Python: [Bug]: Gemini: `thought_signature` is lost when a tool approval is answered — PR #7095's adjacency mechanism does not cover the approval path (#6963 regression)

[antsok]

Description

Summary

On gemini-3.6-flash, the turn immediately after a tool approval is answered fails:

google.genai.errors.ClientError: 400 Bad Request
"Function call is missing a thought_signature in functionCall parts. This is required for
 tools to work correctly, and missing thought_signature may lead to degraded model performance."

This is the failure of #6963, which was closed by PR #7095. #7095 does fix the general case — a normal multi-round tool loop replays signed calls correctly, verified below. It does not cover the approval path, which is the path #6963 was opened for:

the harness's tool-approval flow reconstructs an approved call as a fresh FunctionCallContent without that part

Filing fresh rather than commenting because #6963 is closed and we cannot reopen it.

Why the mechanism misses this path

PR #7095 carries the signature as base64 protected_data on a text_reasoning content and re-attaches it in GeminiChatClient._convert_message_contents by adjacency — the carrier must immediately precede its call:

if content.type == "text_reasoning":
    pending_signature = None
    ... pending_signature = b64decode(content.protected_data) ...
    continue
thought_signature = pending_signature
pending_signature = None

After an approval is answered, the replayed history has no carrier for the approved call, so pending_signature is None when the call is serialized. A probe inside _convert_message_contents, logging (content.type, bool(content.protected_data), call_id) for each message — same conversation, same call_id:

request before the approval:   [('text_reasoning', SIG), ('function_call', 'rLR9mbWo'), ('text', '')]   -> 200 OK
replay after the approval:     [('function_call', 'rLR9mbWo')]                                          -> 400

There are zero protected_data carriers anywhere in the failing request. The first line is #7095 working exactly as designed; the second is the same call, unsigned.

Scope of what we verified. The probe establishes that the carrier is absent from the replay. We did not isolate whether raw_representation also fails to survive as a types.Part (the mechanism #6963 originally described, which would otherwise let the raw_part.thought_signature branch cover it). Either way adjacency has nothing to correlate, so the outcome is the same, but the reconstruction detail is worth confirming on your side — _replace_approval_contents_with_results rebuilds the call from the function_call nested in the approval content, and whether that nested copy still carries the original Part is the deciding factor for which branch could have saved it.

A second, smaller fragility in the same loop

pending_signature is cleared by any intervening content, so the signature is also lost whenever anything sits between carrier and call — including another text_reasoning that has no protected_data (a thought summary), or an approval control that the loop then discards through case _. Measured on the pinned connector:

contents passed to _convert_message_contents	signature on the emitted functionCall part
carrier, call	present
carrier, approval_response, call	None
carrier, summary_reasoning, call	None
carrier, call, approval_request	present

Whether this fires is therefore ordering luck, which makes the current mechanism awkward to depend on even where a carrier does exist.

Reproduction

End to end: any AG-UI surface on a Gemini 3.x model with one approval-gated tool — send a prompt that triggers the tool, approve the card. The next model call 400s.

The adjacency dependency itself reproduces offline, no network, and is the part worth asserting in a test:

import base64
from agent_framework import Content
from agent_framework_gemini import GeminiChatClient

SIG = b"signature-bytes"
client = object.__new__(GeminiChatClient)

def sig_of(contents):
    parts = client._convert_message_contents(contents, {})
    call = next(p for p in parts if p.function_call is not None)
    return call.thought_signature

carrier = Content.from_text_reasoning(text="thinking", protected_data=base64.b64encode(SIG).decode())
call = Content.from_function_call(call_id="c1", name="search", arguments={})

assert sig_of([carrier, call]) == SIG      # the normal loop: signed
assert sig_of([call]) is None              # the approval replay: unsigned -> 400

Code Sample

Error Messages / Stack Traces

Package Versions

agent-framework-core: 1.12.1, agent-framework-gemini: 1.0.0b260722, agent-framework-ag-ui: 1.0.0

Python Version

No response

Additional Context

Suggested fix

Correlate by call_id instead of position — robust to the carrier being absent, reordered, or separated by another content:

• keep the signature on the function-call content itself, or in a per-request call_id → signature map populated at parse time; and
• on build, backfill only when the part lacks a signature, so this composes with the current adjacency path rather than replacing it.

One pitfall worth flagging, because we walked into it. The obvious implementation captures from the raw types.Part — part.function_call.id — and that is what our own pre-#7095 shim did. It has a hole: _parse_parts (_chat_client.py:1168-1172) generates the id when Gemini omits it,

if function_call.id:
    call_id = function_call.id
else:
    call_id = self._generate_tool_call_id()
    logger.debug("function_call missing id; generated fallback call_id=%r", call_id)

so a raw-part capture is keyed by an id the rest of the framework never sees, and the backfill silently misses every call that took the fallback. Capturing from the parsed contents instead — the carrier and call you have just emitted, where the call_id is already resolved — keys it correctly in both cases. Adjacency is reliable at parse time (both are appended while walking one response's parts); it is only the replay side where it fails.

We have re-shipped this locally against 143386fe and verified it live on gemini-3.6-flash: the backfill fires for each outstanding call and the previously-400ing approval turn now completes. So the direction is known to work, not merely proposed. Our implementation is a GeminiChatClient subclass holding a bounded per-client OrderedDict, populated in _parse_parts and consumed in _convert_message_contents; happy to paste it here if that is useful.

For history: we shipped this once while #6963 was open and retired it when #7095 landed. That was our call and our mistake, but the gap is real either way.

Suggested regression test

Worth passing on, because it is why this slipped past us too: our own retirement guard did exercise a reconstructed call — but handed the converter [carrier, reconstructed], supplying by hand the very carrier the approval path drops. It could therefore only ever prove the adjacency path while reading as coverage of the approval one.

A test that asserts the approval path works needs to build the history the approval flow actually produces, and then assert that it did so. The shape we landed on:

def replay_after_approval(call_id):
    # The history _replace_approval_contents_with_results produces: the call rebuilt from
    # the function_call nested in the approval content, and no carrier anywhere.
    approved = Content.from_function_approval_response(
        True, id=call_id,
        function_call=Content.from_function_call(call_id=call_id, name="search", arguments={}),
    )
    return [approved.function_call]

def test_the_replay_history_contains_no_carrier():
    replay = replay_after_approval("c1")
    assert [c.type for c in replay] == ["function_call"]
    assert not any(c.type == "text_reasoning" and c.protected_data for c in replay)
    assert not isinstance(replay[0].raw_representation, types.Part)

That last test is the one that matters: it fails the moment a future edit starts supplying a carrier or a raw Part, which is the only way the approval-path assertions can silently stop testing anything.

Environment

• agent-framework-core 1.12.1, agent-framework-gemini 1.0.0b260722, agent-framework-ag-ui 1.0.0
• Pinned to main @ 143386fecc1e1c8ab02f1e3ee21b544ed5456d1c
• Model gemini-3.6-flash via the Gemini Developer API; surface: AG-UI + CopilotKit, one approval-gated tool, answered
• First observed on a deployed revision on 2026-07-24, i.e. shortly after we retired our own workaround on the strength of Python: preserve Gemini 3 thought_signature across function-call replays #7095 — not related to any later dependency bump

References

• #6963 — the original report, closed by PR Python: preserve Gemini 3 thought_signature across function-call replays #7095
• PR Python: preserve Gemini 3 thought_signature across function-call replays #7095 — the fix that covers the general case
• Gemini thought-signature docs

[github-actions]

👋 Hi @antsok — thanks for the report! We weren't able to reproduce this against the current codebase, and it looks like it may already be addressed in a more recent release.

• You reported using: agent-framework-gemini 1.0.0b260722

Could you try upgrading to the latest release and let us know if the issue still reproduces? If it does, please reopen this issue or leave a comment with a fresh snippet and stack trace and we'll take another look. 🙏

[antsok]

Re-verified on the latest release, and it still reproduces.

Versions under test: agent-framework-gemini 1.0.0b260730 (the current PyPI release), agent-framework-core 1.13.0, agent-framework-ag-ui 1.0.1, model gemini-3.6-flash via the Gemini Developer API. Installed from microsoft/agent-framework@e39a8a2e79c8c8987a0b9082d3ccb8665734b897, which is the commit that cut those versions.

One thing worth stating before the repro, because it explains why the result was not going to change: python/packages/gemini/agent_framework_gemini/_chat_client.py is byte-identical (sha256 c782dd92c46e1f12…, 56307 bytes) across the commit we filed against (143386fe), current main (e39a8a2e), and the 1.0.0b260730 wheel on PyPI. The only diff to python/packages/gemini between our pin and main is the version bump in pyproject.toml. So the connector we tested was already the code that shipped as the latest release.

What still reproduces

The offline assertions from the report, unchanged on 1.0.0b260730:

sig_of([carrier, call]) = b'signature-bytes'   (normal loop)
sig_of([call])          = None                 (approval replay)

carrier, call                        -> b'signature-bytes'
carrier, approval_response, call     -> None
carrier, summary_reasoning, call     -> None
carrier, call, approval_request      -> b'signature-bytes'

And live, end to end. Here is a self-contained repro on upstream packages only — no app code, no harness of ours. It runs one approval-gated tool, pushes the history through AG-UI's own adapters (what happens to it when a client renders the turn and posts the answer back), and replays it:

"""Issue #7453 on agent-framework-gemini 1.0.0b260730. Needs GEMINI_API_KEY."""

import asyncio
import importlib.metadata as md
import os
import sys

from agent_framework import Agent, Content, Message, tool
from agent_framework_ag_ui._message_adapters import (
    agent_framework_messages_to_agui,
    agui_messages_to_agent_framework,
)
from agent_framework_gemini import GeminiChatClient
from google.genai import types

MODEL = sys.argv[1] if len(sys.argv) > 1 else "gemini-3.6-flash"
PROMPT = "Use the lookup_weather tool for Oslo, then tell me in one sentence what it said."


@tool(approval_mode="always_require")
def lookup_weather(city: str) -> str:
    """Look up the current weather for a city."""
    return f"It is 14 degrees and raining in {city}."


def describe(msg: Message) -> str:
    bits = []
    for c in msg.contents:
        flags = ""
        if getattr(c, "protected_data", None):
            flags += "+protected_data"
        raw = getattr(c, "raw_representation", None)
        if isinstance(raw, types.Part):
            flags += "+rawPart" + ("(signed)" if raw.thought_signature else "")
        bits.append(f"{c.type}{flags}")
    return f"[{msg.role}] {bits}"


async def main() -> None:
    print(
        f"agent-framework-core   {md.version('agent-framework-core')}\n"
        f"agent-framework-gemini {md.version('agent-framework-gemini')}\n"
        f"agent-framework-ag-ui  {md.version('agent-framework-ag-ui')}\n"
        f"model                  {MODEL}\n"
    )
    client = GeminiChatClient(model=MODEL, api_key=os.environ["GEMINI_API_KEY"])
    agent = Agent(client, "You are a terse assistant.", tools=[lookup_weather], name="probe")

    history: list[Message] = [Message(role="user", contents=[Content.from_text(PROMPT)])]
    first = await agent.run(history)
    requests = first.user_input_requests
    print(f"turn 1: {len(requests)} approval request(s)")
    for m in first.messages:
        print(f"  {describe(m)}")
    if not requests:
        print("!! the model did not call the tool; nothing to approve")
        return

    history.extend(first.messages)

    # --- the AG-UI round trip: server -> client -> server -------------------
    wire = agent_framework_messages_to_agui(history)
    print(f"\nAG-UI wire messages: {[w.get('role') for w in wire]}")
    print(f"  reasoning messages on the wire: {sum(w.get('role') == 'reasoning' for w in wire)}")
    rebuilt = agui_messages_to_agent_framework(wire)
    print("history rebuilt from the wire:")
    for m in rebuilt:
        print(f"  {describe(m)}")
    carriers = [
        c for m in rebuilt for c in m.contents if c.type == "text_reasoning" and c.protected_data
    ]
    print(f"  protected_data carriers surviving the round trip: {len(carriers)}")

    answers = [
        Content.from_function_approval_response(True, id=r.id, function_call=r.function_call)
        for r in requests
    ]
    rebuilt.append(Message(role="user", contents=answers))

    print("\n--- turn 2 ---")
    second = await agent.run(rebuilt)
    print(f"turn 2 OK: {second.text[:200]!r}")


asyncio.run(main())

Output — the carrier is on the assistant message going in, gone coming back, and turn 2 400s:

agent-framework-core   1.13.0
agent-framework-gemini 1.0.0b260730
agent-framework-ag-ui  1.0.1
model                  gemini-3.6-flash

turn 1: 1 approval request(s)
  [assistant] ['text_reasoning+protected_data', 'function_call+rawPart(signed)', 'function_approval_request']

AG-UI wire messages: ['user', 'assistant']
  reasoning messages on the wire: 0
history rebuilt from the wire:
  [user] ['text']
  [assistant] ['function_call']
  protected_data carriers surviving the round trip: 0

--- turn 2 ---

Traceback (most recent call last):
  File "repro_7453.py", line 98, in <module>
    asyncio.run(main())
  File "…/asyncio/runners.py", line 195, in run
    return runner.run(main)
  File "…/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
  File "…/asyncio/base_events.py", line 691, in run_until_complete
    return future.result()
  File "repro_7453.py", line 94, in main
    second = await agent.run(rebuilt)
  File "…/agent_framework/observability.py", line 2004, in _run
    response: AgentResponse[Any] = await execute()
  File "…/agent_framework/_agents.py", line 1059, in _run_non_streaming
    response = await self._call_chat_client(ctx, stream=False)
  File "…/agent_framework/_tools.py", line 2930, in _get_response_with_function_invocation
    await super_get_response(
  File "…/agent_framework/observability.py", line 1672, in _get_response
    await super_get_response(
  File "…/agent_framework_gemini/_chat_client.py", line 562, in _get_response
    raw = await self._genai_client.aio.models.generate_content(model=model, contents=contents, config=config)
  File "…/google/genai/models.py", line 8410, in generate_content
    return await self._generate_content(
  File "…/google/genai/models.py", line 6953, in _generate_content
    response = await self._api_client.async_request(
  File "…/google/genai/_api_client.py", line 1651, in async_request
    result = await self._async_request(
  File "…/google/genai/_api_client.py", line 1584, in _async_request
    return await self._async_retry(
  File "…/tenacity/asyncio/__init__.py", line 112, in __call__
    do = await self.iter(retry_state=retry_state)
  File "…/tenacity/__init__.py", line 413, in exc_check
    raise retry_exc.reraise()
  File "…/tenacity/__init__.py", line 184, in reraise
    raise self.last_attempt.result()
  File "…/tenacity/asyncio/__init__.py", line 116, in __call__
    result = await fn(*args, **kwargs)
  File "…/google/genai/_api_client.py", line 1515, in _async_request_once
    await errors.APIError.raise_for_async_response(response)
  File "…/google/genai/errors.py", line 247, in raise_for_async_response
    await cls.raise_error_async(status_code, response_json, response)
  File "…/google/genai/errors.py", line 269, in raise_error_async
    raise ClientError(status_code, response_json, response)
google.genai.errors.ClientError: 400 INVALID_ARGUMENT. {'error': {'code': 400, 'message': 'Function call is missing a thought_signature in functionCall parts. This is required for tools to work correctly, and missing thought_signature may lead to degraded model performance. Additional data, function call `default_api:lookup_weather` , position 2. Please refer to https://ai.google.dev/gemini-api/docs/thought-signatures for more details.', 'status': 'INVALID_ARGUMENT'}}

The same failure shows up through a real surface: on our AG-UI + CopilotKit app on gemini-3.6-flash, approving a single file_access_write card ends the run with 400 … Function call is missing a thought_signature … function call default_api:file_access_write, position 9.

A correction to our own report, and a sharper location for the cause

The original report said the carrier is missing from the replay and named _replace_approval_contents_with_results as the place worth checking. That part was under-specified, and measuring it on these bits shows the loss is not in core:

• _replace_approval_contents_with_results in 1.13.0 preserves both the text_reasoning carrier and the call's types.Part raw_representation when the approval is resolved in-process.
• Serializing the history (Message.to_dict() → Message.from_dict()) drops raw_representation, as expected, but keeps the carrier — so a plain store round-trip is still fine, and the call is still signed.
• The carrier dies in the AG-UI adapters. agent_framework_messages_to_agui emits no reasoning message for history, and agui_messages_to_agent_framework drops them explicitly on the way in:

# agent_framework_ag_ui/_message_adapters.py
if role_str == "reasoning":
    # Reasoning messages are UI-only state carried in MESSAGES_SNAPSHOT.
    # They should not be forwarded to the LLM provider.
    continue

That comment is reasonable for every other provider. For Gemini 3.x it is the failure: _run_common.py does put content.protected_data on the wire as encryptedValue, so the signature reaches the client — it simply cannot come back, and PR #7095's adjacency mechanism has nothing to attach.

This also explains the shape of the bug precisely. Within one run the tool loop never leaves the process, so signed calls replay fine — which is why #7095 tested green. The approval path is the one that goes out to the client and returns mid-turn, and it is the one that 400s.

Control run, same bits: an auto-approved tool call, the same AG-UI round trip, then an ordinary follow-up user question — no 400. The AG-UI round trip drops the carrier there too, but Gemini only demands the signature while the turn that produced the call is still being resolved. So the blast radius is the approval path (and anything else that resumes a turn across the client), not every replay.

The suggested fix still holds on these bits

Our subclass — capture call_id → signature from the parsed contents in _parse_parts, backfill in _convert_message_contents only where the emitted part has no signature — was re-run against 1.0.0b260730 / core 1.13.0 / ag-ui 1.0.1 with the identical AG-UI round trip:

protected_data carriers surviving the round trip: 0
turn 2 OK: 'The weather in Oslo is currently 14 degrees and raining.'

Zero carriers, still signed, turn completes. Correlating by call_id is robust to the carrier being dropped by a surface, which adjacency cannot be.

Given where the loss actually happens, there are two independent places to fix it, and they compose:

1. agent-framework-ag-ui — round-trip the reasoning carrier instead of discarding it inbound (at minimum, keep encryptedValue/protected_data when the target model needs it), and
2. agent-framework-gemini — correlate by call_id so a missing carrier is survivable at all, whatever the surface does.

Two variants of the script above pin down where the loss is not: swapping the AG-UI round trip for a plain Message.to_dict() / from_dict() one makes turn 2 pass, and keeping the AG-UI round trip while dropping the approval (an auto-approved tool, then an ordinary follow-up question) also passes.