Python: chore: update dependencies

Python: Enhance _OutputItemTracker to prevent duplicate function call streaming (#7486 )
* Python: Enhance _OutputItemTracker to prevent duplicate function call streaming * Handle empty function call metadata arguments Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9b232bff-6a8c-4b02-addd-89de57a82f6a * Python: Refactor _OutputItemTracker to manage outstanding function calls and update tests for call ID reuse --------- Copilot-Session: 9b232bff-6a8c-4b02-addd-89de57a82f6a
2026-08-17 04:34:14 +00:00 · 2026-08-16 16:22:30 +00:00 · 2026-08-16 16:12:17 +00:00 · 2026-08-16 16:11:28 +00:00 · 2026-08-14 15:32:54 +00:00 · 2026-08-14 15:16:53 +00:00
28 changed files with 6169 additions and 5104 deletions
@@ -1,5 +1,130 @@
 # Code ownership assignments
 # https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Policy: a PR needs one approval, and it must come from a code owner of the changed
+# files ("Require review from Code Owners" + "Required approvals: 1" on `main`).
+# A PR touching several CODEOWNERS patterns will request review from the applicable
+# code owners, but an approval from any applicable code owner is sufficient to satisfy
+# GitHub's required-code-owner review.
+#
+# Order matters: the LAST matching pattern wins, so a module rule fully replaces the
+# catch-all rather than adding to it. @chetantoshniwal is included on every line as a
+# repository-wide fallback owner. All owners on a line have equal approval authority.
+#
+# CONVENTION: owners are written in the order
+#   @chetantoshniwal <owner A> <owner B> [...]
+# @chetantoshniwal is at the beginning for aesthetics. The owners share equal approval
+# power and responsibility.
+#
+# RULE: every path must list at least two owners besides @chetantoshniwal. An author
+# cannot approve their own PR, so a path with a single module owner leaves only Chetan
+# to review whenever that owner is the author, which defeats the point of naming a
+# module owner.
+#
+# Samples: owned by all core developers of that language, not by the module a sample
+# demonstrates. Any core Python developer can approve any Python sample, and any core
+# .NET developer can approve any .NET sample. No dedicated rule is needed -- samples
+# fall through to the /python and /dotnet rules, which already list those developers.
+#
+# Tests: same as samples. Tests that live inside a package (python/packages/<pkg>/tests)
+# are covered by that package's rule instead, since they sit under its path.
+
+# Default owners for everything not matched by a module rule below.
+*                                                               @chetantoshniwal @westey-m
+
+# Repository-level paths: every core Agent Framework developer is a code owner, so any
+# one of them can approve. Be explicit now and we can use the AgentFramework team in the future.
+/docs/                                                          @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+/*.md                                                           @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+/LICENSE                                                        @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+/.gitattributes                                                 @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+/.gitignore                                                     @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+/.github                                                        @chetantoshniwal @westey-m @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU @peibekwe @rogerbarreto @SergeyMenshykh
+
+# Repository-level paths that require specific owners
+/.devcontainer                                                  @chetantoshniwal @westey-m @rogerbarreto @SergeyMenshykh
+/declarative-agents                                             @chetantoshniwal @moonbox3 @peibekwe
+
+# Core Python developers: @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU
+/python                                                         @chetantoshniwal @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU
+
+# Python packages
+/python/packages/a2a/                                           @chetantoshniwal @giles17 @eavanvalkenburg
+/python/packages/ag-ui/                                         @chetantoshniwal @moonbox3 @giles17
+/python/packages/anthropic/                                     @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/azure-ai-search/                               @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/azure-contentunderstanding/                    @chetantoshniwal @giles17 @eavanvalkenburg
+/python/packages/azure-cosmos/                                  @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/azure-cosmos-memory/                           @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/bedrock/                                       @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/chatkit/                                       @chetantoshniwal @moonbox3 @giles17
+/python/packages/claude/                                        @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/copilotstudio/                                 @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/core/                                          @chetantoshniwal @eavanvalkenburg @moonbox3 @TaoChenOSU @giles17
+/python/packages/core/agent_framework/_workflows/               @chetantoshniwal @moonbox3 @TaoChenOSU
+/python/packages/core/agent_framework/_harness/                 @chetantoshniwal @westey-m @eavanvalkenburg
+/python/packages/declarative/                                   @chetantoshniwal @moonbox3 @peibekwe
+/python/packages/devui/                                         @chetantoshniwal @eavanvalkenburg @moonbox3
+/python/packages/foundry/                                       @chetantoshniwal @eavanvalkenburg @TaoChenOSU @moonbox3 @giles17
+/python/packages/foundry_hosting/                               @chetantoshniwal @TaoChenOSU @eavanvalkenburg
+/python/packages/foundry_local/                                 @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/gemini/                                        @chetantoshniwal @giles17 @eavanvalkenburg
+/python/packages/github_copilot/                                @chetantoshniwal @giles17 @eavanvalkenburg
+/python/packages/hosting/                                       @chetantoshniwal @eavanvalkenburg @TaoChenOSU
+/python/packages/hosting-a2a/                                   @chetantoshniwal @eavanvalkenburg @TaoChenOSU
+/python/packages/hosting-mcp/                                   @chetantoshniwal @eavanvalkenburg @TaoChenOSU
+/python/packages/hosting-responses/                             @chetantoshniwal @eavanvalkenburg @TaoChenOSU
+/python/packages/hosting-telegram/                              @chetantoshniwal @eavanvalkenburg @TaoChenOSU
+/python/packages/hyperlight/                                    @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/lab/                                           @chetantoshniwal @eavanvalkenburg @giles17 @moonbox3 @TaoChenOSU
+/python/packages/mem0/                                          @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/mistral/                                       @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/monty/                                         @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/ollama/                                        @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/openai/                                        @chetantoshniwal @eavanvalkenburg @moonbox3 @TaoChenOSU @giles17
+/python/packages/orchestrations/                                @chetantoshniwal @moonbox3 @TaoChenOSU
+/python/packages/purview/                                       @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/redis/                                         @chetantoshniwal @eavanvalkenburg @giles17
+/python/packages/tools/                                         @chetantoshniwal @eavanvalkenburg @giles17
+
+# Core .NET developers: @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet                                                         @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+
+# .NET projects
+/dotnet/src/Aspire.Hosting.AgentFramework.DevUI/                @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/LegacySupport/                                      @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Shared/                                             @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI/                                @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.A2A/                            @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Abstractions/                   @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.AGUI/                           @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Anthropic/                      @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.AzureAI.Persistent/             @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.CopilotStudio/                  @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.CosmosNoSql/                    @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.Declarative/                    @chetantoshniwal @peibekwe @westey-m
+/dotnet/src/Microsoft.Agents.AI.DevUI/                          @chetantoshniwal @peibekwe @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Foundry/                        @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/                @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.GitHub.Copilot/                 @chetantoshniwal @rogerbarreto @westey-m
+/dotnet/src/Microsoft.Agents.AI.Harness/                        @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.Hosting/                        @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hosting.A2A/                    @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hosting.A2A.AspNetCore/         @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hosting.AGUI.AspNetCore/        @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hosting.AspNetCore/             @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/                 @chetantoshniwal @rogerbarreto @SergeyMenshykh @westey-m
+/dotnet/src/Microsoft.Agents.AI.Hyperlight/                     @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.LocalCodeAct/                   @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.Mcp/                            @chetantoshniwal @westey-m @peibekwe
+/dotnet/src/Microsoft.Agents.AI.Mem0/                           @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.OpenAI/                         @chetantoshniwal @westey-m @rogerbarreto
+/dotnet/src/Microsoft.Agents.AI.Purview/                        @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.Tools.Shell/                    @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.Valkey/                         @chetantoshniwal @westey-m @SergeyMenshykh
+/dotnet/src/Microsoft.Agents.AI.Workflows/                      @chetantoshniwal @peibekwe @rogerbarreto
+/dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/          @chetantoshniwal @peibekwe @rogerbarreto
+/dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Foundry/  @chetantoshniwal @peibekwe @rogerbarreto
+/dotnet/src/Microsoft.Agents.AI.Workflows.Declarative.Mcp/      @chetantoshniwal @peibekwe @rogerbarreto
+/dotnet/src/Microsoft.Agents.AI.Workflows.Generators/           @chetantoshniwal @peibekwe @rogerbarreto

-python/samples/getting_started/azure_functions/ @microsoft/agentframework-durabletask-developers
-python/samples/getting_started/durabletask/ @microsoft/agentframework-durabletask-developers
@@ -342,6 +342,21 @@ that manually replay messages own the equivalent rule: do not resend an approval
 ### Approval request and resume

 - A tool that requires approval does not execute before an approved response.
+- With an `AgentSession`, every surfaced local or hosted approval request is stored as an immutable snapshot in one
+  active model batch. A new surfaced batch replaces an abandoned batch instead of accumulating session state.
+- Approval request IDs use the provider function `call_id`, whose conversation-level uniqueness is required for
+  function-call/result correlation. Duplicate request IDs within one batch are rejected as malformed.
+- An inbound response is honored only when its request id matches the pending server-held snapshot.
+- Approval requests replayed in inbound message history do not create, replace, or resurrect approval authority.
+- The executable call id, tool name, arguments, and local or hosted tool metadata are sourced from the recorded
+  request, never from the response payload.
+- A matched approval response consumes its pending entry once. Unmatched, duplicate, and replayed responses do not
+  reach local execution.
+- Tool lookup uses the recorded name against the current registry. A same-name implementation upgrade is allowed;
+  removing the name prevents local execution.
+- Only the strict boolean `True` grants approval. Missing decisions and non-boolean values are rejection, not consent.
+- Direct chat-client invocation without an `AgentSession` preserves pass-through compatibility, matching .NET;
+  authorization sinks still require strict `True`.
 - An approved tool executes exactly once.
 - A rejected tool executes zero times and produces one synthetic rejection `function_result` using the original
  function `call_id`.
@@ -421,12 +436,17 @@ that manually replay messages own the equivalent rule: do not resend an approval
 | Rejected streaming resume | Rejection result update precedes final text and tool executes zero times. | `test_approval_resume_returns_result_without_mutating_inputs[streaming-rejected]`, `test_streaming_approval_resume_yields_terminal_result_before_model_text[rejected]` |
 | Mixed approved/rejected batch | Every call gets one correctly correlated terminal result. | `packages/core/tests/core/test_function_invocation_logic.py::test_rejected_approval` |
 | Persisted approval replay | Resume executes with the prior call available. | `test_persisted_approval_messages_replay_correctly` |
-| Hosted approval pass-through | Hosted requests/responses are not processed as local calls. | `test_hosted_tool_approval_response`, `test_hosted_mcp_approval_response_passthrough`, `test_mixed_local_and_hosted_approval_flow` |
+| Hosted approval pass-through | Hosted requests/responses are bound to the recorded provider request and are not processed as local calls. | `test_hosted_tool_approval_response`, `test_hosted_mcp_approval_response_passthrough`, `test_session_approval_binding_reconstructs_hosted_response`, `test_mixed_local_and_hosted_approval_flow` |
 | Approval-time user input | Every user-input request from one approved execution returns in order with assistant role and no extra model call; the execution consumes one call-budget unit. | `packages/core/tests/core/test_harness_tool_approval.py::test_approval_resume_returns_all_user_input_requests_without_another_model_call`, `packages/core/tests/core/test_function_invocation_logic.py::test_approval_resume_user_input_counts_toward_function_call_budget` |
 | Mixed terminal result and follow-up input | Completed siblings remain tool-role while only follow-up input requests use assistant-role messages/updates. | `packages/core/tests/core/test_function_invocation_logic.py::test_approval_resume_separates_terminal_results_from_follow_up_requests`, `packages/openai/tests/openai/test_openai_chat_completion_client.py::test_mixed_approval_resume_roles_serialize_function_result_as_tool` |
 | Approval-time middleware termination | Terminal result returns with no extra model call in either response mode. | `packages/core/tests/core/test_function_invocation_logic.py::test_approval_resume_honors_middleware_termination` |
 | Approval re-entry after iteration budget | Pending approved calls resolve once even when prior model calls consumed `max_iterations`. | `packages/core/tests/core/test_harness_tool_approval.py::test_auto_approval_resolves_after_iteration_budget_is_exhausted` |
 | Approval resume with reasoning | Model-bound resume history retains reasoning before the call and terminal result in both modes. | `packages/core/tests/core/test_harness_tool_approval.py::test_approval_resume_replays_reasoning_with_function_call_group` |
+| Session-bound substituted response | A response is rebound to the immutable recorded call and cannot replace its call id, tool name, or arguments. | `packages/core/tests/core/test_function_invocation_logic.py::test_session_approval_binding_rebinds_consumes_and_rejects_duplicates` |
+| Truthy non-boolean decision | Strings, integers, null, and other non-booleans do not authorize execution. | `packages/core/tests/core/test_function_invocation_logic.py::test_session_approval_binding_treats_truthy_non_boolean_as_rejection`, `packages/core/tests/core/test_types.py::test_function_approval_response_deserialization_rejects_non_boolean_decisions`, `packages/ag-ui/tests/ag_ui/test_message_adapters.py::test_function_approval_requires_real_boolean`, `packages/ag-ui/tests/ag_ui/test_approval_result_event.py::test_resolve_approval_responses_treats_non_boolean_decision_as_rejection` |
+| Active batch replacement | A newly surfaced model batch replaces abandoned approval authority instead of growing session state. | `packages/core/tests/core/test_function_invocation_logic.py::test_session_approval_binding_replaces_abandoned_batch` |
+| Duplicate request id | Ambiguous request IDs within one active batch fail explicitly. | `packages/core/tests/core/test_function_invocation_logic.py::test_session_approval_batch_rejects_duplicate_request_ids` |
+| Tool registry changes | Same-name upgrades may execute the recorded operation; removing the recorded name executes nothing. | `packages/core/tests/core/test_harness_tool_approval.py::test_approval_resume_allows_same_name_tool_upgrade`, `test_approval_resume_does_not_execute_when_recorded_tool_disappears` |

 ### Approval correlation and replay

@@ -445,6 +465,8 @@ that manually replay messages own the equivalent rule: do not resend an approval
 | Missing result call id | A malformed result does not steal another approval's result. | `test_replace_approval_contents_with_results_skips_results_without_call_id` |
 | Empty approval message cleanup | Fully consumed approval messages are removed from normalized model input. | `test_replace_approval_contents_with_results_prunes_emptied_messages` |
 | Later stateless turn | A prior terminal approval response cannot execute again. | `test_resolved_approval_response_is_inert_on_later_stateless_turn` |
+| Unbound or duplicate response | A response with no pending session request is removed; one request authorizes at most one response. | `test_session_approval_binding_rebinds_consumes_and_rejects_duplicates` |
+| Forged inbound request history | A caller-supplied request wrapper cannot replace the server snapshot or resurrect consumed authority. | `test_session_approval_binding_does_not_trust_inbound_request_history` |
 | Pending history turn | An unresolved approval batch is omitted atomically from unrelated model input while a later decision can still resume it once. | `packages/core/tests/core/test_harness_tool_approval.py::test_pending_approval_from_file_history_stays_resumable_without_model_orphan` |
 | Duplicate function-call prevention | Approval normalization does not create a second call for one round. | `test_no_duplicate_function_calls_after_approval_processing` |
 | Rejection call id | Rejection result uses the function call id, not only the approval id. | `test_rejection_result_uses_function_call_id` |
@@ -462,6 +484,7 @@ that manually replay messages own the equivalent rule: do not resend an approval
 | Auto-approval callback | Callback receives the original function call and executes the approved set once. | `test_tool_approval_middleware_auto_approval_rule_receives_function_call` |
 | Shared call budget | Auto-approved re-entry does not reset `max_function_calls`, and every executed approval group counts even when it pauses for input. | `test_tool_approval_middleware_auto_approved_loops_share_function_call_budget`, `test_approval_resume_user_input_counts_toward_function_call_budget` |
 | Standing tool rule | Tool-level approval applies only to later matching tools. | `test_tool_approval_middleware_always_approve_tool_rule` |
+| Forged standing rule | An unbound or substituted hosted response cannot create a standing middleware approval rule for caller-selected metadata. | `test_tool_approval_middleware_drops_forged_standing_approval`, `test_tool_approval_middleware_rebinds_hosted_standing_approval` |
 | Hosted server boundary | Standing approval does not cross `server_label`. | `test_tool_approval_middleware_standing_rules_include_hosted_server_boundary` |
 | Argument-scoped rule | Exact arguments are required; empty arguments are not tool-wide. | `test_tool_approval_middleware_always_approve_tool_with_arguments_rule`, `test_tool_approval_middleware_empty_arguments_rule_is_not_tool_wide` |
 | Provider-injected approval tool | A tool added during `before_run` defers to in-run resolution, executes once, and emits one result. | `packages/ag-ui/tests/ag_ui/test_endpoint.py::test_endpoint_agent_approval_deferred_provider_tool_executes` |
@@ -544,6 +567,7 @@ uv run poe syntax -P openai
 uv run poe pyright -P openai
 uv run poe test-typing -P openai
 uv run poe test -P ag-ui
+uv run poe test -P declarative
 uv run --directory packages/foundry_hosting poe test
 ```

@@ -37,7 +37,7 @@ TextSearchStore textSearchStore = new(vectorStore, "product-and-policy-info", 30
 await textSearchStore.UpsertDocumentsAsync(GetSampleDocuments());

 // Create an adapter function that the TextSearchProvider can use to run searches against the TextSearchStore.
-Func<string, CancellationToken, Task<IEnumerable<TextSearchProvider.TextSearchResult>>> SearchAdapter = async (text, ct) =>
+async Task<IEnumerable<TextSearchProvider.TextSearchResult>> SearchAdapterAsync(string text, CancellationToken ct)
 {
    // Here we are limiting the search results to the single top result to demonstrate that we are accurately matching
    // specific search results for each question, but in a real world case, more results should be used.
@@ -49,7 +49,7 @@ Func<string, CancellationToken, Task<IEnumerable<TextSearchProvider.TextSearchRe
        Text = r.Text ?? string.Empty,
        RawRepresentation = r
    });
-};
+}

 // Configure the options for the TextSearchProvider.
 TextSearchProviderOptions textSearchOptions = new()
@@ -63,7 +63,7 @@ AIAgent agent = aiProjectClient
    .AsAIAgent(new ChatClientAgentOptions
    {
        ChatOptions = new() { ModelId = deploymentName, Instructions = "You are a helpful support specialist for Contoso Outdoors. Answer questions using the provided context and cite the source document when available." },
-        AIContextProviders = [new TextSearchProvider(SearchAdapter, textSearchOptions)],
+        AIContextProviders = [new TextSearchProvider(SearchAdapterAsync, textSearchOptions)],
        // Since we are using ChatCompletion which stores chat history locally, we can also add a message filter
        // that removes messages produced by the TextSearchProvider before they are added to the chat history, so that
        // we don't bloat chat history with all the search result messages.
@@ -40,7 +40,7 @@ await UploadDataFromMarkdown(afOverviewUrl, "Microsoft Agent Framework Overview"
 await UploadDataFromMarkdown(afMigrationUrl, "Semantic Kernel to Microsoft Agent Framework Migration Guide", documentationCollection, 2000, 200);

 // Create an adapter function that the TextSearchProvider can use to run searches against the collection.
-Func<string, CancellationToken, Task<IEnumerable<TextSearchProvider.TextSearchResult>>> SearchAdapter = async (text, ct) =>
+async Task<IEnumerable<TextSearchProvider.TextSearchResult>> SearchAdapterAsync(string text, CancellationToken ct)
 {
    List<TextSearchProvider.TextSearchResult> results = [];
    await foreach (var result in documentationCollection.SearchAsync(text, 5, cancellationToken: ct))
@@ -54,7 +54,7 @@ Func<string, CancellationToken, Task<IEnumerable<TextSearchProvider.TextSearchRe
        });
    }
    return results;
-};
+}

 // Configure the options for the TextSearchProvider.
 TextSearchProviderOptions textSearchOptions = new()
@@ -72,7 +72,7 @@ AIAgent agent = aiProjectClient
    .AsAIAgent(new ChatClientAgentOptions
    {
        ChatOptions = new() { ModelId = deploymentName, Instructions = "You are a helpful support specialist for the Microsoft Agent Framework. Answer questions using the provided context and cite the source document when available. Keep responses brief." },
-        AIContextProviders = [new TextSearchProvider(SearchAdapter, textSearchOptions)],
+        AIContextProviders = [new TextSearchProvider(SearchAdapterAsync, textSearchOptions)],
        // Configure a filter on the InMemoryChatHistoryProvider so that we don't persist the messages produced by the TextSearchProvider in chat history.
        // The default is to persist all messages except those that came from chat history in the first place.
        // You may choose to persist the TextSearchProvider messages, if you want the search output to be provided to the model in future interactions as well.
@@ -23,7 +23,7 @@ var endpoint = Environment.GetEnvironmentVariable("FOUNDRY_PROJECT_ENDPOINT") ??
 var deploymentName = Environment.GetEnvironmentVariable("FOUNDRY_MODEL") ?? "gpt-5.4-mini";

 // A sample function to load the next three calendar events for the user.
-Func<Task<string[]>> loadNextThreeCalendarEvents = async () =>
+async Task<string[]> LoadNextThreeCalendarEventsAsync()
 {
    // In a real implementation, this method would connect to a calendar service
    return
@@ -32,7 +32,7 @@ Func<Task<string[]>> loadNextThreeCalendarEvents = async () =>
        "Team meeting today at 17:00",
        "Birthday party today at 20:00"
    ];
-};
+}

 // Create an agent with an AI context provider attached that aggregates two other providers.
 // You must dissable client side conversation storage for clients that support it:
@@ -64,7 +64,7 @@ AIAgent agent = new AIProjectClient(
        // The agent will call each provider in sequence, accumulating context from each.
        AIContextProviders = [
            new TodoListAIContextProvider(),
-            new CalendarSearchAIContextProvider(loadNextThreeCalendarEvents)
+            new CalendarSearchAIContextProvider(LoadNextThreeCalendarEventsAsync)
        ],
    });

@@ -636,7 +636,7 @@ def _handle_step_based_approval(messages: list[Any]) -> list[BaseEvent]:
        try:
            parsed_result = json.loads(approval_text)
            result: dict[str, Any] = cast(dict[str, Any], parsed_result) if isinstance(parsed_result, dict) else {}
-            accepted = bool(result.get("accepted", False))
+            accepted = result.get("accepted") is True
            steps_raw = result.get("steps", [])
            steps: list[dict[str, Any]] = []
            if isinstance(steps_raw, list):
@@ -880,7 +880,7 @@ def _register_server_generated_approval_response(
        aliases=[str(response.function_call.call_id)] if response.function_call.call_id else None,
        server_label=_function_call_server_label(response.function_call),
    )
-    if not response.approved:
+    if response.approved is not True:
        lifecycle.claim_batch(
            thread_id=thread_id,
            decisions=[
@@ -1565,6 +1565,12 @@ async def _resolve_approval_responses(
        # stale replay controls and must not authorize a malformed fresh one.
        primary_response = responses[-1]
        response_content_ids_to_strip.update(id(response) for response in responses[:-1])
+        if not isinstance(primary_response.approved, bool):
+            logger.warning(
+                "Treating approval response id=%s as rejected: approved must be a boolean",
+                primary_response.id,
+            )
+            primary_response.approved = False
        resp_id = primary_response.id
        id_entry = (
            lifecycle.occurrence_for_alias(thread_id=thread_id, interrupt_id=str(resp_id))
@@ -1612,7 +1618,7 @@ async def _resolve_approval_responses(
            else:
                primary_response.function_call.additional_properties.pop("server_label", None)
        if (
-            primary_response.approved
+            primary_response.approved is True
            and lifecycle is not None
            and authorized_executions is not None
            and primary_response.function_call is not None
@@ -1626,14 +1632,14 @@ async def _resolve_approval_responses(
            intents_by_response_content_id[id(primary_response)] = intent
        valid_response_content_ids.add(id(primary_response))
        if (
-            primary_response.approved
+            primary_response.approved is True
            and intent is not None
            and intent.owner in {ApprovalExecutionOwner.HOSTED, ApprovalExecutionOwner.DEFERRED}
        ):
            validated_forwarded_approvals.append(primary_response)
        if not server_label:
            pending_local_response_content_ids.add(id(primary_response))
-        if validated_approved_responses is not None and primary_response.approved and not server_label:
+        if validated_approved_responses is not None and primary_response.approved is True and not server_label:
            validated_approved_responses.append(primary_response)

    if response_content_ids_to_strip:
@@ -1698,7 +1704,7 @@ async def _resolve_approval_responses(
    if not fcc_todo:
        return []

-    approved_responses = [resp for resp in fcc_todo.values() if resp.approved]
+    approved_responses = [resp for resp in fcc_todo.values() if resp.approved is True]

    approved_function_result_groups: list[list[Content]] = []

@@ -1909,7 +1915,7 @@ def _clean_resolved_approvals_from_snapshot(
            )
            if target_call_id is None:
                continue
-            if parsed.get("accepted"):
+            if parsed.get("accepted") is True:
                replacement = result_by_call_id.get(target_call_id)
                if replacement is None:
                    continue
@@ -901,7 +901,7 @@ class ApprovalLifecycle:
            result
            for result in results
            if result.type == "function_approval_response"
-            and result.approved
+            and result.approved is True
            and result.function_call is not None
            and result.function_call.call_id == occurrence.identity.call_id
        ]
@@ -152,9 +152,9 @@ def _sanitize_tool_history(
                    if content.function_call and content.function_call.call_id:
                        approval_call_ids.add(str(content.function_call.call_id))
                    if approval_accepted is None:
-                        approval_accepted = bool(content.approved)
+                        approval_accepted = content.approved is True
                    else:
-                        approval_accepted = approval_accepted and bool(content.approved)
+                        approval_accepted = approval_accepted and content.approved is True

            if approval_call_ids and pending_tool_call_ids:
                pending_tool_call_ids = [
@@ -203,7 +203,7 @@ def _sanitize_tool_history(
                            contents=[
                                Content.from_function_result(
                                    call_id=pending_confirm_changes_id,
-                                    result="Confirmed" if parsed.get("accepted") else "Rejected",
+                                    result="Confirmed" if parsed.get("accepted") is True else "Rejected",
                                )
                            ],
                        )
@@ -360,9 +360,10 @@ def _extract_multimodal_source_fields(
 ) -> tuple[str | None, str | None, str | None, str | None]:
    """Extract ``(url, data, binary_id, mime_type)`` from an AG-UI multimodal part.

-    Handles both the current AG-UI spec (``source.value`` for base64 payloads) and the
-    legacy ``source.data`` field for backward compatibility. Returned values are the
-    raw extracted strings (or ``None`` when absent); callers apply their own defaults.
+    Handles both the current AG-UI spec (``source.value`` for both URL and base64
+    payloads) and the legacy ``source.url``/``source.data`` fields for backward
+    compatibility. Returned values are the raw extracted strings (or ``None`` when
+    absent); callers apply their own defaults.
    """
    mime_type = cast(str | None, part.get("mimeType") or part.get("mime_type"))
    url = cast(str | None, part.get("url") or part.get("uri"))
@@ -378,7 +379,7 @@ def _extract_multimodal_source_fields(
            mime_type = source_mime

        if source_type in {"url", "uri"}:
-            url = cast(str | None, source_dict.get("url") or source_dict.get("uri"))
+            url = cast(str | None, source_dict.get("value") or source_dict.get("url") or source_dict.get("uri"))
        elif source_type in {"base64", "data", "binary"}:
            data = cast(str | None, source_dict.get("value") or source_dict.get("data"))
        elif source_type in {"id", "file"}:
@@ -724,7 +725,7 @@ def agui_messages_to_agent_framework(messages: list[dict[str, Any]]) -> list[Mes
                # Look for the matching function call in previous messages to create
                # proper function_approval_response content. This enables the agent framework
                # to execute the approved tool (fix for GitHub issue #3034).
-                accepted = parsed.get("accepted", False) if parsed is not None else False
+                accepted = parsed.get("accepted") is True if parsed is not None else False
                approval_payload_text = result_content if isinstance(result_content, str) else json.dumps(parsed)

                # Log the full approval payload to debug modified arguments
@@ -932,7 +933,7 @@ def agui_messages_to_agent_framework(messages: list[dict[str, Any]]) -> list[Mes

                # Create the approval response
                approval_response = Content.from_function_approval_response(
-                    approved=approval.get("approved", True),
+                    approved=approval.get("approved") is True,
                    id=approval.get("id", ""),
                    function_call=func_call,
                )
@@ -14,7 +14,7 @@ from conftest import StubAgent  # pyrefly: ignore[missing-import] # pyright: ign

 from agent_framework_ag_ui._agent import AgentConfig
 from agent_framework_ag_ui._agent_run import run_agent_stream
-from agent_framework_ag_ui._approval_lifecycle import ApprovalExecutionOwner
+from agent_framework_ag_ui._approval_lifecycle import ApprovalExecutionOwner, ApprovalStatus
 from agent_framework_ag_ui._approval_state import InMemoryAGUIApprovalStateStore


@@ -148,6 +148,69 @@ async def test_rejected_call_does_not_execute_or_emit_live_result() -> None:
    assert not [event for event in events if getattr(event, "type", None) == "TOOL_CALL_RESULT"]


+async def test_resolve_approval_responses_treats_non_boolean_decision_as_rejection() -> None:
+    """A malformed decision completes the pending call as an explicit rejection."""
+    executions: list[str] = []
+
+    def guarded_write(value: str) -> str:
+        executions.append(value)
+        return f"wrote:{value}"
+
+    tool = FunctionTool(name="guarded_write", description="Write", func=guarded_write)
+    function_call = Content.from_function_call(
+        call_id="call-bool",
+        name="guarded_write",
+        arguments={"value": "safe"},
+    )
+    response = Content.from_function_approval_response(
+        approved=True,
+        id="approval-bool",
+        function_call=function_call,
+    )
+    response.approved = "true"  # type: ignore[assignment]  # ty: ignore[invalid-assignment]
+    store = InMemoryAGUIApprovalStateStore()
+    store.set_tool_approval_state(
+        "thread-bool",
+        {"collected_approval_responses": [response]},
+    )
+    agent = StubAgent(
+        updates=[AgentResponseUpdate(contents=[Content.from_text(text="Done.")], role="assistant")],
+        default_options={"tools": [tool]},
+    )
+
+    events = [
+        event
+        async for event in run_agent_stream(
+            {
+                "thread_id": "thread-bool",
+                "run_id": "run-bool",
+                "messages": [{"role": "user", "content": "Continue"}],
+            },
+            agent,
+            AgentConfig(),
+            approval_state_store=store,
+        )
+    ]
+
+    occurrence = store.lifecycle.occurrence_for_alias(
+        thread_id="thread-bool",
+        interrupt_id="approval-bool",
+    )
+    rejection_results = [
+        content
+        for message in agent.messages_received
+        for content in message.contents
+        if content.type == "function_result" and content.call_id == "call-bool"
+    ]
+    assert executions == []
+    assert occurrence is not None
+    assert occurrence.status is ApprovalStatus.REJECTED
+    assert [(result.call_id, result.result) for result in rejection_results] == [
+        ("call-bool", "Error: Tool call invocation was rejected by user.")
+    ]
+    assert not [event for event in events if getattr(event, "type", None) == "TOOL_CALL_RESULT"]
+
+
 async def test_mixed_batch_preserves_approved_result_identity_and_order() -> None:
    executions: list[str] = []

@@ -100,6 +100,56 @@ def test_agui_tool_result_to_agent_framework():
    assert message.additional_properties.get("tool_call_id") == "call_123"


+@pytest.mark.parametrize("approved", [None, "true", "false", 1, 0, []])
+def test_function_approval_requires_real_boolean(approved: Any) -> None:
+    """Missing and malformed decisions are converted to explicit rejection."""
+    approval: dict[str, Any] = {
+        "id": "approval_1",
+        "call_id": "call_1",
+        "name": "sensitive_action",
+        "arguments": {},
+    }
+    if approved is not None:
+        approval["approved"] = approved
+
+    messages = agui_messages_to_agent_framework([{"role": "user", "content": "", "function_approvals": [approval]}])
+
+    response = messages[0].contents[0]
+    assert response.type == "function_approval_response"
+    assert response.approved is False
+
+
+@pytest.mark.parametrize(
+    ("accepted", "expected"),
+    [(True, True), (False, False), ("true", False), (1, False), (None, False)],
+)
+def test_tool_approval_accepted_requires_real_boolean(accepted: Any, expected: bool) -> None:
+    """Only the literal boolean true authorizes a raw tool approval payload."""
+    messages = agui_messages_to_agent_framework(
+        [
+            {
+                "role": "assistant",
+                "tool_calls": [
+                    {
+                        "id": "call_1",
+                        "type": "function",
+                        "function": {"name": "sensitive_action", "arguments": {}},
+                    }
+                ],
+            },
+            {
+                "role": "tool",
+                "toolCallId": "call_1",
+                "content": json.dumps({"accepted": accepted}),
+            },
+        ]
+    )
+
+    response = messages[1].contents[0]
+    assert response.type == "function_approval_response"
+    assert response.approved is expected
+
+
 def test_agui_tool_approval_updates_tool_call_arguments():
    """Tool approval updates matching tool call arguments for snapshots and agent context.

@@ -1995,3 +2045,39 @@ def test_parse_multimodal_media_part_unknown_source_value_fallback():
    )
    assert result is not None
    assert "aGVsbG8=" in result.uri  # type: ignore[operator]  # pyrefly: ignore[not-iterable]  # ty: ignore[unsupported-operator]
+
+
+def test_parse_multimodal_media_part_url_value_field():
+    """Source with type='url' reads the URL from the 'value' field per AG-UI spec."""
+    from agent_framework_ag_ui._message_adapters import _parse_multimodal_media_part
+
+    result = _parse_multimodal_media_part(
+        {
+            "type": "document",
+            "source": {
+                "type": "url",
+                "value": "https://example.com/files/document.pdf",
+                "mime_type": "application/pdf",
+            },
+        }
+    )
+    assert result is not None
+    assert result.uri == "https://example.com/files/document.pdf"
+    assert result.media_type == "application/pdf"
+
+
+def test_parse_multimodal_media_part_url_field_backward_compat():
+    """Source with type='url' still supports the non-spec 'url' and 'uri' fields."""
+    from agent_framework_ag_ui._message_adapters import _parse_multimodal_media_part
+
+    from_url = _parse_multimodal_media_part(
+        {"type": "image", "source": {"type": "url", "url": "https://example.com/a.png"}}
+    )
+    assert from_url is not None
+    assert from_url.uri == "https://example.com/a.png"
+
+    from_uri = _parse_multimodal_media_part(
+        {"type": "image", "source": {"type": "uri", "uri": "https://example.com/b.png"}}
+    )
+    assert from_uri is not None
+    assert from_uri.uri == "https://example.com/b.png"
@@ -386,7 +386,7 @@ class ToolApprovalMiddleware(AgentMiddleware):

        state = _get_state(context.session, source_id=self.source_id)
        context.client_kwargs.setdefault(_FUNCTION_INVOCATION_BUDGET_STATE_KEY, {})
-        context.messages = self._prepare_inbound_messages(context.messages, state)
+        context.messages = self._prepare_inbound_messages(context.messages, state, context.session)
        await self._drain_auto_approvable_queue(state)
        if next_queued := self._pop_next_queued_request(state):
            _save_state(context.session, state, source_id=self.source_id)
@@ -501,14 +501,22 @@ class ToolApprovalMiddleware(AgentMiddleware):

        return ResponseStream(_stream(), finalizer=AgentResponse.from_updates)

-    def _prepare_inbound_messages(self, messages: Sequence[Message], state: ToolApprovalState) -> list[Message]:
+    def _prepare_inbound_messages(
+        self,
+        messages: Sequence[Message],
+        state: ToolApprovalState,
+        session: AgentSession,
+    ) -> list[Message]:
        prepared: list[Message] = []
        for message in messages:
            replacement_contents: list[Content] = []
            changed = False
            for content in message.contents:
                if content.type == "function_approval_response":
-                    replacement = self._handle_inbound_approval_response(content, state)
+                    replacement = self._handle_inbound_approval_response(content, state, session)
+                    if replacement is None:
+                        changed = True
+                        continue
                    state.collected_approval_responses.append(replacement)
                    changed = True
                    continue
@@ -523,9 +531,23 @@ class ToolApprovalMiddleware(AgentMiddleware):
                prepared.append(cloned)
        return prepared

-    def _handle_inbound_approval_response(self, response: Content, state: ToolApprovalState) -> Content:
+    def _handle_inbound_approval_response(
+        self,
+        response: Content,
+        state: ToolApprovalState,
+        session: AgentSession,
+    ) -> Content | None:
+        from .._tools import (
+            _bind_approval_response_to_pending_request,  # pyright: ignore[reportPrivateUsage]
+            _is_approval_granted,  # pyright: ignore[reportPrivateUsage]
+        )
+
+        bound_response = _bind_approval_response_to_pending_request(response, session, consume=False)
+        if bound_response is None:
+            return None
+        response = bound_response
        scope = _get_always_approve_scope(response)
-        if scope is None or not response.approved:
+        if scope is None or not _is_approval_granted(response.approved):
            return response

        function_call = response.function_call
@@ -97,6 +97,7 @@ DEFAULT_MAX_CONSECUTIVE_ERRORS_PER_REQUEST: Final[int] = 3
 SHELL_TOOL_KIND_VALUE: Final[str] = "shell"
 _TOOL_APPROVAL_STATE_KEY: Final[str] = "tool_approval"
 _ALREADY_APPROVED_APPROVAL_REQUEST_GROUPS_KEY: Final[str] = "already_approved_approval_request_groups"
+_PENDING_APPROVAL_REQUESTS_KEY: Final[str] = "pending_approval_requests"
 _FUNCTION_INVOCATION_BUDGET_STATE_KEY: Final[str] = "_function_invocation_budget_state"
 _FUNCTION_INVOCATION_LIMIT_FALLBACK_TEXT: Final[str] = (
    "Function invocation limit reached before a final answer could be produced."
@@ -1813,6 +1814,7 @@ async def _try_execute_function_call_groups(
            visible_requests,
            already_approved_requests,
        )
+        _store_pending_approval_requests(invocation_session, visible_requests)
        return [[request] for request in visible_requests], False
    if has_declaration_only_call:
        # Declaration-only calls are returned as user input rather than executed locally.
@@ -1943,6 +1945,11 @@ def _is_hosted_tool_approval(content: Any) -> bool:
    return bool(ap and ap.get("server_label"))


+def _is_approval_granted(value: Any) -> bool:
+    """Return whether an approval decision is the strict boolean ``True``."""
+    return value is True
+
+
 def _is_unexecutable_local_tool_content(content: Content) -> bool:
    if _is_actionable_function_call(content):
        return True
@@ -2072,6 +2079,146 @@ def _content_from_state(value: Any) -> Content | None:
    return None


+def _load_pending_approval_requests(invocation_session: AgentSession | None) -> dict[str, Content]:
+    """Load immutable approval-request snapshots keyed by request ID."""
+    state = _get_tool_approval_state(invocation_session)
+    if state is None:
+        return {}
+    raw_requests = state.get(_PENDING_APPROVAL_REQUESTS_KEY, [])
+    if not isinstance(raw_requests, list):
+        return {}
+    pending: dict[str, Content] = {}
+    for raw_request in cast(list[Any], raw_requests):
+        request = _content_from_state(raw_request)
+        if request is not None and request.type == "function_approval_request" and request.id is not None:
+            if request.id in pending:
+                raise ValueError(f"Duplicate pending approval request id {request.id!r}.")
+            pending[request.id] = request
+    return pending
+
+
+def _save_pending_approval_requests(
+    invocation_session: AgentSession | None,
+    pending_requests: Mapping[str, Content],
+) -> None:
+    """Persist the active approval-request batch."""
+    state = _get_tool_approval_state(invocation_session)
+    if state is None:
+        return
+    if pending_requests:
+        state[_PENDING_APPROVAL_REQUESTS_KEY] = [request.to_dict() for request in pending_requests.values()]
+    else:
+        state.pop(_PENDING_APPROVAL_REQUESTS_KEY, None)
+
+
+def _store_pending_approval_requests(
+    invocation_session: AgentSession | None,
+    approval_requests: Sequence[Content],
+) -> None:
+    """Replace the active batch with immutable snapshots of surfaced approval requests."""
+    if invocation_session is None:
+        return
+    pending: dict[str, Content] = {}
+    for request in approval_requests:
+        if request.type != "function_approval_request" or request.id is None:
+            continue
+        if request.id in pending:
+            raise ValueError(f"Duplicate approval request id {request.id!r} in the active batch.")
+        snapshot = _content_from_state(request.to_dict())
+        if snapshot is not None:
+            pending[request.id] = snapshot
+    _save_pending_approval_requests(invocation_session, pending)
+    state = _get_tool_approval_state(invocation_session)
+    if state is None:
+        return
+    raw_groups = state.get(_ALREADY_APPROVED_APPROVAL_REQUEST_GROUPS_KEY)
+    if not isinstance(raw_groups, list):
+        return
+    active_ids = set(pending)
+    active_groups: list[Any] = []
+    for raw_group in cast(list[Any], raw_groups):
+        if not isinstance(raw_group, Mapping):
+            continue
+        group = cast(Mapping[str, Any], raw_group)
+        raw_ids = group.get("approval_request_ids")
+        if not isinstance(raw_ids, list):
+            continue
+        group_ids = {str(item) for item in cast(list[Any], raw_ids)}
+        if group_ids.issubset(active_ids):
+            active_groups.append(raw_group)
+    if active_groups:
+        state[_ALREADY_APPROVED_APPROVAL_REQUEST_GROUPS_KEY] = active_groups
+    else:
+        state.pop(_ALREADY_APPROVED_APPROVAL_REQUEST_GROUPS_KEY, None)
+
+
+def _bind_approval_response_to_pending_request(
+    response: Content,
+    invocation_session: AgentSession | None,
+    *,
+    consume: bool,
+) -> Content | None:
+    """Bind one approval response to a session-recorded request."""
+    from ._types import Content
+
+    if invocation_session is None:
+        return response
+    if response.id is None:
+        return None
+    pending = _load_pending_approval_requests(invocation_session)
+    request = pending.get(response.id)
+    if request is None or request.function_call is None:
+        return None
+    rebound_call = _content_from_state(request.function_call.to_dict())
+    if rebound_call is None:
+        return None
+    rebound = Content.from_function_approval_response(
+        approved=_is_approval_granted(response.approved),
+        id=response.id,
+        function_call=rebound_call,
+        annotations=response.annotations,
+        additional_properties=copy.deepcopy(response.additional_properties),
+        raw_representation=response.raw_representation,
+    )
+    if consume:
+        pending.pop(response.id, None)
+        _save_pending_approval_requests(invocation_session, pending)
+    return rebound
+
+
+def _bind_approval_responses_to_pending_requests(
+    messages: list[Message],
+    invocation_session: AgentSession | None,
+) -> None:
+    """Rebind approval responses and remove unissued or duplicate responses."""
+    if invocation_session is None:
+        return
+
+    filtered_messages: list[Message] = []
+    for message in messages:
+        filtered_contents: list[Content] = []
+        for content in message.contents:
+            if content.type != "function_approval_response":
+                filtered_contents.append(content)
+                continue
+            rebound = _bind_approval_response_to_pending_request(
+                content,
+                invocation_session,
+                consume=True,
+            )
+            if rebound is None:
+                logger.warning(
+                    "Ignored an approval response with request id %r because no pending approval request exists.",
+                    content.id,
+                )
+                continue
+            filtered_contents.append(rebound)
+        if filtered_contents:
+            message.contents = filtered_contents
+            filtered_messages.append(message)
+    messages[:] = filtered_messages
+
+
 def _store_already_approved_approval_requests(
    invocation_session: AgentSession | None,
    visible_approval_requests: Sequence[Content],
@@ -2419,7 +2566,7 @@ def _replace_approval_contents_with_results(
                if occurrence is None:
                    occurrence = find_open_occurrence(call_id)
                replacements: list[Content] | None
-                if content.approved:
+                if _is_approval_granted(content.approved):
                    call_result_groups = result_groups_by_call_id.get(call_id)
                    replacements = call_result_groups.popleft() if call_result_groups else None
                else:
@@ -2708,6 +2855,8 @@ async def _resolve_approval_responses(
    """Resolve inbound approval responses before the next model call."""
    from ._types import Message

+    _bind_approval_responses_to_pending_requests(prepared_messages, invocation_session)
+
    # 1. Restore safe siblings hidden with a prior mixed approval batch when its visible decision arrives.
    explicit_approval_response_ids = {
        content.id
@@ -2728,7 +2877,9 @@ async def _resolve_approval_responses(
        return _FunctionProcessingResult(errors_in_a_row=errors_in_a_row)

    # 3. Execute approved decisions once. Rejected decisions are converted to results during normalization below.
-    responses_to_execute = [response for response in pending_approval_responses.values() if response.approved]
+    responses_to_execute = [
+        response for response in pending_approval_responses.values() if _is_approval_granted(response.approved)
+    ]
    execution_result_groups: list[list[Content]] = []
    should_terminate = False
    reached_error_limit = False
@@ -2782,14 +2933,23 @@ async def _process_model_function_calls(
    errors_in_a_row: int,
    max_errors: int,
    execute_function_calls: _FunctionCallExecutor,
+    invocation_session: AgentSession | None = None,
 ) -> _FunctionProcessingResult:
    """Execute function calls from a newly completed model response."""
+    approval_requests = [
+        content
+        for message in response.messages
+        for content in message.contents
+        if content.type == "function_approval_request"
+    ]
    # 1. Extract only actionable, unanswered calls from this model turn.
    tools = _extract_tools(options)
    function_calls = _extract_function_calls(response)
    if not (function_calls and tools):
        if function_call_messages is not None:
            _prepend_function_call_messages(response, function_call_messages)
+        if approval_requests:
+            _store_pending_approval_requests(invocation_session, approval_requests)
        return _FunctionProcessingResult(errors_in_a_row=errors_in_a_row, action="return")

    # 2. Execute the batch once while preserving each call's result group.
@@ -2810,6 +2970,15 @@ async def _process_model_function_calls(
    )
    if execution.should_terminate:
        processing_result.action = "return"
+    if processing_result.action == "return":
+        returned_approval_requests = [
+            content
+            for message in response.messages
+            for content in message.contents
+            if content.type == "function_approval_request"
+        ]
+        if returned_approval_requests:
+            _store_pending_approval_requests(invocation_session, returned_approval_requests)
    return processing_result


@@ -2967,6 +3136,7 @@ class FunctionInvocationLayer(Generic[OptionsCoT]):
                errors_in_a_row=errors_in_a_row,
                max_errors=max_errors,
                execute_function_calls=execute_function_calls,
+                invocation_session=invocation_session,
            )
            total_function_calls = _record_function_calls(
                budget_state,
@@ -3117,6 +3287,7 @@ class FunctionInvocationLayer(Generic[OptionsCoT]):
                errors_in_a_row=errors_in_a_row,
                max_errors=max_errors,
                execute_function_calls=execute_function_calls,
+                invocation_session=invocation_session,
            )
            errors_in_a_row = function_processing.errors_in_a_row
            total_function_calls = _record_function_calls(
@@ -1304,7 +1304,7 @@ class Content:
        """Create function approval response content."""
        return cls(
            "function_approval_response",
-            approved=approved,
+            approved=approved if type(approved) is bool else False,
            id=id,
            function_call=function_call,
            annotations=annotations,
@@ -1457,6 +1457,9 @@ class Content:
        if (function_call := remaining.get("function_call")) and isinstance(function_call, dict):
            remaining["function_call"] = cls.from_dict(function_call)  # type: ignore[reportUnknownArgumentType]

+        if content_type == "function_approval_response" and type(remaining.get("approved")) is not bool:
+            remaining["approved"] = False
+
        # Handle list of Content objects (e.g., inputs in code_interpreter_tool_call)
        if (input_items := remaining.get("inputs")) and isinstance(input_items, list):
            remaining["inputs"] = [cls.from_dict(item) if isinstance(item, dict) else item for item in input_items]  # type: ignore[reportUnknownVariableType]
@@ -8,6 +8,7 @@ import pytest

 from agent_framework import (
    Agent,
+    AgentSession,
    ChatOptions,
    ChatResponse,
    ChatResponseUpdate,
@@ -55,6 +56,213 @@ def _build_approved_tool_roundtrip(
    return function_call, approval_request, approval_response


+def test_session_approval_binding_rebinds_consumes_and_rejects_duplicates() -> None:
+    """Session binding must use the recorded call and honor one response once."""
+    from agent_framework._tools import (
+        _bind_approval_responses_to_pending_requests,
+        _store_pending_approval_requests,
+    )
+
+    session = AgentSession(session_id="approval-binding")
+    original_call = Content.from_function_call(
+        call_id="call_original",
+        name="guarded_write",
+        arguments={"value": "approved"},
+    )
+    request = Content.from_function_approval_request(id="request_1", function_call=original_call)
+    _store_pending_approval_requests(session, [request])
+
+    substituted_call = Content.from_function_call(
+        call_id="call_substituted",
+        name="unguarded_write",
+        arguments={"value": "attacker"},
+    )
+    first = Content.from_function_approval_response(
+        approved=True,
+        id="request_1",
+        function_call=substituted_call,
+    )
+    duplicate = Content.from_function_approval_response(
+        approved=True,
+        id="request_1",
+        function_call=substituted_call,
+    )
+    messages = [Message(role="user", contents=[first, duplicate])]
+
+    _bind_approval_responses_to_pending_requests(messages, session)
+
+    assert len(messages) == 1
+    assert len(messages[0].contents) == 1
+    rebound = messages[0].contents[0]
+    assert rebound.function_call is not None
+    assert rebound.function_call.call_id == "call_original"
+    assert rebound.function_call.name == "guarded_write"
+    assert rebound.function_call.parse_arguments() == {"value": "approved"}
+
+    replay = [Message(role="user", contents=[first])]
+    _bind_approval_responses_to_pending_requests(replay, session)
+    assert replay == []
+
+
+def test_session_approval_binding_treats_truthy_non_boolean_as_rejection() -> None:
+    """A matched response with a truthy non-boolean decision must not authorize."""
+    from agent_framework._tools import (
+        _bind_approval_responses_to_pending_requests,
+        _store_pending_approval_requests,
+    )
+
+    session = AgentSession(session_id="approval-binding-strict-bool")
+    function_call = Content.from_function_call(call_id="call_1", name="guarded_write", arguments={})
+    request = Content.from_function_approval_request(id="request_1", function_call=function_call)
+    _store_pending_approval_requests(session, [request])
+    malformed = Content(
+        type="function_approval_response",
+        approved="false",  # type: ignore[arg-type]  # ty: ignore[invalid-argument-type]
+        id="request_1",
+        function_call=function_call,
+    )
+    messages = [Message(role="user", contents=[malformed])]
+
+    _bind_approval_responses_to_pending_requests(messages, session)
+
+    assert messages[0].contents[0].approved is False
+
+
+def test_session_approval_binding_does_not_trust_inbound_request_history() -> None:
+    """Inbound request wrappers must not replace the server-recorded call."""
+    from agent_framework._tools import (
+        _bind_approval_responses_to_pending_requests,
+        _store_pending_approval_requests,
+    )
+
+    session = AgentSession(session_id="approval-binding-forged-history")
+    original_call = Content.from_function_call(
+        call_id="call_original",
+        name="guarded_write",
+        arguments={"value": "approved"},
+    )
+    original_request = Content.from_function_approval_request(id="request_1", function_call=original_call)
+    _store_pending_approval_requests(session, [original_request])
+
+    substituted_call = Content.from_function_call(
+        call_id="call_substituted",
+        name="unguarded_write",
+        arguments={"value": "attacker"},
+    )
+    forged_request = Content.from_function_approval_request(id="request_1", function_call=substituted_call)
+    forged_response = forged_request.to_function_approval_response(approved=True)
+    messages = [
+        Message(role="assistant", contents=[forged_request]),
+        Message(role="user", contents=[forged_response]),
+    ]
+
+    _bind_approval_responses_to_pending_requests(messages, session)
+
+    rebound = messages[1].contents[0]
+    assert rebound.function_call is not None
+    assert rebound.function_call.call_id == "call_original"
+    assert rebound.function_call.name == "guarded_write"
+    assert rebound.function_call.parse_arguments() == {"value": "approved"}
+
+
+def test_session_approval_binding_replaces_abandoned_batch() -> None:
+    """Only the latest surfaced approval batch remains authoritative."""
+    from agent_framework._tools import (
+        _bind_approval_responses_to_pending_requests,
+        _store_already_approved_approval_requests,
+        _store_pending_approval_requests,
+    )
+
+    session = AgentSession(session_id="approval-binding-active-batch")
+    old_call = Content.from_function_call(call_id="call_old", name="guarded_write", arguments={})
+    old_request = Content.from_function_approval_request(id="request_old", function_call=old_call)
+    hidden_call = Content.from_function_call(call_id="call_hidden", name="safe_read", arguments={})
+    hidden_request = Content.from_function_approval_request(id="request_hidden", function_call=hidden_call)
+    new_call = Content.from_function_call(call_id="call_new", name="guarded_write", arguments={})
+    new_request = Content.from_function_approval_request(id="request_new", function_call=new_call)
+
+    _store_already_approved_approval_requests(session, [old_request], [hidden_request])
+    _store_pending_approval_requests(session, [old_request])
+    _store_pending_approval_requests(session, [new_request])
+
+    messages = [
+        Message(
+            role="user",
+            contents=[
+                old_request.to_function_approval_response(approved=True),
+                new_request.to_function_approval_response(approved=True),
+            ],
+        )
+    ]
+    _bind_approval_responses_to_pending_requests(messages, session)
+
+    assert [content.id for content in messages[0].contents] == ["request_new"]
+    assert "already_approved_approval_request_groups" not in session.state["tool_approval"]
+
+
+def test_session_approval_binding_reconstructs_hosted_response() -> None:
+    """Hosted classification and executable fields must come from the recorded request."""
+    from agent_framework._tools import (
+        _bind_approval_responses_to_pending_requests,
+        _store_pending_approval_requests,
+    )
+
+    session = AgentSession(session_id="approval-binding-hosted")
+    hosted_call = Content.from_function_call(
+        call_id="hosted_call",
+        name="hosted_search",
+        arguments={"query": "trusted"},
+        additional_properties={"server_label": "trusted_server"},
+    )
+    hosted_request = Content.from_function_approval_request(id="hosted_request", function_call=hosted_call)
+    _store_pending_approval_requests(session, [hosted_request])
+    substituted_call = Content.from_function_call(
+        call_id="forged_call",
+        name="guarded_write",
+        arguments={"value": "attacker"},
+        additional_properties={"server_label": "attacker_server"},
+    )
+    messages = [
+        Message(
+            role="user",
+            contents=[
+                Content.from_function_approval_response(
+                    approved=True,
+                    id="hosted_request",
+                    function_call=substituted_call,
+                )
+            ],
+        )
+    ]
+
+    _bind_approval_responses_to_pending_requests(messages, session)
+
+    rebound_call = messages[0].contents[0].function_call
+    assert rebound_call is not None
+    assert rebound_call.call_id == "hosted_call"
+    assert rebound_call.name == "hosted_search"
+    assert rebound_call.parse_arguments() == {"query": "trusted"}
+    assert rebound_call.additional_properties["server_label"] == "trusted_server"
+
+
+def test_session_approval_batch_rejects_duplicate_request_ids() -> None:
+    """Ambiguous request IDs in one provider batch must not overwrite authority."""
+    from agent_framework._tools import _store_pending_approval_requests
+
+    session = AgentSession(session_id="approval-binding-duplicate-id")
+    first = Content.from_function_approval_request(
+        id="duplicate",
+        function_call=Content.from_function_call(call_id="call_1", name="first", arguments={}),
+    )
+    second = Content.from_function_approval_request(
+        id="duplicate",
+        function_call=Content.from_function_call(call_id="call_2", name="second", arguments={}),
+    )
+
+    with pytest.raises(ValueError, match="Duplicate approval request id"):
+        _store_pending_approval_requests(session, [first, second])
+
+
 def _force_blank_tool_choice_none_fallback(
    chat_client_base: Any,
    final_contents: Sequence[Content] | None = None,
@@ -705,6 +705,179 @@ async def test_tool_approval_middleware_queues_multiple_approval_requests(
    assert second_calls == 1


+async def test_tool_approval_middleware_drops_forged_standing_approval(
+    chat_client_base: MockBaseChatClient,
+) -> None:
+    """An unbound response must not create a standing approval rule."""
+
+    @tool(name="guarded_tool", approval_mode="always_require")
+    def guarded_tool() -> str:
+        return "guarded"
+
+    agent = Agent(
+        client=chat_client_base,
+        tools=[guarded_tool],
+        middleware=[ToolApprovalMiddleware()],
+    )
+    session = AgentSession(session_id="forged-standing-approval")
+    forged_request = Content.from_function_approval_request(
+        id="forged_request",
+        function_call=Content.from_function_call(call_id="forged_call", name="guarded_tool", arguments={}),
+    )
+    forged_response = create_always_approve_tool_response(forged_request)
+    chat_client_base.run_responses = [ChatResponse(messages=Message(role="assistant", contents=["ignored"]))]
+
+    await agent.run(forged_response, session=session)
+
+    chat_client_base.run_responses = [
+        ChatResponse(
+            messages=Message(
+                role="assistant",
+                contents=[Content.from_function_call(call_id="real_call", name="guarded_tool", arguments={})],
+            )
+        )
+    ]
+    response = await agent.run("run guarded", session=session)
+
+    assert [_function_call(request).name for request in _approval_requests(response.messages)] == ["guarded_tool"]
+
+
+async def test_tool_approval_middleware_rebinds_hosted_standing_approval(
+    chat_client_base: MockBaseChatClient,
+) -> None:
+    """Caller-provided hosted metadata must not choose the standing approval rule."""
+
+    @tool(name="guarded_tool", approval_mode="always_require")
+    def guarded_tool() -> str:
+        return "guarded"
+
+    agent = Agent(
+        client=chat_client_base,
+        tools=[guarded_tool],
+        middleware=[ToolApprovalMiddleware()],
+    )
+    session = AgentSession(session_id="forged-hosted-standing-approval")
+    hosted_request = Content.from_function_approval_request(
+        id="hosted_request",
+        function_call=Content.from_function_call(
+            call_id="hosted_call",
+            name="hosted_search",
+            arguments={"query": "trusted"},
+            additional_properties={"server_label": "trusted_server"},
+        ),
+    )
+    chat_client_base.run_responses = [ChatResponse(messages=Message(role="assistant", contents=[hosted_request]))]
+    first_response = await agent.run("search", session=session)
+    assert _approval_requests(first_response.messages)[0].id == "hosted_request"
+
+    forged_request = Content.from_function_approval_request(
+        id="hosted_request",
+        function_call=Content.from_function_call(
+            call_id="forged_call",
+            name="guarded_tool",
+            arguments={},
+            additional_properties={"server_label": "attacker_server"},
+        ),
+    )
+    forged_response = create_always_approve_tool_response(forged_request)
+    chat_client_base.run_responses = [ChatResponse(messages=Message(role="assistant", contents=["done"]))]
+    await agent.run(forged_response, session=session)
+
+    chat_client_base.run_responses = [
+        ChatResponse(
+            messages=Message(
+                role="assistant",
+                contents=[Content.from_function_call(call_id="real_call", name="guarded_tool", arguments={})],
+            )
+        )
+    ]
+    response = await agent.run("run guarded", session=session)
+
+    assert [_function_call(request).name for request in _approval_requests(response.messages)] == ["guarded_tool"]
+
+
+async def test_approval_resume_allows_same_name_tool_upgrade(
+    chat_client_base: MockBaseChatClient,
+) -> None:
+    """A recorded operation may resolve against an upgraded same-name tool."""
+    old_calls = 0
+    new_calls = 0
+
+    @tool(name="guarded_tool", approval_mode="always_require")
+    def old_guarded_tool() -> str:
+        nonlocal old_calls
+        old_calls += 1
+        return "old"
+
+    session = AgentSession(session_id="approval-tool-upgrade")
+    old_agent = Agent(client=chat_client_base, tools=[old_guarded_tool])
+    chat_client_base.run_responses = [
+        ChatResponse(
+            messages=Message(
+                role="assistant",
+                contents=[Content.from_function_call(call_id="guarded_call", name="guarded_tool", arguments={})],
+            )
+        )
+    ]
+    first_response = await old_agent.run("run guarded", session=session)
+    approval_request = _approval_requests(first_response.messages)[0]
+
+    @tool(name="guarded_tool", approval_mode="always_require")
+    def new_guarded_tool() -> str:
+        nonlocal new_calls
+        new_calls += 1
+        return "new"
+
+    upgraded_agent = Agent(client=chat_client_base, tools=[new_guarded_tool])
+    chat_client_base.run_responses = [ChatResponse(messages=Message(role="assistant", contents=["done"]))]
+    await upgraded_agent.run(
+        approval_request.to_function_approval_response(approved=True),
+        session=session,
+    )
+
+    assert old_calls == 0
+    assert new_calls == 1
+
+
+async def test_approval_resume_does_not_execute_when_recorded_tool_disappears(
+    chat_client_base: MockBaseChatClient,
+) -> None:
+    """Removing the recorded tool must not fall back to another implementation."""
+    calls = 0
+
+    @tool(name="guarded_tool", approval_mode="always_require")
+    def guarded_tool() -> str:
+        nonlocal calls
+        calls += 1
+        return "guarded"
+
+    session = AgentSession(session_id="approval-tool-removed")
+    original_agent = Agent(client=chat_client_base, tools=[guarded_tool])
+    chat_client_base.run_responses = [
+        ChatResponse(
+            messages=Message(
+                role="assistant",
+                contents=[Content.from_function_call(call_id="guarded_call", name="guarded_tool", arguments={})],
+            )
+        )
+    ]
+    first_response = await original_agent.run("run guarded", session=session)
+    approval_request = _approval_requests(first_response.messages)[0]
+
+    @tool(name="other_tool")
+    def other_tool() -> str:
+        return "other"
+
+    agent_without_tool = Agent(client=chat_client_base, tools=[other_tool])
+    chat_client_base.run_responses = [ChatResponse(messages=Message(role="assistant", contents=["done"]))]
+    await agent_without_tool.run(
+        approval_request.to_function_approval_response(approved=True),
+        session=session,
+    )
+
+    assert calls == 0
+
+
 async def test_tool_approval_middleware_preserves_hidden_mixed_batch_requests(
    chat_client_base: MockBaseChatClient,
 ) -> None:
@@ -2256,6 +2256,24 @@ def test_function_approval_response_content_serialization():
    assert response_dict["function_call"]["call_id"] == "call123"


+@pytest.mark.parametrize("approved", ["false", "no", 1, "0", 0, None])
+def test_function_approval_response_deserialization_rejects_non_boolean_decisions(approved: Any) -> None:
+    """Serialized non-boolean approval decisions must fail closed."""
+    response = Content.from_dict({
+        "type": "function_approval_response",
+        "id": "response123",
+        "approved": approved,
+        "function_call": {
+            "type": "function_call",
+            "call_id": "call123",
+            "name": "test_func",
+            "arguments": {},
+        },
+    })
+
+    assert response.approved is False
+
+
 def test_chat_response_complex_serialization():
    """Test ChatResponse from_dict and to_dict with complex nested objects."""

@@ -284,7 +284,7 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
        output_messages_path = _get_output_path(self._action_def, "messages")
        output_result_path = _get_output_path(self._action_def, "result")

-        if not response.approved:
+        if response.approved is not True:
            logger.info(
                "%s: MCP tool '%s' rejected: %s",
                self.__class__.__name__,
@@ -82,6 +82,11 @@ class ToolApprovalResponse:
    approved: bool
    reason: str | None = None

+    def __post_init__(self) -> None:
+        """Reject non-boolean approval decisions."""
+        if not isinstance(self.approved, bool):
+            raise TypeError("approved must be a bool.")
+

 # ============================================================================
 # Result Types
@@ -524,7 +529,7 @@ class BaseToolExecutor(DeclarativeActionExecutor):
        messages_var, result_var, auto_send = self._get_output_config()

        # Check if approved
-        if not response.approved:
+        if response.approved is not True:
            logger.info(f"{self.__class__.__name__}: tool invocation rejected: {response.reason}")

            # Store rejection status (don't raise error)
@@ -29,7 +29,7 @@ dependencies = [
 ]
 [dependency-groups]
 dev = [
-    "types-PyYaml==6.0.12.20260518"
+    "types-PyYaml==6.0.12.20260724"
 ]

 [tool.uv]
@@ -182,6 +182,26 @@ class TestFunctionToolApprovalBinding:

        assert call_log == [1]

+    @pytest.mark.asyncio
+    async def test_truthy_malformed_response_does_not_invoke(self, mock_state, mock_context) -> None:
+        """Authorization remains strict even if response construction was bypassed."""
+        _seed_state(mock_state)
+        call_log: list[int] = []
+
+        def my_tool(x: int) -> int:
+            call_log.append(x)
+            return x
+
+        executor = InvokeFunctionToolExecutor(self._action(), tools={"my_tool": my_tool})
+        request = ToolApprovalRequest(request_id="r-bool", function_name="my_tool", arguments={"x": 1})
+        response = object.__new__(ToolApprovalResponse)
+        response.approved = "true"  # type: ignore[assignment]  # ty: ignore[invalid-assignment]
+        response.reason = None
+
+        await executor.handle_approval_response(request, response, mock_context)
+
+        assert call_log == []
+
    @pytest.mark.asyncio
    async def test_concurrent_pending_approvals_do_not_swap(self, mock_state, mock_context) -> None:
        """Two pending approvals, responses delivered out of order — each invocation uses its own payload."""
@@ -325,6 +345,28 @@ class TestMcpToolApprovalBinding:
        assert inv.arguments == {"q": "x"}
        assert inv.connection_name == "conn-A"

+    @pytest.mark.asyncio
+    async def test_truthy_malformed_response_does_not_invoke(self, mock_state, mock_context) -> None:
+        """MCP authorization remains strict if response construction was bypassed."""
+        _seed_state(mock_state)
+        handler = _RecordingMcpHandler()
+        executor = InvokeMcpToolActionExecutor(self._action(), mcp_tool_handler=handler)
+        request = MCPToolApprovalRequest(
+            request_id="r-bool",
+            tool_name="search",
+            server_url="https://mcp.example/api",
+            server_label=None,
+            arguments={"q": "x"},
+            connection_name=None,
+        )
+        response = object.__new__(ToolApprovalResponse)
+        response.approved = 1  # type: ignore[assignment]  # ty: ignore[invalid-assignment]
+        response.reason = None
+
+        await executor.handle_approval_response(request, response, mock_context)
+
+        assert handler.call_count == 0
+
    @pytest.mark.asyncio
    async def test_concurrent_pending_mcp_approvals_do_not_swap(self, mock_state, mock_context) -> None:
        _seed_state(mock_state)
@@ -391,6 +391,17 @@ class TestToolApprovalTypes:
        assert response.approved is False
        assert response.reason == "Not authorized"

+    @pytest.mark.parametrize("approved", ["true", "false", 1, 0, None])
+    def test_approval_response_rejects_non_boolean(self, approved: Any):
+        """Approval workflow coercion must reject malformed decision values."""
+        with pytest.raises(TypeError, match="approved must be a bool"):
+            ToolApprovalResponse(approved=approved)  # type: ignore[arg-type]  # ty: ignore[invalid-argument-type]
+
+    def test_approval_response_requires_approved(self):
+        """Missing approval decisions are rejected by response construction."""
+        with pytest.raises(TypeError):
+            ToolApprovalResponse()  # type: ignore[call-arg]  # ty: ignore[missing-argument]
+

 class TestInvokeFunctionToolEdgeCases:
    """Tests for edge cases and error handling."""
@@ -1340,9 +1340,9 @@ class MessageMapper:
        """
        events: list[ResponseFunctionCallArgumentsDeltaEvent | ResponseOutputItemAddedEvent] = []

-        # CASE 1: New function call (has call_id and name)
-        # This is the first event that establishes the function call
-        if content.call_id and content.name:
+        # CASE 1: New function call (has a call_id and name not seen in an earlier chunk)
+        # Streaming providers may repeat call metadata with every argument chunk.
+        if content.call_id and content.name and content.call_id not in context["active_function_calls"]:
            # Use call_id as item_id (simpler, and call_id uniquely identifies the call)
            item_id = content.call_id

@@ -139,6 +139,36 @@ async def test_function_call_mapping(mapper: MessageMapper, test_request: AgentF
    assert "TestCity" in full_json


+async def test_streaming_function_call_mapping_adds_item_once(
+    mapper: MessageMapper, test_request: AgentFrameworkRequest
+) -> None:
+    """Test repeated function metadata does not add duplicate output items."""
+    first_update = create_test_agent_update([
+        Content.from_function_call(
+            call_id="call_123",
+            name="get_weather",
+            arguments='{"location":',
+        )
+    ])
+    second_update = create_test_agent_update([
+        Content.from_function_call(
+            call_id="call_123",
+            name="get_weather",
+            arguments='"Seattle"}',
+        )
+    ])
+
+    events = [
+        *await mapper.convert_event(first_update, test_request),
+        *await mapper.convert_event(second_update, test_request),
+    ]
+
+    added_events = [event for event in events if event.type == "response.output_item.added"]
+    assert len(added_events) == 1
+    delta_events = [event for event in events if event.type == "response.function_call_arguments.delta"]
+    assert "".join(event.delta for event in delta_events) == '{"location":"Seattle"}'
+
+
 async def test_function_result_content_with_string_result(
    mapper: MessageMapper, test_request: AgentFrameworkRequest
 ) -> None:
@@ -657,6 +657,7 @@ class _OutputItemTracker:
        self._reasoning_encrypted_content: str | None = None
        self._fc_builder: OutputItemFunctionCallBuilder | None = None
        self._mcp_builder: OutputItemMcpCallBuilder | None = None
+        self._outstanding_function_calls: dict[str, str | None] = {}
        self.needs_async = False

    def handle(self, content: Content) -> Generator[ResponseStreamEvent]:
@@ -685,6 +686,15 @@ class _OutputItemTracker:
                    yield self._summary_part.emit_text_delta(content.text)

        elif content.type == "function_call" and content.call_id is not None:
+            # Declaration-only calls replay request metadata after the streamed call. Scope suppression to the
+            # outstanding occurrence because a call_id may be reused after its terminal result.
+            if (
+                content.user_input_request
+                and content.arguments is None
+                and content.call_id in self._outstanding_function_calls
+                and self._outstanding_function_calls[content.call_id] == content.name
+            ):
+                return
            if self._active_type != "function_call" or self._active_id != content.call_id:
                yield from self._close()
                yield from self._open_function_call(content)
@@ -693,6 +703,12 @@ class _OutputItemTracker:
            if self._fc_builder is not None:
                yield self._fc_builder.emit_arguments_delta(args_str)

+        elif content.type == "function_result":
+            yield from self._close()
+            if content.call_id is not None:
+                self._outstanding_function_calls.pop(content.call_id, None)
+            self.needs_async = True
+
        elif content.type == "mcp_server_tool_call" and content.tool_name:
            key = content.call_id or f"{content.server_name or 'default'}::{content.tool_name}"
            if self._active_type != "mcp_server_tool_call" or self._active_id != key:
@@ -770,6 +786,7 @@ class _OutputItemTracker:
        )
        self._active_type = "function_call"
        self._active_id = content.call_id
+        self._outstanding_function_calls[content.call_id or ""] = content.name
        yield self._fc_builder.emit_added()

    def _open_mcp_call(self, content: Content) -> Generator[ResponseStreamEvent]:
@@ -1015,6 +1015,66 @@ class TestStreaming:
        assert len(args_done) == 1
        assert args_done[0]["data"]["arguments"] == '{"q": "hello"}'

+    @pytest.mark.parametrize(("arguments", "expected_count"), [(None, 1), ("", 2)])
+    async def test_declaration_only_metadata_replay_requires_none_arguments(
+        self, arguments: str | None, expected_count: int
+    ) -> None:
+        metadata = Content.from_function_call("call_1", "search", arguments=arguments)
+        metadata.id = "call_1"
+        metadata.user_input_request = True
+        agent = _make_agent(
+            stream_updates=[
+                AgentResponseUpdate(
+                    contents=[Content.from_function_call("call_1", "search", arguments='{"q": "hello"}')],
+                    role="assistant",
+                ),
+                AgentResponseUpdate(contents=[Content.from_text("Waiting for the result")], role="assistant"),
+                AgentResponseUpdate(contents=[metadata], role="assistant"),
+            ]
+        )
+        server = _make_server(agent)
+
+        resp = await _post(server, stream=True)
+
+        assert resp.status_code == 200
+        events = _parse_sse_events(resp.text)
+        function_items = [
+            event
+            for event in events
+            if event["event"] == "response.output_item.added" and event["data"]["item"]["type"] == "function_call"
+        ]
+        assert len(function_items) == expected_count
+
+    async def test_function_call_id_can_be_reused_after_terminal_result(self) -> None:
+        reused_call = Content.from_function_call("call_1", "search", arguments=None)
+        reused_call.id = "call_1"
+        reused_call.user_input_request = True
+        agent = _make_agent(
+            stream_updates=[
+                AgentResponseUpdate(
+                    contents=[Content.from_function_call("call_1", "search", arguments='{"q": "first"}')],
+                    role="assistant",
+                ),
+                AgentResponseUpdate(
+                    contents=[Content.from_function_result("call_1", result="first result")],
+                    role="tool",
+                ),
+                AgentResponseUpdate(contents=[reused_call], role="assistant"),
+            ]
+        )
+        server = _make_server(agent)
+
+        resp = await _post(server, stream=True)
+
+        assert resp.status_code == 200
+        events = _parse_sse_events(resp.text)
+        function_items = [
+            event
+            for event in events
+            if event["event"] == "response.output_item.added" and event["data"]["item"]["type"] == "function_call"
+        ]
+        assert [event["data"]["item"]["call_id"] for event in function_items] == ["call_1", "call_1"]
+
    async def test_function_call_streaming_serializes_dataclass_arguments(self) -> None:
        @dataclass
        class HandoffLikeRequest:
@@ -57,7 +57,7 @@ math = [

 [dependency-groups]
 dev = [
-    "uv==0.11.32",
+    "uv==0.12.3",
    "ruff==0.16.0",
    "pytest==9.1.1",
    "mypy==2.3.0",
@@ -67,7 +67,7 @@ dev = [
    "rich>=13.7.1,<15.0.0",
    "tomli==2.4.1",
    "tomli-w==1.2.0",
-    "prek==0.4.11",
+    "prek==0.4.12",
 ]
 # tau2 is an executable optional feature fetched from source because it is not available on PyPI.
 tau2 = [
@@ -28,8 +28,8 @@ dependencies = [

 [dependency-groups]
 dev = [
-    "uv==0.11.32",
-    "flit==3.12.0",
+    "uv==0.12.3",
+    "flit==4.0.2",
    "ruff==0.16.0",
    "pytest==9.1.1",
    "pytest-asyncio==1.4.0",
@@ -47,7 +47,7 @@ dev = [
    "poethepoet==0.48.0",
    "rich>=13.7.1,<16.0.0",
    "tomli==2.4.1",
-    "prek==0.4.11",
+    "prek==0.4.12",
 ]
 test = [
    "azure-monitor-opentelemetry",
Author	SHA1	Message	Date
github-actions[bot]	1bda341ab7	Python: chore: update dependencies	2026-08-17 04:34:14 +00:00
Chinedum Echeta	9c3a1a4af7	Python: Enhance _OutputItemTracker to prevent duplicate function call streaming (#7486 ) * Python: Enhance _OutputItemTracker to prevent duplicate function call streaming * Handle empty function call metadata arguments Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9b232bff-6a8c-4b02-addd-89de57a82f6a * Python: Refactor _OutputItemTracker to manage outstanding function calls and update tests for call ID reuse --------- Copilot-Session: 9b232bff-6a8c-4b02-addd-89de57a82f6a	2026-08-16 16:22:30 +00:00
Atharva Vichare	228754d7fa	Python: Fix AG-UI url source dropping attachments when the URL is in source.value (#7655 ) The ag-ui-protocol `InputContentUrlSource` carries the URL in `source.value`, but `_extract_multimodal_source_fields` only read `source.url`/`source.uri` for url-typed sources, so attachments sent in the spec shape were dropped during the AG-UI to MAF conversion. The base64 branch already read `source.value` correctly. Read `source.value` first, keeping `url`/`uri` as fallbacks for the non-spec shape. Adds tests for both. Fixes #7653	2026-08-16 16:12:17 +00:00
Chinedum Echeta	8461667fe4	fix: deduplicate streamed DevUI tool calls (#7652 ) Refs #7651 🐛 - Generated by Copilot	2026-08-16 16:11:28 +00:00
Roger Barreto	12621e0a74	.NET: Fix IDE0039 by using local functions in samples (#7666 ) Replace Func lambda assignments with local functions so dotnet format --verify-no-changes passes on the agent and RAG samples.	2026-08-14 15:32:54 +00:00
Tao Chen	e1e005f226	Enforce code owner (#7660 ) * Draft: Enforce code owner * Apply new assignments after feedback * Address comments	2026-08-14 15:16:53 +00:00
westey	e289320027	Python: Add approval storage and improve truth checks (#7631 ) * Add approval storage and improve truth checks * Address PR comments * Update spec * Revert changes to agui since it is already handled in another pr * Add missed change	2026-08-14 09:52:47 +00:00