18 Commits

• Python: Add Foundry Toolbox MCP skills hosted agent sample (#6363)

  * Add 12_foundry_toolbox_mcp_skills hosted agent sample
  
  Demonstrates using MCPSkillsSource with a Foundry Toolbox MCP endpoint
  to discover and serve skills via SkillsProvider (progressive disclosure).
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Fix env var reference in README and reuse local var in main.py
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Potential fix for pull request finding
  
  Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
  
  * Require AZURE_AI_MODEL_DEPLOYMENT_NAME and use placeholder in .env.example
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Document Toolbox MCP skills vs Foundry Skills in sample README
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Reference 12_foundry_toolbox_mcp_skills in parent README
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: SergeyMenshykh <SergeMenshikh@outlook.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

  SergeyMenshykh · 2026-06-09 08:38:19 +00:00
  caa75f7cdd
• Python: Refactor workflow as agent pending request handling (#6259)

  * WIP: Refactor Workflow as agent pending request handling
  
  * WIP: debugging empty message bug
  
  * Working: Workflow as agent with function approval
  
  * Address Copilot comments
  
  * Fix mypy
  
  * Address comments and fix pipeline
  
  * Request info non function approval now becomes function call
  
  * Revert uv.lock
  
  * Fix mypy
  
  * Bump min version of azure-ai-project
  
  * Remove RequestInfoFunctionArgs
  
  * fix tests
  
  * Fix failing tests
  
  * Fix sample

  Tao Chen · 2026-06-05 17:23:19 +00:00
  9cafd7e58b
• Python: Fix toolbox consent flow in hosted agent (#6249)

  * Fix toolbox consent flow in hosted agent
  
  * Resolve conflict
  
  * Make unused tool as comment
  
  * Fix tests

  Tao Chen · 2026-06-04 20:28:59 +00:00
  dbc312a78a
• Python: Show more authentication methods in Foundry Toolbox MCP (#5719)

  * Show more authentication methods in Foundry Toolbox MCP
  
  * Remove hardcoded toolbox version num
  
  * Add Foundry MCP OAuth consent handling
  
  * Use message instead of the dedicated item type
  
  * Go back to using OAuthConsentRequestOutputItem
  
  * WIP: sample testing
  
  * Update error code
  
  * Address review on Foundry Toolbox MCP samples
  
  Reviewed feedback addressed:
  
  - Drop the branch-pinned `git+https://...@feature/...` entries from
    `04_foundry_toolbox/requirements.txt`; restore the simple comment + `mcp`
    runtime dep. The git pins were only useful while iterating on the PR and
    shouldn't ship. (eavanvalkenburg)
  
  - Fix the `/toolsets/` typo in both `04_foundry_toolbox/README.md` and
    `06_files/README.md`. Verified empirically against the
    research_toolbox in the test workspace: the toolbox MCP gateway lives at
    `/toolboxes/{name}/mcp?api-version=v1` and requires the
    `Foundry-Features: Toolboxes=V1Preview` header. `/toolsets/{name}/mcp`
    returns 403 with `preview_feature_required: Toolsets=V1Preview` (a
    different opt-in feature).
  
  - Wrap `httpx.AsyncClient(...)` in `async with ... as http_client:` in both
    samples so the connection pool is cleaned up. (Copilot reviewer)
  
  - Make the `TOOLBOX_NAME` env var consistent in both samples. Previously the
    tool name silently fell back to `"toolbox"` when `TOOLBOX_NAME` was unset,
    but `resolve_toolbox_endpoint()` still required `TOOLBOX_NAME` and would
    raise `KeyError`. The samples now resolve the endpoint once and derive the
    tool name from the resolved URL when `TOOLBOX_NAME` isn't set, so the
    local tool name always matches the upstream toolbox identity regardless
    of which env var the user set. (Copilot reviewer)
  
  - Rename `_responses.is_consent_error` to `consent_url_from_error`: the
    helper returns `str | None` (the consent URL), not a bool, so the new
    name matches behavior. Update the test class accordingly. (eavanvalkenburg)
  
  - Tighten `_handle_inner_agent`'s lazy-entry catch from `Exception` to
    `AgentFrameworkException`, the type the MCP layer actually wraps consent
    errors in via `MCPStreamableHTTPTool.__aenter__` →
    `ToolExecutionException(inner_exception=mcp_error)`. Network failures,
    cancellations, and other non-framework exceptions now propagate normally
    instead of being briefly caught and re-raised. The test helper
    `_make_consent_error` is updated to use `ToolExecutionException` so it
    matches the real-world wrapping. (eavanvalkenburg)
  
  - Clarify the `github_pat` description in `agent.manifest.yaml` to note
    it's only needed when the PAT-based connection (`github-mcp-pat-conn`)
    is chosen; users selecting the OAuth2 connection (`github-mcp-oauth-conn`)
    can leave it empty. (Copilot reviewer)
  
  Validation: ran both samples end-to-end against a real Foundry toolbox
  (`research_toolbox`) -- the samples connect successfully and the agent
  lists the toolbox's MCP tools (`api_specs___fetch_azure_rest_api_docs`,
  etc.). `uv run poe test -P foundry_hosting` passes (119 tests), pyright +
  mypy clean.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs: fix broken Foundry samples link in 04_foundry_toolbox README
  
  The previous URL pointed to an old location of the toolbox supported-scenarios
  doc; the doc moved to /samples/python/hosted-agents/SUPPORTED_TOOLBOX_SCENARIOS.md
  and the old /samples/python/toolbox/azd path now 404s.
  
  Caught by the markdown-link-check CI step.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Eduard van Valkenburg <eavanvalkenburg@users.noreply.github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Tao Chen · 2026-05-20 12:00:38 +00:00
  d74d26c917
• [BREAKING] Python: Enable instrumentation by default (#5865)

  * Enable instrumentation by default
  
  * Update samples
  
  * Optimization when span is not recording
  
  * Address Copilot comments
  
  * Revert uv.lock
  
  * Add warning
  
  * Formatting
  
  * Fix mypy
  
  * Add disable_instrumentation() with sticky user-intent semantics
  
  Add a public disable_instrumentation() entry point so users can explicitly opt
  out of Agent Framework telemetry, with a sticky-disable flag that makes the
  user's intent "leading" — no framework code path (foundry's
  configure_azure_monitor, configure_otel_providers, enable_instrumentation,
  enable_sensitive_telemetry, or direct OBSERVABILITY_SETTINGS.enable_*
  writes) can re-enable instrumentation until the user explicitly clears the
  disable with enable_instrumentation(force=True) /
  enable_sensitive_telemetry(force=True).
  
  Also addresses the two remaining unresolved review threads on the PR:
  1. test_observability_settings_defaults_instrumentation_true pins the new
     "ENABLE_INSTRUMENTATION defaults to True when env unset" behavior.
  2. test_enable_instrumentation_reads_env_sensitive_data restores coverage
     for the post-import load_dotenv() fallback path.
  
  Implementation:
  - ObservabilitySettings.enable_instrumentation / enable_sensitive_data become
    properties backed by _enable_*. While _user_disabled is True, the getters
    return False and the setters drop True writes (defense in depth so third-
    party writes can't subvert the disable).
  - Public is_user_disabled read-only property lets integrations (e.g. foundry's
    configure_azure_monitor) cheaply check the disable state without poking at
    privates.
  - enable_instrumentation() and enable_sensitive_telemetry() short-circuit with
    an info log when disabled; gain a force=True kwarg that clears the disable.
  - configure_otel_providers() still creates providers / exporters / views so a
    later force-enable can use them, but logs an info message when called while
    disabled.
  - Foundry's FoundryChatClient.configure_azure_monitor and
    FoundryAgent.configure_azure_monitor early-return when the user has
    disabled, so Azure Monitor's global providers aren't installed unnecessarily.
  
  Tests: 11 new tests covering default-on, env re-read at call time, sticky
  behavior against each re-enable surface (enable_instrumentation,
  enable_sensitive_telemetry, configure_otel_providers, direct attribute
  writes), force=True override, re-arming the disable, and the __all__ export.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs: document disable_instrumentation() and force=True paths
  
  Add a "Disabling instrumentation" section to the observability sample README
  that walks through:
  
  - The distinction between the ENABLE_INSTRUMENTATION env var (initial,
    non-sticky) and disable_instrumentation() (process-wide, sticky).
  - Why the sticky semantics matter: framework integrations like
    FoundryChatClient.configure_azure_monitor() can call
    enable_instrumentation() as part of their setup, and the user's opt-out
    needs to win.
  - All five surfaces guarded by the sticky disable (property reads, public
    enable functions, configure_otel_providers, direct attribute writes,
    is_user_disabled-aware integrations).
  - The force=True escape hatch on both enable_instrumentation() and
    enable_sensitive_telemetry().
  - How third-party integrations should consult OBSERVABILITY_SETTINGS.is_user_disabled.
  - The limits of the disable (does not tear down existing providers /
    in-flight spans / third-party instrumentation, does not persist across
    processes).
  
  Cross-links the new section from the ENABLE_INSTRUMENTATION row in the env
  vars table.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs: soften disable_instrumentation() overclaim about telemetry guarantees
  
  Replace 'no telemetry will be emitted no matter what' (which is too strong,
  since callers can still pass force=True or mutate private attributes) with
  language framing the disable as a user-intent contract that library and
  framework code is expected to honor: the framework actively short-circuits
  the public enable paths, force=True and private-attribute writes are
  acknowledged as out-of-contract escape hatches that integrations should
  not use on the user's behalf.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs: correct observability Dependencies section
  
  - opentelemetry-sdk is no longer a hard dependency; it is lazily imported by
    create_resource(), create_metric_views(), and configure_otel_providers()
    with a clear ImportError when missing. Day-to-day instrumentation works
    with opentelemetry-api alone provided some other component configures the
    global OpenTelemetry providers (Azure Monitor, an APM agent, application
    bootstrap, etc.).
  - opentelemetry-semantic-conventions-ai is no longer used anywhere in the
    source; remove it from the listed dependencies.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * docs: replace stale observability migration guide with current PR's only relevant migration
  
  The old guide documented the move away from setup_observability(otlp_endpoint=...)
  which was an earlier-release API change unrelated to this PR and stale enough that
  it's more confusing than helpful at this point. Replace it with a short note on the
  single migration this PR introduces: callers of
  enable_instrumentation(enable_sensitive_data=True) should switch to
  enable_sensitive_telemetry(). Cross-link to the Disabling instrumentation section
  for the rare 'force on without enabling sensitive data' use case where
  enable_instrumentation() still applies.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Eduard van Valkenburg <eavanvalkenburg@users.noreply.github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Tao Chen · 2026-05-20 11:52:08 +00:00
  72a6157c6a
• Python: feat: add agent-framework-monty (Monty-backed CodeAct provider) (#5915)

  * Python: feat: add agent-framework-monty (Monty-backed CodeAct)
  
  New alpha package that wraps pydantic-monty (a Rust-based Python
  interpreter) behind the same CodeAct API surface as
  agent-framework-hyperlight, so users can swap providers with minimal
  code change.
  
  Public API (agent_framework_monty):
  - MontyCodeActProvider — ContextProvider that injects a run-scoped
    execute_code tool plus dynamic CodeAct instructions.
  - MontyExecuteCodeTool — standalone FunctionTool for mixed-tool agents
    or manual static wiring.
  - FileMount / FileMountInput / MountMode — public types mirroring the
    Hyperlight names, with Monty's mode (read-only/read-write/overlay)
    and write_bytes_limit on FileMount.
  
  Constructor kwargs (both classes) mirror Hyperlight where possible:
  tools, approval_mode, workspace_root, file_mounts; plus a Monty-only
  resource_limits forwarding ResourceLimits to Monty.start().
  
  Filesystem flow:
  - workspace_root auto-mounts at /input (read-write), matching Hyperlight.
  - file_mounts accepts string shorthand, (host, mount) tuple, or
    FileMount with mode + write cap.
  - Files written under read-write mounts are scanned post-execution and
    returned as Content.from_data items (mirrors Hyperlight /output).
  - overlay mounts buffer writes in-memory; read-only mounts reject writes.
  
  Internals:
  - _monty_bridge.InlineCodeBridge ports the inline (non-durable) bridge
    from anthonychu/maf-codeact-monty-python; handles FunctionSnapshot /
    FutureSnapshot pause/resume, dispatches direct typed calls + the
    call_tool fallback, forwards mount/limits to Monty.start(...).
  - generate_type_stubs emits per-tool stubs so Monty's `ty` type-checker
    rejects bad calls before any host tool runs.
  
  Alpha-policy compliance (per python-package-management skill):
  - Added agent-framework-monty = { workspace = true } to root
    pyproject.toml.
  - Added row to python/PACKAGE_STATUS.md.
  - Added monty entry under Experimental in python/AGENTS.md.
  - NOT added to core[all]; NO agent_framework.monty lazy shim (deferred
    to beta promotion).
  
  Samples (three sets, import from agent_framework_monty directly):
  - samples/02-agents/context_providers/code_act/monty_code_act.py
    (provider pattern) + updated local README.
  - samples/02-agents/tools/monty_code_interpreter/ (standalone +
    manual-wiring + README).
  - samples/04-hosting/foundry-hosted-agents/responses/11_monty_codeact/
    (full hosted-agent layout with uv-based pyproject.toml + Dockerfile,
    Azure Monitor wiring via APPLICATIONINSIGHTS_CONNECTION_STRING +
    enable_instrumentation, ENABLE_INSTRUMENTATION and
    ENABLE_SENSITIVE_DATA env vars). The alpha wheel is vendored into
    ./wheels/ (gitignored) via vendor-wheel.sh; new row added to the
    parent Responses-API README.
  
  Tests:
  - 28 hermetic unit tests (stubbed pydantic_monty).
  - 18 integration tests marked @pytest.mark.integration, auto-skipped
    when pydantic_monty is unimportable; exercise the real Monty
    runtime: print round-trip, last-expression value, direct typed
    tool dispatch, call_tool fallback, async tool, asyncio.gather
    parallelism, ty type-check rejection, OS blocked by default,
    workspace_root read+write capture, read-only / overlay mount
    semantics, resource_limits.max_duration_secs abort, approval
    gating end-to-end, full Agent run with a scripted chat client.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix: monty FileMount test compares against the normalized POSIX path
  
  The shorthand string mount goes through _normalize_mount_path, which
  rewrites Windows drive letters like 'C:\\Users\\...' into
  '/C:/Users/...' (POSIX-style). The Windows CI runners surfaced this
  because tmp_path resolves to a backslashed Windows path; the test was
  comparing against the raw str(host_a) instead of the normalized form.
  
  Compare against _normalize_mount_path(str(host_a)) so the assertion is
  platform-independent.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix: address PR #5915 review feedback
  
  - _execute_code_tool docstring: clarify that the Monty backend supports
    scoped filesystem access via workspace_root / file_mounts (blocked by
    default).
  - _to_monty_mount: import pydantic_monty lazily through load_monty so
    missing-dependency errors surface as the same actionable RuntimeError
    the rest of the package raises (not a bare ImportError at module load).
    Renamed _load_monty -> load_monty for the same reason.
  - _python_type_repr: emit None for type(None) instead of Any, and
    normalize both typing.Union[...] and PEP-604 X | Y to PEP-604 syntax
    so Optional[X] / Union[..., None] / -> None signatures round-trip
    correctly through ty validation. Added a regression test.
  - _PrintCollector: track a running character count instead of
    recomputing sum(len(c) for c in self.chunks) per callback. Eliminates
    the O(n^2) cost on print-heavy code.
  - Instructions: mention that the value of the final expression is also
    returned alongside captured stdout (matches actual behavior).
  - 11_monty_codeact Dockerfile: pin ghcr.io/astral-sh/uv to 0.11.6
    instead of :latest for reproducible builds.
  - 11_monty_codeact README: replace the bare "see parent README" pointer
    with sample-specific steps (./vendor-wheel.sh + uv sync + uv run),
    since the sample uses pyproject.toml + a vendored wheel rather than
    requirements.txt.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: sample: 11_monty_codeact installs agent-framework-monty from PyPI
  
  Drop the vendored-wheel scaffolding now that agent-framework-monty is on
  PyPI as an alpha (1.0.0a*) release:
  
  - pyproject.toml: remove [tool.uv.sources] override; keep [tool.uv]
    prerelease = "allow" so uv pulls the alpha automatically.
  - Dockerfile: drop the COPY wheels/ step.
  - README: drop the ./vendor-wheel.sh setup step and the
    not-yet-on-PyPI warning.
  - Delete vendor-wheel.sh and the gitignored wheels/ directory.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): harden post-execution file capture against symlink escape
  
  Same class of issue as the MSRC-reported Hyperlight finding: the
  post-execution capture walked workspace_root with Path.rglob() +
  is_file() + read_bytes() - all of which follow symlinks. An attacker
  who controls the workspace (cloned repo, extracted archive, shared
  workspace) could pre-place `workspace/leak.txt -> /etc/passwd` or
  `workspace/outside_dir -> /etc/` and have host files surface as
  captured Content items.
  
  Monty's mount layer already rejects symlink reads from inside the
  sandbox across all three modes (verified empirically), so the runtime
  path was safe. This commit closes the post-execution scan path.
  
  Changes:
  - New `_iter_real_files(root)` walker that uses iterdir() +
    is_symlink() to skip symlinks at every directory level and yields
    only real files. Replaces the previous `host_root.rglob("*")` calls
    in both `_snapshot_writable_mounts` and `_capture_written_files`.
  - Use `Path.lstat()` instead of `Path.stat()` so size/mtime can never
    be taken from a symlink target.
  - Three new integration tests reproducing the MSRC attack shape
    against the workspace_root flow: symlink-to-file outside workspace,
    symlink-to-directory outside workspace, and a guard ensuring
    legitimate sandbox writes are still captured when symlinks are
    present.
  
  Per user request, hyperlight is untouched in this commit (separate fix).
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): skip symlink regression tests when unsupported
  
  Apply the same Windows-CI safety guard as the hyperlight fix in PR #5919:
  the three symlink integration tests create symlinks via Path.symlink_to(),
  which fails with OSError / NotImplementedError on unprivileged Windows
  runners. Add a local _symlinks_supported helper (mirroring the one in
  packages/core/tests/core/test_skills.py) and pytest.skip when symlinks
  aren't available, so the tests no longer fail for environment reasons.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: fix(monty): address PR #5915 follow-up review feedback
  
  - _invoke_tool: drop the inspect.iscoroutinefunction(...) branch and
    always `await self.tool_map[name](**kwargs)`. Every entry in
    tool_map is `partial(FunctionTool.invoke, skip_parsing=True)` and
    FunctionTool.invoke is `async def`, so the branching was dead code -
    and on Python versions affected by cpython#98590,
    iscoroutinefunction(partial(bound_async_method, ...)) returns False,
    causing the bridge to take the asyncio.to_thread path, return an
    unawaited coroutine, and surface it as a JSON-serialization failure
    for every tool call. Added a regression test
    test_invoke_tool_awaits_partial_wrapped_async_method.
  
  - generate_type_stubs: skip tools whose name is not a valid Python
    identifier or is a Python keyword. FunctionTool.name has no upstream
    validation, so a name like "weird-name" produced a syntax error in
    the stubs and a name like "broken\n    pass\nasync def injected"
    would inject arbitrary stub source. Non-identifier names stay
    reachable via `call_tool("weird-name", ...)` at runtime; they just
    don't get type-checked stubs. Added regression test
    test_generate_type_stubs_skips_non_identifier_tool_names.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-20 00:35:23 +00:00
  4609535e22
• Python: Improve the handling of intermediate outputs for workflows and orchestrations (#5623)

  * Improve the handling of intermediate outputs for workflows and orchestrations
  
  * Address PR review feedback on intermediate output forwarding
  
  - Switch workflow.as_agent() forwarding to an explicit allowlist of {output,
    intermediate, data, request_info} so orchestration-internal events
    (group_chat, handoff_sent, magentic_orchestrator) stay inside the workflow
    instead of leaking into agent responses via str(data) coercion.
  - Stop raising on intermediate AgentResponseUpdate in non-streaming run();
    surface the partial as a Message with text_reasoning content. The defensive
    raise still applies to terminal output events, where Update payloads would
    corrupt message ordering.
  - Extend the DevUI workflow-event mapper so intermediate yields wrapping
    plain strings, Messages, and list[Message] render as visible output items
    instead of generic completed-trace events.
  - Add orchestration coverage for GroupChat, Handoff, and Magentic builders
    (default vs intermediate_outputs=True; structural where end-to-end is heavy).
  
  * Lift output-designation policy into a value type
  
  Replace the ``Workflow._output_executors`` list and the
  ``RunnerContext.should_label_as_intermediate`` Protocol method with a single
  immutable ``OutputDesignation`` value type owned by ``Workflow``. Thread the
  designation as a parameter through the existing call chain (Runner ->
  EdgeRunner -> Executor -> WorkflowContext) so ``yield_output`` consults the
  threaded snapshot directly rather than calling back into the runner context.
  
  Removes the ``InProcRunnerContext._workflow`` back-reference and the
  ``WorkflowBuilder.build()`` assignment that wired it up. Adds the public
  predicate ``Workflow.is_terminal_executor(executor_id)`` for external
  observers; ``OutputDesignation`` itself stays package-internal.
  
  Key decisions
  - ``OutputDesignation.designated`` is ``frozenset[str] | None`` -- ``None``
    preserves legacy "every yield is type='output'" behavior, any frozenset
    (including empty) opts into strict mode. The ``DeprecationWarning`` for
    legacy mode at build time is unchanged.
  - ``output_designation`` is an optional parameter on ``Runner``,
    ``EdgeRunner.send_message``, ``EdgeRunner._execute_on_target``,
    ``Executor.execute``, ``Executor._create_context_for_handler``, and
    ``WorkflowContext.__init__``. Each defaults to legacy ``OutputDesignation()``
    so direct callers (Azure Functions ``CapturingRunnerContext``,
    ``test_runner`` recording fixtures) keep working without ceremony.
  - The workflow-level filter in ``_run_core`` reads ``self._output_designation``
    live, preserving today's semantics where mutating the designation after
    build still affects subsequent runs (used by two existing tests).
  - ``Workflow.to_dict()`` continues to emit ``"output_executors":
    list[str] | None`` (sorted from the frozenset). Checkpoint format unchanged.
  
  Files changed
  - _workflow.py: add ``OutputDesignation`` dataclass; replace
    ``_output_executors`` with ``_output_designation``; add
    ``is_terminal_executor``; delete ``_should_yield_output_event``.
  - _runner_context.py: drop ``should_label_as_intermediate`` Protocol method
    and ``InProcRunnerContext`` impl; drop ``_workflow`` back-reference.
  - _workflow_builder.py: remove ``context._workflow = workflow`` assignment.
  - _runner.py, _edge_runner.py, _executor.py, _workflow_context.py: thread
    ``output_designation`` parameter through the call chain.
  - tests/workflow/test_output_designation.py (new): three-state coverage of
    the value type plus the public predicate delegation.
  - tests/workflow/test_workflow_builder.py, test_validation.py,
    test_workflow.py, test_runner.py and
    orchestrations/tests/test_orchestration_intermediate_vs_terminal.py:
    switch probes from ``_output_executors`` set checks to
    ``get_output_executors`` / ``is_terminal_executor``; update two
    post-build mutation tests to set ``_output_designation`` instead.
  
  Verification
  - core/tests/workflow/, orchestrations/tests/, azurefunctions/tests/:
    1119 passed, 42 skipped, 2 xfailed.
  - ``uv run poe lint``: clean.
  - ``uv run poe typing``: only the pre-existing
    ``_AGENT_FORWARDED_EVENT_TYPES`` pyright warning from 394bcd607 remains.
  
  Notes for next iteration
  - The builder's own ``_output_executors`` attribute (``list[Executor |
    SupportsAgentRun]``) is intentionally untouched; the issue scoped the
    rename to the workflow attribute.
  - Adjacent review candidates (twin ``WorkflowAgent`` translators,
    ``_AGENT_FORWARDED_EVENT_TYPES`` kind classifier,
    ``_event_origin_context`` ContextVar removal, ``WorkflowEvent`` ADT
    split, legacy-mode removal) remain out of scope.
  
  * Add explicit workflow output designation
  
  Key decisions
  
  - Extend the internal OutputDesignation value type from terminal-only membership to output/intermediate/hidden classification. Legacy mode remains outputs=None, so workflows built without output_executors or intermediate_executors still label every yield_output as type='output'.
  
  - WorkflowBuilder now accepts intermediate_executors. Providing either designation enters explicit mode; output executors emit output, intermediate executors emit intermediate, and unlisted yield_output payloads are hidden from caller-facing events while remaining in executor_completed data.
  
  - Empty explicit designation, duplicate entries, overlaps, unknown executors, and designated executors without workflow output annotations fail build validation. Existing orchestration builders pass intermediate-capable participants through intermediate_executors to preserve current intermediate_outputs behavior until participant-oriented designation lands.
  
  Files changed
  
  - packages/core/agent_framework/_workflows/_workflow.py, _workflow_builder.py, _workflow_context.py, _validation.py, _events.py
  
  - packages/core/tests/workflow/test_output_designation.py, test_output_executors_contract.py, test_strict_mode_event_labeling.py, test_validation.py, test_workflow.py, test_workflow_agent_intermediate.py
  
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py, _concurrent.py, _group_chat.py, _magentic.py
  
  - packages/core/AGENTS.md
  
  Verification
  
  - uv run pytest packages/core/tests/workflow packages/orchestrations/tests packages/devui/tests/devui/test_mapper.py -q
  
  - uv run pytest packages/azurefunctions/tests -q
  
  - uv run poe lint
  
  - uv run poe typing fails only on pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  Notes for next iteration
  
  - issues/03-core-workflow-explicit-designation.md was moved to issues/done but issues/ remains untracked and intentionally excluded from this commit.
  
  - Slice 4 should tighten workflow.as_agent() mapping for hidden emissions and streaming-only update payloads; Slice 5 should replace orchestration intermediate_outputs with participant-oriented designation.
  
  * Tighten workflow-as-agent output mapping
  
  Key decisions
  
  - Treat AgentResponseUpdate as a streaming-only payload across the workflow.as_agent() adapter, so non-streaming agent runs now reject both terminal output and intermediate workflow events carrying updates.
  - Keep streaming classification behavior explicit: terminal update payloads remain normal text content, while intermediate update payloads are rewritten to text_reasoning content.
  - Add explicit-mode coverage proving hidden yield_output emissions do not appear in non-streaming AgentResponse messages or streaming AgentResponseUpdate chunks.
  
  Files changed
  
  - packages/core/agent_framework/_workflows/_agent.py
  - packages/core/tests/workflow/test_workflow_agent_intermediate.py
  
  Verification
  
  - uv run pytest packages/core/tests/workflow/test_workflow_agent_intermediate.py -q
  - uv run pytest packages/core/tests/workflow/test_workflow_agent.py packages/core/tests/workflow/test_workflow_agent_intermediate.py -q
  - uv run pytest packages/core/tests/workflow packages/orchestrations/tests packages/devui/tests/devui/test_mapper.py -q
  - uv run poe lint
  - uv run poe typing fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  Blockers or notes for next iteration
  
  - issues/04-workflow-as-agent-output-mapping.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - Slice 5 should replace orchestration intermediate_outputs with participant-oriented designation.
  
  * Add orchestration participant output designation
  
  Key decisions
  
  - Replace orchestration intermediate_outputs with participant-oriented output_participants and intermediate_participants across Sequential, Concurrent, GroupChat, Magentic, and Handoff builders.
  - Keep synthetic final executors terminal by default for Concurrent, GroupChat, and Magentic; keep Sequential's final participant terminal by default; keep Handoff participants terminal by default.
  - Centralize participant designation validation for empty explicit designation, duplicates, overlaps, and unknown participants, then map validated participants to workflow output/intermediate executors.
  
  Files changed
  
  - packages/orchestrations/agent_framework_orchestrations/_participant_designation.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - packages/orchestrations/agent_framework_orchestrations/_concurrent.py
  - packages/orchestrations/agent_framework_orchestrations/_group_chat.py
  - packages/orchestrations/agent_framework_orchestrations/_magentic.py
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/tests/test_orchestration_intermediate_vs_terminal.py
  - packages/orchestrations/tests/test_magentic.py
  
  Blockers or notes for next iteration
  
  - issues/05-orchestration-participant-designation.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - Slice 7 should migrate samples and docs away from intermediate_outputs to the new participant designation API.
  - uv run poe typing still fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  * Migrate samples to explicit output designation
  
  Key decisions
  
  - Replace sample usage of the removed orchestration intermediate_outputs boolean with participant-oriented intermediate_participants designation.
  - Update raw workflow guidance to show output_executors together with intermediate_executors, and document that unlisted yields are hidden in explicit designation mode.
  - Keep orchestration final outputs terminal while streaming designated participant responses as intermediate progress, including workflow.as_agent() samples where intermediates map to text_reasoning content.
  - Refresh workflow and orchestration README guidance plus the changelog reference so public docs no longer point users at intermediate_outputs.
  
  Files changed
  
  - CHANGELOG.md
  - packages/orchestrations/README.md
  - samples/README.md
  - samples/03-workflows/README.md
  - samples/03-workflows/control-flow/intermediate_vs_terminal_outputs.py
  - samples/03-workflows/orchestrations/README.md
  - samples/03-workflows/orchestrations/group_chat_agent_manager.py
  - samples/03-workflows/orchestrations/group_chat_philosophical_debate.py
  - samples/03-workflows/orchestrations/group_chat_simple_selector.py
  - samples/03-workflows/orchestrations/magentic.py
  - samples/03-workflows/orchestrations/magentic_human_plan_review.py
  - samples/03-workflows/orchestrations/sequential_chain_only_agent_responses.py
  - samples/03-workflows/agents/group_chat_workflow_as_agent.py
  - samples/03-workflows/agents/magentic_workflow_as_agent.py
  - samples/03-workflows/agents/sequential_workflow_as_agent.py
  - samples/semantic-kernel-migration/orchestrations/group_chat.py
  - samples/semantic-kernel-migration/orchestrations/magentic.py
  
  Blockers or notes for next iteration
  
  - issues/07-samples-and-docs-explicit-output-designation.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - issues/06-devui-intermediate-event-rendering.md remains present and appears already satisfied by existing DevUI mapper/tests from the prior implementation slice.
  - PRD-explicit-workflow-output-designation.md remains untracked and intentionally excluded from this commit.
  
  * Render DevUI intermediate workflow outputs
  
  Key decisions
  
  - Preserve workflow output designation metadata on visible DevUI output messages and text deltas so intermediate/data emissions remain distinguishable from terminal output.
  - Render intermediate workflow message items in the execution timeline using executor metadata, while excluding them from the final workflow result aggregation.
  - Keep terminal output message rendering unchanged and retain legacy data events on the intermediate compatibility path.
  
  Files changed
  
  - packages/devui/agent_framework_devui/_mapper.py
  - packages/devui/frontend/src/components/features/workflow/execution-timeline.tsx
  - packages/devui/frontend/src/components/features/workflow/workflow-view.tsx
  - packages/devui/frontend/src/types/openai.ts
  - packages/devui/tests/devui/test_mapper.py
  
  Blockers or notes for next iteration
  
  - issues/06-devui-intermediate-event-rendering.md was moved to issues/done/ but issues/ remains untracked and intentionally excluded from this commit.
  - PRD-explicit-workflow-output-designation.md remains untracked and intentionally excluded from this commit.
  - uv run poe typing still fails only on the pre-existing packages/core/agent_framework/_workflows/_agent.py _AGENT_FORWARDED_EVENT_TYPES private-use pyright error.
  
  * Fix mypy
  
  * Clarify orchestration participant output config
  
  * Rename participant output kwargs for clarity
  
  output_participants -> final_output_from, intermediate_participants ->
  intermediate_output_from. The old names read like categories of
  participant; the new names make it clear the kwarg designates which
  participants' outputs surface as final vs. intermediate events.
  
  * Rename core workflow output kwargs with deprecation shim
  
  Adds final_output_from / intermediate_output_from as canonical kwargs on
  Workflow and WorkflowBuilder. Old output_executors / intermediate_executors
  kwargs continue to work but emit DeprecationWarning via a shared coalesce
  helper that also rejects supplying both. Wire-format keys in to_dict()
  stay as output_executors / intermediate_executors so checkpoint
  compatibility is preserved.
  
  Internal call sites in orchestrations and samples updated to the new
  names so users following sample code learn the canonical vocabulary;
  legacy callers still work with a one-shot warning.
  
  * Suppress pyright reportPrivateUsage on cross-module sentinel import
  
  * Update docstrings
  
  * Propagate sub-workflow intermediate outputs, fix handoff/sequential intermediate-only designation, and shore up tests, sample, and docstrings around the intermediate output contract.
  
  * Add canonical workflow output_from selection
  
  Key decisions:\n- Make output_from the canonical workflow-output allow-list and keep output_executors/final_output_from as deprecated compatibility aliases.\n- Treat empty output_from/intermediate_output_from lists as explicit selections and keep validation responsible for empty, duplicate, overlap, and unknown selections.\n- Remove the branch-only public intermediate_executors WorkflowBuilder kwarg while preserving legacy wire keys in to_dict().\n\nFiles changed:\n- packages/core/agent_framework/_workflows/_workflow.py\n- packages/core/agent_framework/_workflows/_workflow_builder.py\n- packages/core/agent_framework/_workflows/_workflow_context.py\n- packages/core/agent_framework/_workflows/_agent.py\n- packages/core/agent_framework/_workflows/_agent_executor.py\n- packages/core/tests/workflow/* output-selection coverage updates\n- packages/core/AGENTS.md\n- issues/done/001-canonical-list-based-output-selection.md\n\nBlockers/notes:\n- Orchestration builders still pass final_output_from internally; follow-up issue 004 should migrate them to output_from.\n- Legacy omitted-selection behavior and explicit all/all_other literals are left for issues 002 and 003.
  
  * Add explicit all workflow output selection
  
  Key decisions:
  - Treat output_from='all' as an explicit workflow-output selection sentinel and expand it at build time to executors with declared workflow output types.
  - Keep omitted output selections in legacy all-output mode with a deprecation warning that names output_from and intermediate_output_from and points to output_from='all'.
  - Reject intermediate_output_from='all' at construction because the all-output literal is output-only for this issue.
  
  Files changed:
  - packages/core/agent_framework/_workflows/_workflow_builder.py
  - packages/core/tests/workflow/test_output_executors_contract.py
  - issues/done/002-explicit-all-output-and-legacy-migration.md
  
  Blockers/notes:
  - all_other intermediate-output selection remains for issue 003.
  - Workflow-as-agent/orchestration parity remains for issue 004.
  
  * Add all-other intermediate output selection
  
  Key decisions:
  - Treat intermediate_output_from='all_other' as an explicit intermediate-output selection sentinel and expand it at build time after the workflow graph is complete.
  - Expand all_other to output-capable executors not selected by output_from; omitted or empty output_from selects no workflow outputs, while output_from='all' leaves an empty intermediate selection.
  - Keep output_from='all_other' invalid so all_other remains intermediate-output-only and runtime classification still receives concrete executor-id sets.
  
  Files changed:
  - packages/core/agent_framework/_workflows/_workflow_builder.py
  - packages/core/tests/workflow/test_output_executors_contract.py
  - issues/done/003-all-other-intermediate-output-selection.md
  
  Blockers/notes:
  - Workflow-as-agent and orchestration parity remains for issue 004.
  - Full documentation updates remain for issue 005.
  
  * Add orchestration output selection parity
  
  Key decisions:
  - Expose output_from on sequential, concurrent, group chat, handoff, and magentic builders while keeping final_output_from as a deprecated compatibility alias.
  - Resolve orchestration participant selections through the same explicit rules as workflows: output_from='all', intermediate_output_from='all_other', hidden unselected participant payloads, and overlap/duplicate/unknown/invalid-literal validation.
  - Continue preserving documented orchestration defaults by always designating each pattern's terminal internal executor where applicable.
  
  Files changed:
  - packages/orchestrations/agent_framework_orchestrations/_participant_output_config.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - packages/orchestrations/agent_framework_orchestrations/_concurrent.py
  - packages/orchestrations/agent_framework_orchestrations/_group_chat.py
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/agent_framework_orchestrations/_magentic.py
  - packages/orchestrations/agent_framework_orchestrations/_orchestration_request_info.py
  - packages/orchestrations/tests/test_orchestration_intermediate_vs_terminal.py
  - issues/done/004-workflow-as-agent-and-orchestration-parity.md
  
  Blockers/notes:
  - Full documentation and sample migration wording remains for issue 005.
  - Existing tests that intentionally use final_output_from now emit the new deprecation warning.
  
  * Document workflow output selection contract
  
  Key decisions:
  - Use Workflow Output and Intermediate Output as the developer-facing terms for selected caller-facing emissions.
  - Document output_from and intermediate_output_from as the canonical API, with output_from as an allow-list and unselected payloads hidden unless explicitly selected as intermediate.
  - Add scenario and invalid-selection tables for workflow and orchestration docs, including legacy omission warnings, output_from='all', intermediate_output_from='all_other', list selections, invalid literals, overlap, duplicates, unknown selections, and empty explicit selections.
  - Migrate samples away from final_output_from and output_executors except where compatibility aliases are explicitly documented.
  
  Files changed:
  - packages/core/AGENTS.md
  - packages/orchestrations/README.md
  - packages/orchestrations/agent_framework_orchestrations/_handoff.py
  - packages/orchestrations/agent_framework_orchestrations/_sequential.py
  - samples/03-workflows/README.md
  - samples/03-workflows/control-flow/intermediate_vs_terminal_outputs.py
  - samples/03-workflows/human-in-the-loop/agents_with_approval_requests.py
  - samples/03-workflows/orchestrations/README.md
  - samples/04-hosting/foundry-hosted-agents/responses/05_workflows/main.py
  - scripts/sample_validation/create_dynamic_workflow_executor.py
  - issues/done/005-document-output-selection-contract.md
  
  Blockers/notes:
  - Direct full Ruff on scripts/sample_validation/create_dynamic_workflow_executor.py still reports pre-existing docstring/print/line-length issues outside this docs migration; syntax-focused checks for changed files pass.
  - No remaining AFK issue files are present under issues/.
  
  * Latest updates
  
  * Typing fixes
  
  * Cleanup

  Evan Mattson · 2026-05-19 00:15:25 +00:00
  3bbc81554b
• Python: New Foundry Hosted Agents samples: RAG, Skills, and Memory (#5822)

  * WIP: Add rag sample; need deployment testing
  
  * Rag sample ready
  
  * Add Foundry Skills sample
  
  * WIP: Foundry memory
  
  * Done: Foundry Memory
  
  * Address Copilot comments
  
  * Fix README
  
  * Restore uv.loack

  Tao Chen · 2026-05-15 17:31:57 +00:00
  da308f5f1e
• Python: Add support for function approval flow in Foundry hosted agent (#5666)

  * Add support for function approval flow in Foundry hosted agent
  
  * Address comments
  
  * Address comments
  
  * Address comments

  Tao Chen · 2026-05-07 14:55:26 +00:00
  213491da66
• Python: Remove bespoke Foundry toolbox helpers; standardize on MCP for toolbox consumption (#5671)

  * Remove Foundry toolbox helpers; standardize on MCP for toolbox consumption
  
  - Remove RawFoundryChatClient.get_toolbox() and its fetch_toolbox import
  - Remove fetch_toolbox, select_toolbox_tools, get_toolbox_tool_name,
    get_toolbox_tool_type, FoundryHostedToolType, ToolboxToolSelectionInput
    from agent_framework_foundry._tools
  - Remove ExperimentalFeature.TOOLBOXES from _feature_stage.py (no consumers)
  - Drop toolbox re-exports from agent_framework_foundry/__init__.py and
    agent_framework.foundry namespace
  - Update _sanitize_foundry_response_tool docstring to remove toolbox framing;
    sanitization logic itself is unchanged
  - Update _agent.py docstring: 'toolbox-fetched MCP' → 'hosted MCP'
  - Delete tests/test_toolbox.py (all tests covered removed helpers)
  - Update test_foundry_chat_client.py: rename/redoc tests that mentioned
    toolbox but test sanitization that remains
  - Delete foundry_chat_client_with_toolbox.py (bespoke toolbox API sample)
  - Delete foundry_toolbox_context_provider.py (relied on select_toolbox_tools)
  - Rename foundry_chat_client_with_toolbox_mcp.py →
    foundry_chat_client_with_toolbox.py (canonical MCP pattern)
  - Rewrite 04_foundry_toolbox/main.py to use MCPStreamableHTTPTool
  - Update provider/README, context_providers/README, 04_foundry_toolbox/README
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(samples): update 06_files sample to consume toolbox via MCP (#5670)
  
  Replace removed get_toolbox/select_toolbox_tools APIs with
  MCPStreamableHTTPTool, using allowed_tools=["code_interpreter"] to
  select only the code interpreter from the toolbox endpoint.
  
  Update .env.example and README to use FOUNDRY_TOOLBOX_ENDPOINT
  instead of TOOLBOX_NAME.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(foundry): remove non-existent toolbox helper APIs from README (#5670)
  
  Remove the 'fetch, optionally filter, and pass tools directly' pattern
  from the FoundryChatClient toolbox documentation, as select_toolbox_tools
  and get_toolbox were removed. Only the MCP endpoint pattern is documented.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(foundry): remove residual toolbox docstring references and reproduction report
  
  Remove REPRODUCTION_REPORT.md (workflow artifact that should not be committed),
  and update two remaining docstring references that still said 'toolbox reads'
  /'toolbox definition' after the toolbox helpers were removed.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: Remove bespoke Foundry toolbox helpers; standardize on MCP for toolbox consumption
  
  Fixes #5670
  
  * fix(#5670): resolve toolbox endpoint from TOOLBOX_NAME fallback; add namespace regression tests
  
  - Add _resolve_toolbox_endpoint() helper in 04_foundry_toolbox/main.py and
    06_files/main.py that prefers FOUNDRY_TOOLBOX_ENDPOINT but falls back to
    deriving the MCP URL from FOUNDRY_PROJECT_ENDPOINT + TOOLBOX_NAME — fixing
    the startup KeyError when agents are deployed via azd provision (which injects
    TOOLBOX_NAME, not FOUNDRY_TOOLBOX_ENDPOINT).
  - Update 04_foundry_toolbox/.env.example to use FOUNDRY_TOOLBOX_ENDPOINT
    (consistent with 06_files).
  - Add TOOLBOX_NAME env var to 06_files/agent.yaml so deployed agents have it
    available for the fallback derivation.
  - Update both READMEs to document the two ways to supply the toolbox endpoint.
  - Add test_foundry_namespace_no_longer_exposes_toolbox_helpers() with negative
    assertions for FoundryHostedToolType, get_toolbox_tool_name,
    get_toolbox_tool_type, and select_toolbox_tools — guarding against accidental
    re-introduction of removed symbols.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix(samples): fail fast on empty FOUNDRY_TOOLBOX_ENDPOINT; add unit tests
  
  Addresses review feedback for #5670:
  
  - In _resolve_toolbox_endpoint() (04_foundry_toolbox/main.py and
    06_files/main.py) change the walrus-operator check from a truthy
    test to an explicit 'is not None' guard.  An explicitly set empty
    string now raises ValueError immediately with a clear message
    instead of silently falling through to the fallback URL
    construction.
  
  - Add tests/samples/hosting/test_toolbox_endpoint.py covering both
    sample modules:
      (a) FOUNDRY_TOOLBOX_ENDPOINT set → returned as-is
      (b) FOUNDRY_TOOLBOX_ENDPOINT set to empty string → ValueError
      (c) fallback constructs URL from FOUNDRY_PROJECT_ENDPOINT + TOOLBOX_NAME,
          stripping trailing slashes
      (d) neither variable group set → KeyError
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback: remove extraneous test and docstring content
  
  - Remove test_foundry_namespace_no_longer_exposes_toolbox_helpers (no longer warranted)
  - Remove docstring from _agent.py _prepare_tools_for_openai (extraneous)
  - Trim _chat_client.py _prepare_tools_for_openai docstring to one-liner (toolbox references no longer relevant)
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix: remove remaining extraneous docstring from RawFoundryChatClient._prepare_tools_for_openai
  
  Address review comment on PR #5671: reviewer noted the description
  isn't warranted now that toolbox helpers have been removed. Matches
  the pattern in RawFoundryAgentChatClient which has no docstring.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <copilot@github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Evan Mattson · 2026-05-06 23:56:16 +00:00
  e56e6dad4d
• Python: Fix hyperlight WasmSandbox cross-thread Drop and harden hosted-agent sample (#5603)

  * update hyperlight to beta and move samples, add hosted agent sample
  
  * Python: Fix hyperlight WasmSandbox cross-thread Drop and harden sample
  
  Root cause: when a worker-side closure raised, the exception's __traceback__
  retained frame locals that included the partially constructed PyO3 sandbox.
  Future.result() re-raised that exception on the caller thread, and when the
  caller's exception was eventually GC'd the frame locals were released
  off-thread, dec_ref'ing the unsendable sandbox from the wrong thread and
  tripping the PyO3 panic
  '_native_wasm::WasmSandbox is unsendable, but is being dropped on another thread'.
  
  Fix:
  * Add _SandboxWorker._run_on_worker which catches every exception on the
    worker, drops __traceback__ there, deletes the original exception, and
    re-raises a fresh instance on the caller thread. initialize and execute
    route through it; dispose keeps its bare-submit semantics.
  * Add an opt-in diagnostic module _drop_diagnostic (no-op unless
    HYPERLIGHT_TRACE_DROPS=1) that installs a sys.unraisablehook and dumps
    owner-thread + per-thread stacks on any future cross-thread unsendable
    Drop. Useful for triaging similar PyO3 regressions.
  * Tests: cross-thread invocation, traceback-leak isolation, _SandboxEntry
    attribute-shape check, and a stale-reference stress test driven through
    asyncio.to_thread.
  
  Sample (samples/04-hosting/foundry-hosted-agents/responses/06_hyperlight_codeact):
  * Dockerfile installs agent-framework-* from in-tree source with python/ as
    build context so unreleased fixes can be validated end-to-end.
  * call_server.py pins the Responses API version.
  * main.py enables include_detailed_errors=True so future tool failures
    surface the actual exception text instead of a bare 'Error: Function
    failed.' string.
  * README.md documents the in-tree-package build and the Hyperlight
    hypervisor requirement (/dev/kvm on Linux, MSHV on Windows). Hosted
    environments without hypervisor passthrough surface 'No Hypervisor was
    found for Sandbox'; this is a hosting constraint, not a hyperlight bug.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: remove _drop_diagnostic from hyperlight package
  
  The diagnostic module was useful while bisecting the cross-thread Drop bug,
  but it is no longer needed now that _SandboxWorker._run_on_worker prevents
  the panic at the source.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: address PR review feedback on hyperlight
  
  - Use lazy agent_framework.hyperlight import in sample main.py.
  - Env-driven endpoint (FOUNDRY_AGENT_ENDPOINT) in call_server.py; remove personal URLs.
  - Align agent.yaml model deployment with manifest (gpt-4.1-mini).
  - Tighten Dockerfile requirements guard; drop dangling deploy.ps1 reference.
  - Preserve exception args when sanitizing tracebacks in _run_on_worker.
  - Add public _SandboxWorker.is_alive(); update test to avoid private attr.
  - Add namespace coverage tests for agent_framework.hyperlight lazy loader.
  - Add prominent note: Foundry hosted-agent runtime does not yet support
    Hyperlight (no hypervisor exposed); container works locally with /dev/kvm.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: bump hyperlight-sandbox dependencies to 0.4.x
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: renumber hyperlight codeact sample to 08
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Coerce worker exception args to strings for cross-thread safety
  
  Stringify exc.args on the worker thread before propagating, so any
  PyO3 unsendable object captured in args (e.g. via a caller-supplied
  callback or underlying SDK) cannot be Dropped on the calling thread.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * moved sample
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-05-05 10:06:16 +00:00
  57c901a245
• Python: Add hosted agent sample with observability (#5608)

  * Add hosted agent sample with observability
  
  * Address comments
  
  * Remove unneeded changes
  
  * Update README

  Tao Chen · 2026-05-04 22:31:47 +00:00
  5a087885a2
• Python: docs(python/samples): recommend uv venv and document Windows ensurepip hang workaround (#5508)

  * docs(samples): recommend uv venv to avoid Windows ensurepip hang
  
  Replace bare 'python -m venv .venv' with 'uv venv .venv' as the
  recommended approach in azure_functions and foundry-hosted-agents
  READMEs. Add a note explaining that python -m venv can hang
  indefinitely on Windows with Microsoft Store Python due to a known
  ensurepip issue.
  
  This matches the pattern already used in a2a/README.md which uses
  uv run exclusively.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Python: docs(python/samples): recommend `uv venv` and document Windows ensurepip hang workaround
  
  Fixes #5401
  
  * fix: correct Windows venv activation commands in foundry-hosted-agents README (#5401)
  
  Split the Windows activation section into separate PowerShell (.venv\Scripts\Activate.ps1)
  and Command Prompt (.venv\Scripts\activate.bat) instructions, replacing the incorrect
  extensionless `Activate` path.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * Address review feedback for #5401: Python: [Samples][Python] `python -m venv` hangs on Windows — READMEs should recommend uv or document workaround
  
  ---------
  
  Co-authored-by: Copilot <copilot@github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Evan Mattson · 2026-05-04 04:46:17 +00:00
  6582926af5
• Python: Add sample for hosted agent with files (#5596)

  * Add sample for hosted agent with files
  
  * Update python/samples/04-hosting/foundry-hosted-agents/responses/06_files/README.md
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Update python/samples/04-hosting/foundry-hosted-agents/responses/06_files/README.md
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Update python/samples/04-hosting/foundry-hosted-agents/responses/06_files/README.md
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Update python/samples/04-hosting/foundry-hosted-agents/responses/04_foundry_toolbox/README.md
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Update python/samples/04-hosting/foundry-hosted-agents/responses/06_files/README.md
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
  
  * Improve README
  
  * Address comments
  
  ---------
  
  Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

  Tao Chen · 2026-05-01 18:40:42 +00:00
  18293ffb31
• Python: Update hosting agent samples + fixes (#5485)

  * Update foundry hosting samples
  
  * Add file data type support
  
  * Fix file content and add more tests
  
  * Fix README
  
  * Address comments
  
  * Fix int tests
  
  * remove temp

  Tao Chen · 2026-04-28 04:24:05 +00:00
  88347f6494
• Python: update FoundryAgent for hosted agent sessions (#5447)

  * fixes to FoundryAgent to connect to new hosted agents
  
  Co-authored-by: Copilot <copilot@github.com>
  
  * fix mypy
  
  Co-authored-by: Copilot <copilot@github.com>
  
  * Python: remove Foundry service session helpers
  
  Remove the public hosted-agent service session CRUD helpers from FoundryAgent and drop the related feature-stage inventory entry.
  
  Update the hosted-agent sample to create and delete service sessions directly through the preview AIProjectClient APIs, and tighten a few test harnesses surfaced by full workspace validation.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * fix from merge
  
  * fix hosted env detection
  
  Co-authored-by: Copilot <copilot@github.com>
  
  * reverted sample update
  
  * fix tests and code
  
  Co-authored-by: Copilot <copilot@github.com>
  
  * remove aenter
  
  * skipping some tests
  
  Co-authored-by: Copilot <copilot@github.com>
  
  ---------
  
  Co-authored-by: Copilot <copilot@github.com>
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Eduard van Valkenburg · 2026-04-24 09:25:03 +00:00
  62e02da698
• Python: fix(foundry): reconcile toolbox hosted-tool payloads with Responses API (#5414)

  * fix(foundry): reconcile toolbox hosted-tool payloads with Responses API
  
  * docs(foundry): update create_sample_toolbox docstring to reflect all tools created

  Evan Mattson · 2026-04-22 17:43:26 +00:00
  fffd0acb3e
• Python: Foundry hosted agent V2 (#5379)

  * Python: Wrapper + Samples 1st (#5177)
  
  * Experiment
  
  * Update dependency and add non streaming
  
  * Add more samples
  
  * Rename samples
  
  * Add invocations
  
  * Comments 1
  
  * Comments 2
  
  * Comments 3
  
  * Improve README
  
  * Add local shell sample
  
  * WIP: Add eval and memory samples
  
  * Update user agent prefix
  
  * Update user agent prefix doc
  
  * Update dependency (#5215)
  
  * Add tests and more content types (#5235)
  
  * Add tests
  
  * fix tests and sample
  
  * Fix formatting
  
  * Remove function approval contents
  
  * Python: Refine samples and upgrade packages (#5261)
  
  * Refine samples and upgrade pacakges
  
  * Upgrade to a new package that fixes a bug
  
  * Update model env var
  
  * Move samples (#5281)
  
  * Python: Upgrade agentserver packages (#5284)
  
  * Upgrade agentserver packages
  
  * Fix new types
  
  * Python: Add special handling for workflows (#5298)
  
  * Add special handling for workflows
  
  * Address comments
  
  * Improve samples (#5372)
  
  * Python: Add more types (#5378)
  
  * Add more type supports
  
  * Upgrade packages
  
  * Remove TODOs in README
  
  * Fix README
  
  * Comments and mypy
  
  * User agent scoped
  
  * Fix README
  
  * Fix pre commit
  
  * Fix pre commit 2
  
  * Fix pre commit 3
  
  * Fix pre commit 4
  
  * Fix pre commit 5
  
  * Fix pre commit 6
  
  * Add azure-monitor-opentelemetry to dev deps
  
  Fixes Samples & Markdown CI failure. The PR's new transitive dep on
  azure-monitor-opentelemetry-exporter (via azure-ai-agentserver-core) makes
  pyright resolve the azure.monitor.opentelemetry namespace, flipping the
  check_md_code_blocks diagnostic for `configure_azure_monitor` from
  reportMissingImports (filtered) to reportAttributeAccessIssue (not filtered).
  Installing the umbrella azure-monitor-opentelemetry package in dev makes
  pyright resolve the symbol correctly, matching the install guidance the
  observability README already gives users.
  
  ---------
  
  Co-authored-by: Evan Mattson <evan.mattson@microsoft.com>

  Tao Chen · 2026-04-21 05:21:27 +00:00
  ce8b6305d8