* Python: DevUI: tighten default access controls and CORS posture
Adjusts the default configuration of the DevUI server so the out-of-the-box
posture matches what most callers expect when running locally. Adds explicit
opt-outs for callers who need the previous behavior.
- DevServer gains auth_enabled and auth_token constructor params; auth is on by
default. Auto-generates and logs a token when none provided.
- CORS default is an empty allowlist on every host. Callers wanting cross-origin
pass cors_origins explicitly.
- Streaming /v1/responses no longer sets Access-Control-Allow-Origin directly;
CORSMiddleware owns all CORS decisions.
- Loopback binds enforce a Host-header allowlist.
- /meta moved out of the auth bypass list (was alongside /health and /).
- serve() default flipped to auth_enabled=True; passes auth args through to
DevServer instead of using env-var indirection.
- CLI: --auth opt-in replaced with --no-auth opt-out; --auth-token preserved.
- Tests cover the eight behaviors above in test_server.py.
* Python: DevUI: address PR review comments
- /meta now derives auth_required from self.auth_enabled instead of
reading DEVUI_AUTH_TOKEN, so the auto-generated and explicit
auth_token paths report correctly.
- Reorder middleware so the loopback Host-header allowlist is registered
last; Starlette wraps later-added middleware around earlier-added ones,
so the host check now runs outermost (before CORS/auth) as intended.
- Rework comments to describe the behavior rather than threat scenarios.
- Streaming-headers and CORS tests now construct the server with an
explicit auth_token and send a Bearer header, so the assertions
actually exercise the streaming/CORS path instead of short-circuiting
in the auth middleware.
Replaces two ILogger.LogWarning(string, params object?[]) calls in DevUIAuthFilter and DevUIExtensions with allocation-free [LoggerMessage] partial methods on a new internal DevUILog class. Preserves original message templates and structured property names ({RemoteIp}, {EnvVar}).
Co-authored-by: alliscode <25218250+alliscode@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fixes microsoft/agent-framework#3295. When the OpenAI Responses chat
client sends a request that carries previous_response_id / conversation_id
/ conversation, the server already has the prior turn's response items
and rejects duplicates with "Duplicate item found with id fc_xxx". The
chat client was re-sending them inline whenever the input messages still
carried the items in additional_properties (workflow replay, history
providers, etc.), which broke any tool-using agent with persistent
history.
Decisions:
- Single chokepoint: _prepare_message_for_openai. When the resulting
request uses service-side storage, drop function_call, reasoning,
approval-request/response, and local-shell-call items from the wire
input. Keep function_result with its call_id; the server pairs it to
the prior function_call via that key.
- function_result is preserved unconditionally except for the local-shell
variant, which carries its own server-issued item id.
- No public API change. Wire format change is subtractive and only on
requests that would otherwise 400.
- Re-pointed the strict-xfail in test_full_conversation.py from #4047 to
#3295. Kept xfail because the test asserts executor-level session-id
clearing, which is the defense-in-depth half tracked by 3295-03; this
slice closes the wire-level half.
Files:
- python/packages/openai/agent_framework_openai/_chat_client.py: strip
rule applied alongside the existing reasoning-item branch.
- python/packages/openai/tests/openai/test_openai_chat_client.py: four
new tests pin the contract (function_call, approval, local-shell-call
stripped under storage; everything kept without storage). Updated
pre-existing tests that exercised the storage-on path to either pass
request_uses_service_side_storage=False explicitly or assert the new
strip behavior.
- python/packages/foundry/tests/foundry/test_foundry_chat_client.py:
same explicit storage-off opt-in for the inherited test.
- python/packages/core/tests/workflow/test_full_conversation.py:
re-pointed xfail reason to #3295 and the executor-level follow-up.
Notes for next iteration:
- 3295-01 (HITL wire-format validation against live OpenAI/Foundry) was
not run; it requires the user's API credentials. The PRD design is
locked but the empirical confirmation is still pending. If script 3
fails on either provider, this slice may need to be revisited.
- 3295-03 (clear service_session_id in AgentExecutor on full-history
replay) remains open. After it lands the xfail in
test_full_conversation.py can be removed.
- pytest was not run in this iteration because uv-based pytest commands
required interactive approval. Validation rests on careful reading;
next iteration should run the openai + core test suites.
* Fix Skill docstring consistency and spelling
- Add ClassSkill to Skill class docstring concrete implementations list
- Normalize 'defence' to 'defense' for American English consistency
- Remove extra blank line in InlineSkill docstring example
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix E501 line-too-long lint error in test_skills.py
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix stale test section header to reflect SkillFrontmatter API
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix metadata children overriding top-level frontmatter fields
Scope YAML_KV_RE to column-0 keys only so indented children
under metadata: are not mistakenly parsed as top-level fields.
Add regression test and spec fields to sample SKILL.md files.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(python): prevent MCP message_handler deadlock on notification reload
When an MCP server sends a notifications/tools/list_changed or
notifications/prompts/list_changed notification, the message_handler
previously awaited load_tools()/load_prompts() directly. Since the
handler runs on the MCP SDK's single-threaded receive loop, this
caused a deadlock: load_tools() sends a list_tools request and waits
for its response, but the receive loop cannot deliver that response
while blocked in the handler.
This manifested as a timeout in call_tool(), which then surfaced as
"Error: Function failed." to the model instead of the real tool
output. The MATLAB MCP server reliably triggers this because it sends
a tools/list_changed notification during tool execution.
Fix: schedule reloads as background asyncio.Tasks via a new
_schedule_reload() helper, freeing the receive loop immediately.
Fixes#4828
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review feedback: fix exc_info, coalesce reloads, shutdown cleanup, tests
- Fix exc_info=exc -> exc_info=True in _schedule_reload and message_handler
- Tighten _schedule_reload param type from Any to Coroutine[Any, Any, None]
- Coalesce reloads: cancel-and-replace per reload kind to prevent unbounded growth
- Cancel pending reload tasks in _close_on_owner before tearing down session
- Re-raise CancelledError in _safe_reload to respect task cancellation
- Replace flaky asyncio.sleep(0) with asyncio.wait_for/gather in tests
- Add caplog assertions to verify reload failure is actually logged
- Assert _pending_reload_tasks cleanup on error path
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: address review comments on MCP reload handling
- Fix exc_info=True -> exc_info=message in message_handler error logging,
since the handler is not called from an except block
- Await cancelled reload tasks in _close_on_owner before tearing down
the session to avoid 'Task was destroyed but pending' warnings
- Add cancel-and-replace test verifying duplicate notifications cancel
the first reload task and only keep one in flight
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: remove Task.cancelling() call for Python 3.10 compat
Task.cancelling() was added in Python 3.11. Replace with awaiting
the task and checking cancelled() instead.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add debug log when cancelling superseded reload task
Log at DEBUG level when a new notification cancels an in-flight reload
task, improving observability of the cancel-and-replace behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(evals): add ground_truth/expected_output support for workflow eval
Brings .NET to parity with Python PR #5234 for issue #5135:
- Add expectedOutput parameter to Run.EvaluateAsync (workflow) and stamp on the overall EvalItem.ExpectedOutput.
- Map EvalItem.ExpectedOutput -> ground_truth in the Foundry JSONL payload, item_schema, and data_mapping for similarity.
- Add GroundTruthEvaluators set (currently builtin.similarity) and a FindMissingGroundTruthEvaluators helper.
- Fail fast with InvalidOperationException when a ground-truth evaluator is selected but no item provides an ExpectedOutput, instead of surfacing a remote provider error.
- Add tests in FoundryEvalConverterTests and WorkflowEvaluationTests.
- Add Evaluation_WorkflowExpectedOutputs sample (workflow + Foundry similarity).
Fixesmicrosoft/agent-framework#5135 (.NET side).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: relax BuildOverallItem events to IReadOnlyList<WorkflowEvent>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Sample: disable per-agent breakdown when using reference-based evaluator
Per-agent EvalItems are intentionally left without ExpectedOutput, so the new fail-fast validation in FoundryEvals would throw when Similarity is invoked for per-agent items. Pass includePerAgent: false in the workflow + similarity sample, and document this gotcha in the EvaluateAsync XML doc.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix BuildOverallItem: fall back to last ExecutorCompletedEvent
AgentResponseEvent is only emitted when AIAgentHostOptions.EmitAgentResponseEvents is enabled, which is not the default for WorkflowBuilder(agent).AddEdge(...). When it is absent, fall back to the last non-internal ExecutorCompletedEvent whose Data is an AgentResponse / ChatMessage / string so the overall EvalItem (and any expectedOutput) is produced. Without this, samples wired up the standard way returned 0 evaluation items.
Update test to cover the fallback path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Sample: enable EmitAgentResponseEvents; eval throws clear error when no overall response found
Root cause of '0 results': AIAgentHostExecutor only emits AgentResponseEvent when AIAgentHostOptions.EmitAgentResponseEvents is true (default false). For ordinary AIAgent executors the runtime's ExecutorCompletedEvent.Data is null, so the prior fallback couldn't find a final response either.
Sample now builds executors with EmitAgentResponseEvents=true via BindAsExecutor(hostOptions). EvaluateAsync now throws InvalidOperationException with a remediation hint when the user supplies expectedOutput but no overall final response can be located, instead of silently returning 0/0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Guard against null sample/error/usage/datasource_item in ParseDetailedItem
Foundry eval responses can have these properties present with JSON null
or non-object values, which caused JsonElement.TryGetProperty to throw
'requires Object, has Null'. Check ValueKind == Object before drilling in.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR review: reorder expectedOutput, tighten ground-truth check, add fail-fast test
* WorkflowEvaluationExtensions.EvaluateAsync: move 'expectedOutput' to
after 'splitter' so the original positional contract of (splitter,
cancellationToken) is preserved for existing callers.
* FoundryEvals: require ALL items to carry ExpectedOutput when a
ground-truth evaluator is selected (e.g. similarity), not just any.
Reference-based evaluators score per-item, so a single missing GT
would still surface as a provider-side validation error. Updated
fail-fast message accordingly.
* WorkflowEvaluationTests: add EvaluateAsync_WithExpectedOutputButNoFinalResponse_ThrowsAsync
to verify the InvalidOperationException is thrown (and that the
message mentions EmitAgentResponseEvents).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fail-fast on missing overall item regardless of expectedOutput; harden BuildOverallItem default
* EvaluateAsync now throws InvalidOperationException whenever 'includeOverall'
is requested but BuildOverallItem cannot produce an item, instead of only
when 'expectedOutput' is supplied. Same misconfiguration (agents not bound
with EmitAgentResponseEvents) used to silently return empty results — now
it surfaces a clear, actionable error in both cases.
* BuildOverallItem switch default now throws instead of returning null. The
preceding for-loop already constrains Data to AgentResponse/ChatMessage/
string, so reaching default would indicate a contract drift; throw to make
the bug visible.
* Test renamed and broadened to verify the throw fires without expectedOutput.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: alliscode <25218250+alliscode@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Jacob Alber ·
copilot-swe-agent[bot] ·
Evan Mattson ·
Ben Thomas ·
SergeyMenshykh ·
Giles Odigwe ·
Yufeng He ·