mirror of
https://github.com/microsoft/agent-framework.git
synced 2026-06-16 21:04:09 +08:00
c30f104b20
Two security fixes for PR #5933: 1. Add safe_mode flag to WorkflowFactory (default True) mirroring AgentFactory. Gates =Env.* exposure inside DeclarativeWorkflowState PowerFx symbols via _safe_mode_context, so workflow YAML loaded from untrusted sources no longer leaks the host's full os.environ snapshot into PowerFx evaluation. The flag is also forwarded to the internally-constructed AgentFactory so inline agent definitions follow the same policy. 2. Pin the invoke_foundry_toolbox_mcp sample's _client_provider to the resolved toolbox endpoint. The bearer-authenticated httpx client is now only returned when MCPToolInvocation.server_url matches the toolbox URL case-insensitively; any other URL gets None (the default unauthenticated path), preventing the Foundry AAD bearer token from being attached to a mis-configured or injected server URL. Mirrors the .NET sample's httpClientProvider guard. The sample is updated to opt in to safe_mode=False because its YAML intentionally uses =Env.FOUNDRY_TOOLBOX_* to keep configuration in env vars under the developer's control. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
c30f104b20
ยท
2026-05-18 14:43:26 -07:00
History
Declarative Workflows
Declarative workflows allow you to define multi-agent orchestration patterns in YAML, including:
- Variable manipulation and state management
- Control flow (loops, conditionals, branching)
- Agent invocations
- Human-in-the-loop patterns
See the main workflows README for the list of available samples.
Prerequisites
pip install agent-framework-declarative
Running Samples
Each sample directory contains:
workflow.yaml- The declarative workflow definitionmain.py- Python code to load and execute the workflowREADME.md- Sample-specific documentation
To run a sample:
cd <sample_directory>
python main.py
Workflow Structure
A basic workflow YAML file looks like:
name: my-workflow
description: A simple workflow example
actions:
- kind: SetValue
path: turn.greeting
value: Hello, World!
- kind: SendActivity
activity:
text: =turn.greeting
Action Types
Variable Actions
SetValue- Set a variable in stateSetVariable- Set a variable (.NET style naming)AppendValue- Append to a listResetVariable- Clear a variable
Control Flow
If- Conditional branchingSwitch- Multi-way branchingForeach- Iterate over collectionsRepeatUntil- Loop until conditionGotoAction- Jump to labeled action
Output
SendActivity- Send text/attachments to userEmitEvent- Emit custom events
Agent Invocation
InvokeAzureAgent- Call an Azure AI agentInvokePromptAgent- Call a local prompt agent
Tool Invocation
InvokeFunctionTool- Call a registered Python function
Human-in-Loop
Question- Request user inputWaitForInput- Pause for external input