Merged and refactored eval module per Eduard's PR review:
- Merge _eval.py + _local_eval.py into single _evaluation.py
- Convert EvalItem from dataclass to regular class
- Rename to_dict() to to_eval_data()
- Convert _AgentEvalData to TypedDict
- Simplify check system: unified async pattern with isawaitable
- Parallelize checks and evaluators with asyncio.gather
- Add all/any mode to tool_called_check
- Fix bool(passed) truthy bug in _coerce_result
- Remove deprecated function_evaluator/async_function_evaluator aliases
- Remove _MinimalAgent, tighten evaluate_agent signature
- Set self.name in __init__ (LocalEvaluator, FoundryEvals)
- Limit FoundryEvals to AsyncOpenAI only
- Type project_client as AIProjectClient
- Remove NotImplementedError continuous eval code
- Add evaluation samples in 02-agents/ and 03-workflows/
- Update all imports and tests (167 passing)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix A2AAgent to invoke context providers before and after run
A2AAgent.run() bypassed the context provider lifecycle (before_run/after_run)
that BaseAgent defines as a contract for all agents. This caused A2AAgent to
violate the semantic definition of BaseAgent, resulting in inconsistency with
other agent implementations.
The fix follows the same pattern used by WorkflowAgent:
- Create SessionContext and run before_run on all context providers before
processing the A2A stream
- Collect response updates and run after_run on all context providers after
the stream is fully consumed
- Auto-create a session when context providers are configured but no session
is explicitly passed
Fixes#4754
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Remove reproduction report from repository
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback for #4754
- Validate messages when no continuation_token: raise ValueError if
normalized_messages is empty, preventing IndexError on messages[-1]
- Import BaseContextProvider/SessionContext from public agent_framework
package instead of internal agent_framework._sessions module
- Add test for ValueError on run(None) without continuation_token
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improve test coverage for empty-messages guard in A2AAgent.run (#4754)
- Parameterize test to cover both messages=None and messages=[] inputs
- Add test verifying run(None, continuation_token=...) does not raise
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix invoke_agent span to aggregate token usage across LLM calls (#4062)
The FunctionInvocationLayer._get_response() loop was overwriting the
response on each iteration, so usage_details only reflected the last
chat completion call. Now tracks aggregated_usage across all iterations
using add_usage_details() and sets it on the returned response.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Remove reproduction report artifact
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Apply pre-commit auto-fixes
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updated automation tasks and commands, with alias for the time being
* Restore aggregate test exclusions
Preserve the legacy all-tests scope for test --all by excluding lab and devui from the default aggregate sweep, while still allowing explicit package selection. Also ignore hidden/generated test directories such as .mypy_cache during aggregate discovery.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updated versions in pre-commit
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: Re-read env vars in configure_otel_providers and enable_instrumentation (#4119)
Fix ENABLE_SENSITIVE_DATA and VS_CODE_EXTENSION_PORT env vars being ignored
when load_dotenv() runs after module import. The module-level
OBSERVABILITY_SETTINGS singleton cached env state at import time, and
configure_otel_providers() / enable_instrumentation() never re-read from
os.environ when parameters were None.
Both functions now construct a fresh ObservabilitySettings() to pick up
current env vars when explicit parameters are not provided, matching the
existing behavior of the env_file_path branch.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback for #4119: avoid throwaway ObservabilitySettings
- Add _read_bool_env/_read_int_env helpers to read env vars without
constructing a full ObservabilitySettings (which calls create_resource())
- Replace ObservabilitySettings() in enable_instrumentation() and
configure_otel_providers() else-branch with direct env reads
- Add enable_console_exporters parameter to configure_otel_providers()
for override parity with enable_sensitive_data and vs_code_extension_port
- Propagate _resource and _executed_setup in the non-env_file_path branch
- Make existing tests hermetic (clear VS_CODE_EXTENSION_PORT and
ENABLE_CONSOLE_EXPORTERS env vars)
- Add tests: enable_console_exporters env refresh, explicit param overrides
for both enable_instrumentation() and configure_otel_providers()
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address remaining review feedback for #4119
- Refresh enable_console_exporters in enable_instrumentation() for
consistency with configure_otel_providers(), so env var changes
after import are picked up by both public API functions
- Make test_configure_otel_providers_reads_env_vs_code_port hermetic
by clearing ENABLE_CONSOLE_EXPORTERS from the environment
- Add test_enable_instrumentation_reads_env_console_exporters to
cover the new refresh behavior
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove unconditional enable_console_exporters overwrite from enable_instrumentation() (#4119)
enable_instrumentation() is documented as not configuring exporters, so
managing enable_console_exporters there was a leaky abstraction. The
unconditional _read_bool_env call silently reset the value to False when
ENABLE_CONSOLE_EXPORTERS was absent from env, clobbering any value
previously set by configure_otel_providers(enable_console_exporters=True).
- Remove the unconditional overwrite line from enable_instrumentation()
- Replace test_enable_instrumentation_reads_env_console_exporters with
test_enable_instrumentation_does_not_touch_console_exporters
- Add regression test: enable_instrumentation() does not clobber a
previously configured enable_console_exporters value
- Add test: explicit enable_sensitive_data param still leaves
enable_console_exporters untouched
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix Content serialization in DurableAgentStateUnknownContent (#4719)
DurableAgentStateUnknownContent.from_unknown_content() stored raw Content
objects without converting them to dicts, causing json.dumps to fail in
Azure Durable Functions' entity state serialization. This affected content
types not explicitly handled (e.g., mcp_server_tool_call/result).
The fix converts Content objects to dicts via to_dict() when storing in
DurableAgentStateUnknownContent, and restores them via Content.from_dict()
in to_ai_content().
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add to_json and from_json methods to Content class (#4719)
Add to_json() and from_json() methods to the Content class to match the
serialization interface provided by SerializationMixin on other model classes.
Also fix pre-existing pyright type errors in durabletask's
DurableAgentStateUnknownContent.to_ai_content().
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: add type guard, remove to_json, add fallback, and tests
- Remove Content.to_json() per reviewer request (comment 3)
- Add type guard in Content.from_json() for non-dict JSON (comments 1, 4)
- Wrap json.JSONDecodeError as ValueError for consistent exception contract
- Add try/except fallback in to_ai_content() for invalid Content dicts (comment 5)
- Add test_content_to_dict_exclude_none and test_content_to_dict_exclude_fields (comment 2)
- Add test_unknown_content_to_ai_content_fallback_on_invalid_type_dict (comment 5)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Address review feedback for #4719: review comment fixes
* Remove Content.from_json, move logic to consuming code (#4719)
Remove the from_json convenience method from Content class per review
feedback. This is the same trivial json.loads + from_dict wrapper as
to_json which was already removed. Consumers should call json.loads
and Content.from_dict directly.
Update tests to use Content.from_dict(json.loads(...)) pattern and
remove from_json-specific error handling tests (those errors are
already covered by json.loads and Content.from_dict).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix flow.interrupts overwrite when multiple tools need approval (#4590)
Change flow.interrupts assignment to append so that all interrupt entries
accumulate when multiple tools require approval in a single turn.
Both _run_common.py and _agent_run.py used assignment (=) which caused
each new interrupt to overwrite the previous one. Switching to append()
ensures RUN_FINISHED.interrupt contains all pending approvals.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add test for streaming path with multiple confirm_changes interrupts (#4590)
Add integration test exercising run_agent_stream with multiple predictive
tool calls requiring confirmation. Verifies that flow.interrupts.append()
correctly accumulates all interrupt entries and they appear in the
RUN_FINISHED event.
Also confirms FlowState already declares interrupts field with
default_factory=list, addressing the AttributeError concern from review.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix _deduplicate_messages catch-all branch dropping valid repeated messages (#4682)
Remove the catch-all dedup branch that used (role, hash(content_str)) as a
dedup key. This incorrectly treated any two messages with the same role and
identical content as duplicates, dropping valid repeated messages (e.g., a
user saying 'yes' to confirm two separate things).
The tool-specific dedup branches (tool results by call_id, assistant tool
calls by call_id tuple) remain unchanged as they correctly identify true
protocol-level duplicates.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: consecutive-duplicate detection for non-tool messages (#4682)
- Replace blanket dedup removal with consecutive-duplicate detection:
only skip a message if the immediately preceding message has the same
role and content, preserving protection against upstream replays while
allowing identical messages at different conversation points.
- Strengthen test assertions to verify message identity and order, not
just list length.
- Add tests for consecutive duplicate skipping, non-consecutive
preservation, and messages with contents=None.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Use message_id for deduplication instead of content hashing
Deduplicate general messages by message_id when available, replacing
the consecutive-duplicate content check. Two messages with the same id
are definitively the same message (upstream replay), while identical
content with distinct ids (e.g. repeated "yes" confirmations) is
preserved. Messages without a message_id are always kept.
* Fix message_id dedup: truthy check, content-hash fallback, log safety
- Use truthy check (`if msg.message_id`) instead of `is not None` so
empty-string IDs fall through to content-hash dedup rather than
collapsing unrelated messages.
- Add content-hash fallback for messages without message_id, preventing
false negatives from integrations that don't set IDs.
- Remove raw message_id from log format string (addresses log-injection
surface with control characters).
- Add tests for empty-string message_id edge cases.
- Update existing tests to reflect content-hash dedup behavior.
Fixes#4682
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: clean up kwargs across agents, chat clients, tools, and sessions (#3642)
Audit and refactor public **kwargs usage across core agents, chat clients,
tools, sessions, and provider packages per the migration strategy codified
in CODING_STANDARD.md.
Key changes:
- Add explicit runtime buckets: function_invocation_kwargs and client_kwargs
on RawAgent.run() and chat client get_response() layers.
- Refactor FunctionTool to prefer explicit ctx: FunctionInvocationContext
injection; legacy **kwargs tools still work via _forward_runtime_kwargs.
- Refactor Agent.as_tool() to use direct JSON schema, always-streaming
wrapper, approval_mode parameter, and UserInputRequiredException
propagation (integrates PR #4568 behavior).
- Remove implicit session bleeding into FunctionInvocationContext; tools
that need a session must receive it via function_invocation_kwargs.
- Lower chat-client layers after FunctionInvocationLayer accept only
compatibility **kwargs (client_kwargs flattened, function_invocation_kwargs
ignored).
- Add layered docstring composition from Raw... implementations via
_docstrings.py helper.
- Clean up provider constructors to use explicit additional_properties.
- Deprecation warnings on legacy direct kwargs paths.
- Update samples, tests, and typing across all 23 packages.
Resolves#3642
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* clarified docstring
* feedback fixes
* Add unit tests for _docstrings.py build/apply helpers
Tests cover: no docstring source, no extra kwargs, appending to existing
Keyword Args section, inserting after Args, inserting in plain docstrings,
multiline descriptions, ordering, and apply_layered_docstring.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add test for propagate_session TypeError on non-AgentSession values
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add tests for multi-content and empty UserInputRequiredException propagation
Cover the branching logic in _try_execute_function_calls for:
- Multiple user_input_request items in a single exception (extra_user_input_contents path)
- Empty contents list (fallback function_result path)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add tests for DurableAIAgent.get_session forwarding service_session_id
Verifies get_session correctly forwards service_session_id and session_id
to the executor's get_new_session, replacing the removed kwargs test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Simplify ag-ui test stub to read session from client_kwargs only
Remove dual-mode detection (client_kwargs vs raw kwargs fallback) from
the test mock. Session is now read exclusively from client_kwargs,
matching the settled public calling convention.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updated create and get sessions in durable
* fixed docstrings
* fix test
* updated session handling
* updated from main
* updated tests
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: A2AAgent defaults name/description from AgentCard
When an AgentCard is provided but name/description are not explicitly
set, A2AAgent now falls back to agent_card.name and agent_card.description.
This avoids redundant duplication when constructing A2AAgent instances,
especially in GroupChat orchestrations where name and description are
essential for routing decisions.
Explicit values still take precedence over card values.
Fixes#4630
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use 'is None' checks instead of truthiness for name/description fallback
Ensures explicitly provided empty strings are not overridden by
agent_card values. Adds test for the empty string edge case.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(python): allow @tool functions to return rich content (images, audio)
Add support for tool functions to return Content objects that the model can perceive natively. Closes#4272
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Anthropic logging + mypy fix
* Address PR review: fix MCP ordering, fold helper into from_function_result, fix Chat client
- Preserve original content order in MCP tool results instead of text-first
- Move _build_function_result logic into Content.from_function_result()
- Chat Completions: inject user message for rich items (API only supports string tool content)
- Update tests for ordering and new from_function_result behavior
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use native Responses API multi-part output, warn+omit for Chat client
- Responses client: put rich items directly in function_call_output's
output field as list (native API support) instead of user message injection
- Chat client: warn and omit rich items (API doesn't support multi-part
tool results), matching Ollama/Bedrock pattern
- Unify test image: use sample_image.jpg across all integration tests
- Add Azure OpenAI Responses integration test
- Assert model describes house image to verify perception
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix lint: remove print statement, wrap long line
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback: bug fixes, single-pass MCP, unit tests
- Add isinstance guard in from_function_result for non-Content lists
- Fix Anthropic empty tool_content fallback to string result
- Fix Content(type='text', text=None) edge case in parse_result
- Rewrite MCP _parse_tool_result_from_mcp as single-pass (no index counters)
- Add Anthropic unit tests: data image, uri image, unsupported media, all-unsupported
- Add OpenAI Chat unit test: rich items warning and omission
- Add OpenAI Responses unit tests: function_result with/without items
- Add test_types tests: only-rich-items list, non-Content list fallback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix pyright errors: add type ignore comments for Any list iteration
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix mypy/pyright: ensure ToolExecutionException receives str
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix lint: remove duplicate test_prepare_options_excludes_conversation_id
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refactor: unify all tool results into Content items
* addressed copilot comments
* pyright fix
* small fix
* comments
* fix: address Copilot review - warnings, blob safety, dedup
- Add warning logs when rich content is dropped in Claude agent and
MCP server handlers (matching Chat/Bedrock/Ollama pattern)
- Defensive blob URI construction: wrap plain base64 in data: prefix
- Simplify Chat client _prepare_content_for_openai to use content.result
- Simplify Responses client text-only path, remove redundant nesting
- Add test for plain base64 blob without data: prefix
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix token double-counting in compaction and address review comments
- Exclude items from _serialize_content() to prevent double-counting
tokens when items mirrors result in function_result content
- Add rich content warning in GitHub Copilot agent tool handler
- Replace raw Content debug log with concise item count/type summary
- Update stale test comments about FunctionTool.invoke return type
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bedrock's Converse API only accepts "auto", "any", or "tool" as valid
toolChoice keys. The previous code mapped tool_choice="none" to
{"none": {}}, which causes a botocore.exceptions.ParamValidationError.
When tool_choice="none" (set by FunctionInvocationLayer after exhausting
max iterations), the fix now omits toolConfig entirely so the model
won't attempt tool calls.
Added tests for tool_choice="none", "auto", and "required" modes.
Fixes#4529
Co-authored-by: Eduard van Valkenburg <eavanvalkenburg@users.noreply.github.com>
* Use deepcopy for state snapshot to detect nested mutations (#4500)
Replace dict() shallow copy with copy.deepcopy() when snapshotting
workflow state before activity execution. The shallow copy shared
references to nested objects (dicts, lists), so in-place mutations by
executors were reflected in both the snapshot and live state, producing
an empty diff and preventing state updates from propagating to
downstream activities.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: Fix state snapshot to use deepcopy so nested mutations are detected in durable workflow activities
Fixes#4500
* Address PR review: remove report, extract testable helpers (#4500)
- Delete REPRODUCTION_REPORT.md (debugging artifact with local paths
and raw LLM output)
- Extract _create_state_snapshot() and _compute_state_updates() as
module-level helpers in _app.py so tests exercise the production
code path
- Update TestStateSnapshotDiff to import and use production helpers
instead of reimplementing snapshot/diff logic locally
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Add regression tests proving shallow copy bug and deep copy isolation (#4500)
Add two additional tests to TestStateSnapshotDiff:
- test_shallow_copy_would_miss_nested_mutations: reproduces the original
bug by demonstrating that dict() (shallow copy) misses nested mutations
- test_create_state_snapshot_isolates_nested_objects: verifies the
production _create_state_snapshot helper creates a true deep copy
These tests ensure a regression back to shallow copy would be caught.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add integration test exercising full activity code path (#4500)
Address PR review comment: add test_executor_activity_detects_nested_state_mutations
that captures the actual executor_activity function from _setup_executor_activity
and verifies it detects in-place nested mutations. This test would fail if
_app.py line 314 regressed from _create_state_snapshot() back to dict().
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review feedback for #4518: review comment fixes
* Address PR review feedback for state snapshot diff
- Inline _compute_state_updates logic at call site to reuse precomputed
original_keys/current_keys sets, avoiding redundant set allocations
- Fix test docstring to describe behavioral regression instead of
hard-coding a specific line number
- Use SOURCE_ORCHESTRATOR constant in integration test instead of
literal string
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* fix: remove unused _compute_state_updates from _app.py (#4518)
The function was inlined per review comment, making the module-level
helper unused and triggering a pyright reportUnusedFunction error.
Move the helper into the test file where it is still needed for unit
testing the diffing logic.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The DevUI /v1/responses endpoint accepts function_approval_response content
without verifying that the request_id corresponds to a real pending approval
request issued by the server. This allows forged approval responses to
execute arbitrary tools with attacker-controlled arguments, bypassing
approval_mode='always_require'.
Changes:
- Track outgoing approval requests in a server-side registry
(_pending_approvals) keyed by request_id
- Validate incoming approval responses against this registry; reject
any response whose request_id was not issued by the server
- Use server-stored function_call data (tool name, arguments, call_id)
instead of client-supplied data when constructing the approval response
- Consume request_ids on use (pop from registry) to prevent replay attacks
Tests:
- 8 new tests covering forged rejection, server-data enforcement,
anti-replay, multiple independent approvals, and edge cases
Co-authored-by: REDMOND\tusharmudi <tusharmudi@microsoft.com>
* Validate approval responses against server-side pending request registry
* improvements
* pin GHCP sdk version to non-breaking for now
* Pin CHCP sdk to LKG.
* really fix GHCP sdk pkg version
* Fix HITL approval validation security gaps and memory leak
- Validate rejected approval responses against pending_approvals registry,
not just approved ones. Fabricated rejections without a prior request are
now stripped from messages before reaching the LLM.
- Bound _pending_approvals with OrderedDict + LRU eviction (max 10k) to
prevent unbounded memory growth from abandoned approval requests.
- Skip registration when function_call.name is None/empty; log warning
when content.id or function_call is missing at registration time.
- Document pending_approvals parameter in run_agent_stream docstring.
- Add test for fabricated rejection attack scenario.
- Assert pending approval entry is preserved after function name mismatch.
- Pre-populate pending_approvals in rejection test for correct validation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Extract function_approval_response from workflow messages (#4546)
_extract_responses_from_messages now handles function_approval_response
content in addition to function_result content. Previously, approval
responses sent via the messages field were silently dropped because the
function only checked for content.type == "function_result".
The approval response is keyed by content.id and includes the approved
status, id, and serialized function_call — consistent with how
_coerce_content identifies approval response payloads.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Fix#4546: Update docstring and add integration tests for message-based approvals
- Update _extract_responses_from_messages docstring to reflect that it
now handles function_approval_response content in addition to
function_result content.
- Add integration tests for run_workflow_stream across two turns with
approval responses provided via messages (function_approvals) rather
than resume.interrupts, covering both approved and denied scenarios.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback for #4546
- Use safer 'not .get("interrupt")' assertion instead of 'not in'
to handle Pydantic v2 model_dump() including keys with None values
- Add unit test for mixed function_result and function_approval_response
in the same message to TestExtractResponsesFromMessages
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Implement annotation-based context compaction
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Handle missing compaction attributes in BaseChatClient
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix CI typing and bandit issues
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Optimize incremental compaction annotation pass
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refinement
* Python: add ToolResultCompactionStrategy and CompactionProvider
Add ToolResultCompactionStrategy that collapses older tool-call groups
into short summary messages (e.g. [Tool calls: get_weather]) while
keeping the most recent groups verbatim. This mirrors the .NET
ToolResultCompactionStrategy from PR #4533.
Add CompactionProvider as a context-provider that auto-applies compaction
before each agent turn and stores compacted history in session state
after each turn.
Includes tests and samples for both features.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* refinement and alignment with dotnet PR
* updated tool result compaction
* updated tool result compaction
* Python: add ToolResultCompactionStrategy, CompactionProvider, and skip_excluded
- ToolResultCompactionStrategy collapses older tool-call groups into
[Tool results: func_name: result] summaries with bidirectional tracing
(same pattern as SummarizationStrategy).
- CompactionProvider as BaseContextProvider with separate before_strategy
and after_strategy parameters. before_strategy compacts loaded context;
after_strategy compacts stored history via history_source_id.
- InMemoryHistoryProvider gains skip_excluded flag to filter out messages
marked as excluded by compaction strategies.
- Tests, samples, and exports updated.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fixed checks
* fix mypy
* Fix: ensure summary messages from both strategies get full compaction annotations
SummarizationStrategy was not calling annotate_message_groups after
inserting its summary message, so the summary lacked core group
annotations (id, kind, index, has_reasoning, _excluded). Added the
missing call. ToolResultCompactionStrategy already had it.
Added tests verifying both strategies produce fully annotated summaries.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updated propagation
* fix mypy
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* support skill scripts execution
* fix mixed line endings
* address comments and fix syntax issues
* use few try/except instead of one
* change samples
* validate either script path or script resource is set not both
* fix: separate LLM args from runtime kwargs in skill script execution
* address pr review comments
* address PR review comments
* Update python/packages/core/agent_framework/_skills.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update python/packages/core/agent_framework/_skills.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update python/packages/core/agent_framework/_skills.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* 1. Fixing the caching bug where parameters_schema would re-inspect on every call when the result was None
2. Updating the arguments tool description to be more generic (not CLI-specific)
* fix failing tests
* address pr review comments
* address pr review comments
* allow resource function returning any instead of sting
* address PR review comments
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Python: Fix `executor_completed` event with non-copyable raw_representation in mixed workflows
Fixes#4455
* fix(#4455): use class-level sets for deepcopy field exclusion
- SerializationMixin.__deepcopy__: check type(self).DEFAULT_EXCLUDE
instead of hardcoding 'raw_representation'
- Content.__deepcopy__: add _SHALLOW_COPY_FIELDS class variable and
check against it instead of hardcoding
- Fix tautological assertion in test (was always True)
- Add second excluded field to test to verify DEFAULT_EXCLUDE is
respected generically
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Decouple __deepcopy__ from DEFAULT_EXCLUDE in SerializationMixin (#4455)
Introduce _SHALLOW_COPY_FIELDS class variable in SerializationMixin to
separate deep-copy semantics from serialization semantics. Previously,
__deepcopy__ used DEFAULT_EXCLUDE to decide which fields to shallow-copy,
conflating 'not serialized' with 'not safe to deep-copy'. A field added
to DEFAULT_EXCLUDE purely for serialization (e.g. additional_properties)
would be silently shared between original and copy.
- Add _SHALLOW_COPY_FIELDS (default {'raw_representation'}) to
SerializationMixin, matching the pattern already used by Content
- Update __deepcopy__ to read from _SHALLOW_COPY_FIELDS instead of
DEFAULT_EXCLUDE
- Add test verifying DEFAULT_EXCLUDE fields are deep-copied unless
also in _SHALLOW_COPY_FIELDS
- Add test for Content._SHALLOW_COPY_FIELDS identity preservation
- Add test for ChatResponse deep-copying additional_properties
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add test for _SHALLOW_COPY_FIELDS and DEFAULT_EXCLUDE independence
Add test_deepcopy_shallow_copy_fields_override_default_exclude to verify
that a field in both DEFAULT_EXCLUDE and _SHALLOW_COPY_FIELDS is
shallow-copied (controlled by _SHALLOW_COPY_FIELDS), while a field in
DEFAULT_EXCLUDE only is still deep-copied. This addresses review comment
#11 ensuring the two class variables control independent concerns.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove unnecessary local variable in __deepcopy__
Inline cls._SHALLOW_COPY_FIELDS directly in the loop check instead of
assigning to a local variable first, per review feedback.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: prevent pickle deserialization of untrusted HITL input
Add strip_pickle_markers() to sanitize HTTP input before it reaches
pickle.loads() via the checkpoint decoding path. Applied as a 3-layer
defence-in-depth:
1. _app.py: sanitize req.get_json() at the HTTP boundary
2. _workflow.py: sanitize in _deserialize_hitl_response() before decode
3. _serialization.py: sanitize in reconstruct_to_type() as final guard
Any dict containing __pickled__ or __type__ markers from untrusted
sources is replaced with None, blocking arbitrary code execution via
crafted payloads to POST /workflow/respond/{instanceId}/{requestId}.
Includes 12 new unit tests covering the sanitizer and end-to-end
attack prevention.
* refactor: address review concerns for pickle fix
1. Remove deserialize_value() fallback in _deserialize_hitl_response
untrusted HITL data now returns as-is when no type hint is available,
never flowing into pickle.loads().
2. Move strip_pickle_markers() out of reconstruct_to_type() the function
is general-purpose again; untrusted-data callers are responsible for
sanitizing first (documented with NOTE comment).
3. Define _PICKLE_MARKER/_TYPE_MARKER as local constants with import-time
assertions against core's values decouples from private names while
failing loudly if core ever changes them.
4. Update tests to reflect new responsibility boundaries.
* fix: simplify warning message and fix ruff RUF001 lint
* fix: suppress pyright reportPrivateUsage on core marker imports
* Lower marker-strip log from warning to debug to avoid log flooding
* Replace assert with RuntimeError for marker sync checks (ruff S101)
* Fix pyright and ruff CI errors in security fix
- Use cast() for dict/list comprehensions in strip_pickle_markers (pyright)
- type: ignore for narrowed dict return in _workflow.py (pyright)
- Simplify marker imports: use core constants directly, remove local copies
- Remove duplicate pyright ignore comment
* Remove duplicate end-to-end test in TestStripPickleMarkers
* Suppress mypy redundant-cast on list cast needed by pyright
* Add multi-turn streaming sample and rename multi-turn samples
- Rename 03_multi_turn.py to 03a_multi_turn.py
- Add 03b_multi_turn_streaming.py showing streaming with session history
- The new sample demonstrates calling get_final_response() after
iterating the stream to persist conversation history
- Update READMEs to reflect the new file names
Closes#4447
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Auto-finalize ResponseStream on iteration completion
When a ResponseStream is fully consumed via async iteration,
automatically trigger finalization (finalizer + result hooks).
This ensures session history is persisted in streaming multi-turn
conversations without requiring an explicit get_final_response() call.
- Add auto-finalize call in __anext__ on StopAsyncIteration
- Guard inner stream finalization to prevent double-execution
- Re-check _finalized after iteration in get_final_response()
- Add tests for auto-finalization and streaming session history
- Revert sample file renames from previous commit
Closes#4447
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* README fix
* Fix SIM102 lint: combine nested if statements
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: Exclude conversation_id from chat completions options (#4315)
When a session with service_session_id is passed to an agent using the
Chat Completions client, conversation_id leaked through _prepare_options()
into AsyncCompletions.create(), causing an 'unexpected keyword argument'
error. The Responses client already excluded conversation_id but the Chat
Completions client did not.
Added conversation_id to the exclusion set in _prepare_options().
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Apply pre-commit auto-fixes
* Remove reproduction report artifact
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix#4305: Handle dict chat_options in _update_conversation_id
_update_conversation_id assumed chat_options had attribute access, but
ChatOptions is a TypedDict (dict). When a dict was passed, setting
.conversation_id raised AttributeError. Now checks isinstance(dict) and
uses key access for dicts, falling back to attribute access for objects.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR feedback: use Mapping ABC and add missing tests (#4305)
- Use collections.abc.Mapping instead of dict for isinstance check in
_update_conversation_id, making it more robust for non-dict mapping types.
- Add test for object-style chat_options with optional options dict parameter.
- Add test verifying existing conversation_id gets overwritten (idempotent).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Remove unnecessary Mapping check in _update_conversation_id (#4305)
chat_options is always a dict, so the isinstance(chat_opts, Mapping)
check and the else branch for attribute-style access are dead code.
Simplify to direct dict key assignment and remove object-style tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Prepare azure-ai-projects 2.0 GA compatibility
Add allow_preview support for internal AIProjectClient creation, keep backward compatibility for renamed SDK model classes, and align Azure AI/core paths and tests for GA validation workflows.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* upgrade to ai-project==2.0.0
* Python: remove azure-ai-projects keyword-guard paths
Assume azure-ai-projects 2.0+ in Azure AI client/provider/responses code paths by removing _supports_keyword_argument gating and related fallback branching.
Also fix pyright typing in FoundryMemoryProvider memory store calls by using ResponseInputItemParam-typed items.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* check fixes
* Python: remove unsupported foundry_features option
Drop foundry_features from Azure AI client and provider surfaces because azure-ai-projects 2.0.0 does not expose that create_version parameter.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: add allow_preview to Foundry memory provider
Propagate allow_preview when FoundryMemoryProvider constructs an AIProjectClient and update tests accordingly.
Also finish wiring allow_preview through AzureAIClient-facing surfaces and related docs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* aligning docstrings
* udpated lock
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update github_copilot package for github-copilot-sdk>=0.1.32 (#4549)
- Update requires-python from >=3.10 to >=3.11
- Remove Python 3.10 classifier
- Update mypy python_version to 3.11
- Update dependency to github-copilot-sdk>=0.1.32
- Fix ToolResult API: use snake_case kwargs (text_result_for_llm,
result_type) instead of camelCase (textResultForLlm, resultType)
- Update test assertions to use attribute access on ToolResult
- Add ToolResult type assertions to tool handler tests
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix tests to use ToolInvocation dataclass instead of plain dict (#4549)
Update test_github_copilot_agent.py to pass ToolInvocation objects to tool
handlers instead of plain dicts, matching the github-copilot-sdk>=0.1.32 API
where ToolInvocation is a dataclass with an .arguments attribute.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add regression tests for ToolInvocation contract (#4549)
Add tests to lock in the new ToolInvocation-based calling convention:
- test_tool_handler_rejects_raw_dict_invocation: verifies passing a raw
dict (old calling convention) raises TypeError/AttributeError
- test_tool_handler_with_empty_arguments: verifies ToolInvocation with
empty arguments works correctly for no-arg tools
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Revert requires-python to >=3.10 to avoid breaking CI (#4549)
The repo CI runs with Python 3.10 (uv sync --all-packages) and all other
packages require >=3.10. Raising this package to >=3.11 would break the
shared install flow. The SDK dependency version constraint (>=0.1.32) will
enforce any Python version requirement from the SDK itself.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix min Python version for github_copilot package to >=3.11
github-copilot-sdk>=0.1.32 requires Python>=3.11, which conflicts
with the package's declared >=3.10 minimum, breaking uv sync.
* Bump py version for GH workflows to 3.11, exclude GHCP sdk from 3.10 items
* Fix uv command
* Fixes
* Update samples
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improve ag-ui tests and coverage
* fix tests paths
* Fixes
* Improve AG-UI test robustness and correctness
- Map toolName → tool_call_name in SSE helpers for TOOL_CALL_START events
- Fail loudly on malformed SSE JSON in parse_sse_response() instead of silently dropping
- Detect duplicate TOOL_CALL_START/TOOL_CALL_END in assert_tool_calls_balanced()
- Remove fragile source line reference from test docstring
- Add found guard in test_client_tool_sets_additional_properties to prevent vacuous pass
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix as_agent() not defaulting name/description from client properties
AzureAIClient.as_agent() and AzureAIAgentClient.as_agent() now fall back
to self.agent_name and self.agent_description when name/description are
not explicitly passed. This ensures Agent.name is populated for
telemetry spans without requiring callers to repeat the name.
Fixes#4471
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: use is None checks instead of truthiness
Switch from name or self.agent_name to explicit is None checks so
that callers can intentionally pass empty strings without them being
replaced by client defaults. Added edge-case tests for empty strings.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Update docstrings to document name/description defaulting behavior
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix Python pyright package scoping and typing remediation
Implements issue #4407 by removing the root pyright include, adding package-level pyright includes, and resolving pyright/mypy typing issues across Python packages. Also cleans unnecessary casts and applies line-level, rule-specific ignores where external libraries are too dynamic.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Reduce pyright cost in handoff cloning
Simplify cloned_options construction in HandoffAgentExecutor to avoid expensive TypedDict narrowing/inference in _handoff.py, which was causing pyright to spend a long time in orchestrations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix types
* Fix lint and type-check regressions
Resolve current Python package check failures across lint, pyright, and mypy after recent code changes, including purview/declarative pyright issues and multiple ruff simplification findings.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fixed hooks
* Stabilize package tests and test tasks
Resolve cross-package non-integration test failures, simplify streaming type flow, harden locale/culture handling, and standardize package test poe tasks to exclude integration tests where applicable.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* lots of small fixes
* Fix current Python test regressions
Address current failing unit tests in azure-ai, bedrock, and azure-cosmos while keeping Bedrock parsing logic inline (no new static helper methods).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* small fixes
* small fixes
* removed pydantic from json
* final updates
* fix core
* fix tests
* fix obser
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Python: Add propagate_session parameter to as_tool() for session sharing
Add opt-in session propagation in agent-as-tool scenarios. When
propagate_session=True, the parent agent's AgentSession is forwarded
to the sub-agent's run() call, allowing both agents to share session
state (history, metadata, session_id).
- Add propagate_session parameter to BaseAgent.as_tool() (default False)
- Include session in additional_function_arguments so it flows to tools
- Add 3 tests for propagation on/off and shared state verification
- Add sample showing session propagation with observability middleware
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Clarify propagate_session docstring per review feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(claude): add plugins, setting_sources, thinking, and effort options
Add four Claude Agent SDK options to ClaudeAgentOptions that are clean
passthroughs with no abstraction conflicts:
- plugins: load Claude Code plugins programmatically via SdkPluginConfig
- setting_sources: control which .claude settings files are loaded
- thinking: modern extended thinking config (adaptive/enabled/disabled)
- effort: control thinking depth (low/medium/high/max)
* feat(claude): remove max_thinking_tokens, add plugins/setting_sources/thinking/effort
Remove the deprecated max_thinking_tokens field from ClaudeAgentOptions
in favor of the new thinking field (ThinkingConfig).
Add four Claude Agent SDK options as clean passthroughs:
- plugins: load Claude Code plugins via SdkPluginConfig
- setting_sources: control which .claude settings files are loaded
- thinking: extended thinking config (adaptive/enabled/disabled)
- effort: thinking depth control (low/medium/high/max)
alliscodeandCopilot
SergeyMenshykhandGitHub
Tao ChenandGitHub
Dmytro StrukandGitHub
Ahmed MuhsinandGitHub
Dineshsuriya DandGitHub