Python: Shell tool with support for local and Docker#5664
Merged
chetantoshniwal merged 16 commits intoMay 22, 2026
Conversation
… package Introduces a safe, cross-OS local shell tool as the first citizen of a new agent-framework-tools workspace package. Supports persistent (default) and stateless modes across pwsh/powershell.exe/bash/sh, with policy denylist, allowlist, approval gating, process-tree kill on timeout, output truncation, and audit hooks. Integrates with existing provider get_shell_tool(func=...) factories via FunctionTool kind='shell'. See docs/decisions/0026-builtin-tools-local-shell.md for the full design. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Codifies what LocalShellTool does and does not defend against, and delegates the security-relevant lifecycle primitive to a battle-tested library instead of hand-rolled per-OS code. Changes: - Adopt psutil for cross-OS process-tree termination (executor + session). Replaces hand-rolled taskkill/killpg with one canonical implementation. - Resolve taskkill.exe to absolute %SystemRoot%\System32 path so PATH poisoning cannot redirect us to an attacker-supplied binary. - Reframe ShellPolicy docstring + ADR + README: denylist is a guardrail, not a security boundary. - Require acknowledge_unsafe=True to set approval_mode='never_require', making the unsafe path explicitly opt-in with a self-documenting name. - Add tests/test_security.py codifying named CVE-style cases. Defenses we DO claim are asserted; non-defenses (denylist bypasses via backslash insertion, variable expansion, interpreter escape, base64, alternative tools, PowerShell-native verbs) are documented as expected-to-pass tests so residual risk stays visible. - Add Threat Model + Confidence Strategy sections to ADR 0026. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds a container-backed shell executor as the recommended pattern for untrusted-input shell workflows. The container provides the security boundary (--network none, non-root user, --read-only, --cap-drop ALL, no-new-privileges, memory/pids limits, tmpfs /tmp), so approval gating is optional unlike LocalShellTool. Also introduces a ShellExecutor Protocol so callers can plug in custom backends (Firecracker, SSH, WASI) without forking the framework. Removes the planned HyperlightShellExecutor follow-up from ADR 0026: Hyperlight is a WASM code sandbox with no kernel/userland/shell binary, so a Hyperlight-backed shell is not viable. Docker is the realistic sandbox tier for shell. Tests: 11 unit tests for argv builders + lifecycle (no Docker daemon required); 3 integration tests gated on is_docker_available(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Applies the applicable subset of bug fixes accumulated during the .NET shell-tool PR review (microsoft#5604) to the Python shell tool. A1 - Quote workdir safely in _maybe_reanchor Previously _tool.py used double-quote interpolation when emitting the cd/Set-Location prefix, which expanded $VAR, $(), and backticks in the workdir path. A workdir containing shell metacharacters could trigger arbitrary command execution before the user command ran. Replaced with single-quote escaping helpers _quote_posix and _quote_powershell that emit literal-string forms safe for both hosts. A5/A6 - Consolidate truncation to a single byte-aware helper Extracted a shared truncate_head_tail / truncate_text_head_tail helper in _truncate.py. The new implementation distributes odd caps so head receives floor(cap/2) and tail receives ceil(cap/2) bytes, matching the .NET round-9 fix and ensuring no input bytes are silently dropped on the boundary. _session.py previously truncated by Python str length while the caller passed _max_output_bytes - the unit mismatch is now gone: raw byte buffers go through truncate_head_tail and decoded text goes through truncate_text_head_tail. Unit tests added for the truncate and quote helpers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…tool
The shell tool's docstrings and comments contained two patterns that
the .NET review pushed back on:
- Narrative framing about implementation history ("hard-won",
"we sidestep", "design inspiration: ...", competitor framework
name-drops in module docstrings).
- Overstated security guarantees ("battle-tested",
"reasonable for untrusted input", "recommended executor for any
agent that runs commands from untrusted input",
"destructive commands are blocked", "safe local shell tool",
"blocks shell injection").
Rewrites the affected docstrings and comments to describe what the
code does in neutral terms. Behaviour is unchanged.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ports the .NET ShellEnvironmentProvider as a Python ContextProvider so agents using LocalShellTool or DockerShellTool can be primed with an accurate description of the shell they're talking to (family, version, OS, working directory, and which CLIs are available). The provider runs probes through any ShellExecutor, caches the resulting snapshot, and on every before_run extends the session instructions with a markdown block describing the shell idiom to use. A failed first probe leaves the cache empty so the next call retries (no permanent poisoning). Probe failures from a narrow set of expected error types (ShellCommandError, ShellExecutionError, ShellTimeoutError, and asyncio.TimeoutError from the per-probe timeout) are recorded as None fields in the snapshot. Other exceptions propagate. Tool names are validated against ^[A-Za-z0-9._-]+$ before being interpolated into a probe command. Includes 12 unit tests covering happy path, stderr fallback, timeout handling, expected/unexpected exception paths, malicious tool name rejection, case-insensitive deduplication, retry after failure, concurrent first-callers sharing one probe, and the default and custom formatter paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…anup Add a README section introducing ShellEnvironmentProvider, soften two remaining overconfident security-boundary comments in _executor_base.py and the DockerShellTool class docstring, and add a sample (shell_with_environment_provider.py) that demonstrates the provider in stateless and persistent modes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
changed the title
The repository convention is to host samples under python/samples/ rather than inside the package directory. Move the two net-new shell samples (allow-list and environment-provider) to python/samples/02-agents/tools/ and drop the in-package samples/ directory; the existing top-level providers/openai/client_with_local_shell.py already covers the basic LocalShellTool walkthrough. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new first-party Python workspace package, agent-framework-tools, introducing a cross-platform shell execution surface (LocalShellTool) plus a container-sandboxed variant (DockerShellTool) and a context provider (ShellEnvironmentProvider) to help models emit correct shell idioms and discover available CLIs.
Changes:
- Add
agent-framework-toolspackage (shell tools, policy/denylist, truncation, process-tree kill, persistent session protocol, environment context provider). - Add unit + integration-gated tests and runnable samples for local and Docker-backed shell execution.
- Register the new package in the Python workspace (pyproject + uv lock) and update an existing OpenAI sample to use
LocalShellTool.
Show a summary per file
| File | Description |
|---|---|
| python/uv.lock | Adds agent-framework-tools as a workspace member and locked editable package entry. |
| python/pyproject.toml | Registers agent-framework-tools as a workspace source dependency. |
| python/samples/02-agents/providers/openai/client_with_local_shell.py | Updates sample to use LocalShellTool instead of a hand-rolled subprocess tool. |
| python/packages/tools/README.md | Documents installation, modes, safety model, and tool/provider usage. |
| python/packages/tools/LICENSE | Adds MIT license for the new tools package. |
| python/packages/tools/pyproject.toml | Defines packaging metadata, deps (incl. psutil), and test/lint/tooling config. |
| python/packages/tools/agent_framework_tools/init.py | Adds package root and version discovery. |
| python/packages/tools/agent_framework_tools/py.typed | Marks the package as typed for type checkers. |
| python/packages/tools/agent_framework_tools/shell/init.py | Exposes the public shell-tool API surface. |
| python/packages/tools/agent_framework_tools/shell/_types.py | Introduces shared types and core exceptions for shell execution. |
| python/packages/tools/agent_framework_tools/shell/_truncate.py | Implements head/tail UTF-8 byte-budget truncation helpers. |
| python/packages/tools/agent_framework_tools/shell/_policy.py | Adds allow/deny policy model and default denylist patterns. |
| python/packages/tools/agent_framework_tools/shell/_resolve.py | Implements cross-platform shell argv resolution and PowerShell detection. |
| python/packages/tools/agent_framework_tools/shell/_killtree.py | Adds cross-OS process-tree termination (psutil + fallback). |
| python/packages/tools/agent_framework_tools/shell/_executor.py | Implements stateless execution via subprocess with timeout + truncation. |
| python/packages/tools/agent_framework_tools/shell/_executor_base.py | Defines a minimal ShellExecutor protocol for pluggable backends. |
| python/packages/tools/agent_framework_tools/shell/_session.py | Implements persistent shell session using sentinel framing and reader tasks. |
| python/packages/tools/agent_framework_tools/shell/_tool.py | Adds LocalShellTool facade + agent-framework FunctionTool wiring. |
| python/packages/tools/agent_framework_tools/shell/_environment.py | Adds ShellEnvironmentProvider to probe and inject shell environment guidance. |
| python/packages/tools/agent_framework_tools/shell/_docker.py | Adds DockerShellTool and argv builders for container-sandboxed execution. |
| python/packages/tools/samples/init.py | Adds samples package marker. |
| python/packages/tools/samples/shell_openai_persistent.py | Demonstrates OpenAI usage with an approval loop and persistent local shell. |
| python/packages/tools/samples/shell_allowlist_stateless.py | Demonstrates a strict allowlist + stateless mode configuration. |
| python/packages/tools/samples/shell_with_environment_provider.py | Demonstrates using ShellEnvironmentProvider with stateless vs persistent shells. |
| python/packages/tools/tests/init.py | Adds tests package marker. |
| python/packages/tools/tests/test_shell_truncate_and_quote.py | Tests truncation helpers and quoting helpers. |
| python/packages/tools/tests/test_shell_environment_provider.py | Tests probing, formatting, caching, and concurrency behavior of environment provider. |
| python/packages/tools/tests/test_security.py | Adds security regression tests documenting denylist behavior and residual risk. |
| python/packages/tools/tests/test_policy.py | Tests default policy behavior, allowlist behavior, and custom overrides. |
| python/packages/tools/tests/test_local_shell_tool.py | Tests local shell tool modes, timeouts, policy, persistence, and concurrency. |
| python/packages/tools/tests/test_docker_shell_tool.py | Tests Docker argv builders, basic tool behavior, and docker-availability-gated integration tests. |
Copilot's findings
- Files reviewed: 27/29 changed files
- Comments generated: 6
…_model Two new tests in test_local_shell_tool.py exercise the default confine_workdir=True behaviour on POSIX and PowerShell, asserting that 'cd' inside one persistent-mode call does not leak into the next. A new test_shell_result.py module provides direct unit coverage for every conditional branch of ShellResult.format_for_model (stdout, truncated, stderr, timed_out, exit_code) so regressions in the LLM-facing format are caught immediately. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- _tool.py: detect PowerShell via is_powershell() helper instead of basename string match - _environment.py: use public ContextProvider import (no private _ prefix) - _session.py: trim _stdout_buf/_stderr_buf after copying to avoid unbounded retention across calls - _docker.py: short-circuit start()/close() in stateless mode; add configurable shell kwarg (default bash, e.g. 'sh' for alpine) - tests: parenthesized multi-line assert; alpine integration tests now pass shell='sh' Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Python Test Coverage Report •
Python Unit Test Overview
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- pyupgrade: drop quoted self-class refs in __aenter__/method annotations - ruff format: reflow long lines per workspace style - pyright: assert psutil non-None in optional-import branch; lowercase mutable module globals; annotate _approval_mode as Literal so tool() Literal-typed kwarg is accepted; add ... body to ShellExecutor.run protocol; remove unused deprecated _kill_tree wrapper - tests: skip docker integration tests on win32 (Windows containers don't support --read-only / alpine images) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…t findings Mirrors the .NET PR microsoft#5604 cleanup: - Remove DEFAULT_DENYLIST from ShellPolicy. ShellPolicy() now ships with an empty deny-list; operators opt into site-specific patterns explicitly. No major agent framework uses regex matching as a primary security control; AutoGen v2 removed theirs. Approval gating + sandbox tier remain the real boundaries. - Rewrite module / class docstrings to frame ShellPolicy as a UX pre-filter, not a security control. - Add Single-session ownership paragraphs to ShellExecutor, ShellSession, LocalShellTool, and DockerShellTool: a persistent-mode tool is owned by exactly one conversation / agent session; do not share across users or concurrent conversations. - Tests now supply explicit deny patterns instead of relying on a default. - Address Pre-commit Hooks (bandit) CI failures: convert internal-invariant asserts to explicit RuntimeError, annotate intentional subprocess/shell usage with # nosec, document container-internal /tmp paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 2 | Confidence: 85%
✓ Test Coverage
The PR adds substantial new shell tool functionality with good high-level integration tests for LocalShellTool and DockerShellTool. However, three production modules totaling ~250 lines have zero test coverage:
_killtree.py(security-critical process-tree termination),_resolve.py(shell discovery with env-var override and fallback chain), and_session.py's_parse_rc()helper (exit-code parsing from sentinel output). The_kiltree.pygap is most concerning since timeout enforcement is listed as a security property in the README. Additionally,LocalShellTool's environment-merging logic (env/clean_envparameters) has three distinct branches with no test coverage.
✓ Design Approach
I found two design-level issues. First, the
shell=/AGENT_FRAMEWORK_SHELLoverride path bypasses the interactive-vs-stateless argv shaping, so common overrides likebashorpwshsilently stop working in stateless mode unless callers already know to include-c/-Commandthemselves. Second,ShellEnvironmentProvidercaches its probe result on the provider instance rather than in provider session state, so a shared provider can leak one session's working-directory/tool snapshot into another session even though the surrounding framework passes per-session provider state and the README describes probing once per session. The code paths and tests look internally consistent, but two new samples currently teach a stronger security model than the PR itself documents. The added tests explicitly defineShellPolicyas a best-effort pre-filter rather than a security boundary, yet one sample saysLocalShellToolhas a default destructive-command deny-list and another says an allow-list is sufficient reason to disable approval. Those sample docs should be corrected so users do not rely on protections the package says it does not provide.
Automated review by alliscode's agents
Deny-list documentation drift: - README and the OpenAI/local-shell sample no longer claim a built-in deny-list of destructive commands. ShellPolicy is described as an optional, operator-supplied UX pre-filter; the real boundaries remain approval gating and the sandbox tier. Behavioural fixes called out in review: - ShellPolicy.evaluate() now denies empty / whitespace-only commands explicitly instead of returning allow with no rationale. - truncate_head_tail() raises ValueError for cap <= 0 instead of silently returning the full input with truncated=False, which previously could defeat output-capping in callers that mis-configured the budget. - LocalShellTool.as_function() / DockerShellTool.as_function() return the ShellCommandError text directly so the model sees a single, non-redundant 'Command rejected by policy: …' message instead of the prior duplicated 'Command blocked by policy: Command rejected …' wrapping. - ShellSession POSIX sentinel trailer now snapshots and restores the prior errexit (set -e) state around the trailer, so a user 'set -e' in the persistent shell is no longer permanently disabled by the next run(). Tests: - New test_shell_parse_rc.py covers the full _parse_rc() edge-case surface (zero, positive, negative, CRLF, no newline, missing prefix, empty input, non-digits, trailing garbage, partial digits). - test_policy.py asserts the new empty-command deny. - test_shell_truncate_and_quote.py asserts ValueError for cap=0 and cap<0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
Round-2 review fixes pushed in Deny-list documentation drift (Copilot review on README.md,
Behaviour fixes:
Tests:
bandit / ruff / pytest all clean locally. |
- _resolve.py: in stateless mode, ensure shell overrides end with -c/-Command so commands aren't misinterpreted as script-file paths. - ShellExecutor.run / LocalShellTool.run / DockerShellTool.run now accept an optional imeout kwarg; ShellEnvironmentProvider drops the outer asyncio.wait_for and lets the executor enforce the probe timeout internally, so cancellation no longer risks leaving a hung subprocess or corrupted session. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
moonbox3
reviewed
May 13, 2026
- pyproject.toml: bump agent-framework-core minimum from 1.2.0 to 1.2.2 to align with the rest of the workspace. - _docker.py: validate extra_run_args at construction time and reject flags that would dismantle the isolation defaults (--privileged, --cap-add, --security-opt, --network/--net, -v/--volume/--mount, --device, --pid, --ipc, --userns, --user, --read-only, --tmpfs, --add-host, --gpus, --cgroupns, --device-cgroup-rule); also documented the warning on the docstring. - _docker._stop_container: retry docker rm -f once and log a warning/error when it does not succeed, so operators can audit leaked containers instead of getting a silent success. - _docker._run_stateless timeout path: fall back to docker rm -f when docker kill fails or times out (--rm only reaps on clean exit), and log instead of silently swallowing communicate() errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
moonbox3
approved these changes
May 14, 2026
giles17
approved these changes
May 21, 2026
giles17
added a commit
to giles17/agent-framework
that referenced
this pull request
May 22, 2026
- ag-ui: 1.0.0rc2 -> 1.0.0rc3 - orchestrations: 1.0.0rc1 -> 1.0.0rc2 - Add shell tool (microsoft#5664) to CHANGELOG - uv.lock refreshed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
kriptoburak
pushed a commit
to kriptoburak/agent-framework
that referenced
this pull request
May 22, 2026
* Python: bump package versions for 1.6.0 release - Released cohort (agent-framework, core, openai, foundry): 1.5.0 -> 1.6.0 - Beta packages (21 packages): 1.0.0b260519 -> 1.0.0b260521 - Alpha packages (azure-contentunderstanding, foundry-hosting, gemini, monty): 1.0.0a260518/19 -> 1.0.0a260521 - ag-ui stays at 1.0.0rc2, orchestrations at 1.0.0rc1 (dependency bounds updated) - Inter-package dependency lower bounds updated (>=1.5.0,<2 -> >=1.6.0,<2) - Update CHANGELOG compare links - uv.lock refreshed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review: bump RC packages, add shell tool to changelog - ag-ui: 1.0.0rc2 -> 1.0.0rc3 - orchestrations: 1.0.0rc1 -> 1.0.0rc2 - Add shell tool (microsoft#5664) to CHANGELOG - uv.lock refreshed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced May 22, 2026
Closed
sanaullahmohammed
pushed a commit
to sanaullahmohammed/NexusOps
that referenced
this pull request
May 28, 2026
Updated [Microsoft.Agents.AI](https://github.com/microsoft/agent-framework) from 1.0.0 to 1.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Agents.AI's releases](https://github.com/microsoft/agent-framework/releases)._ ## 1.7.0 ## [1.7.0] - 2026-05-28 ### Added - **agent-framework-core**: Add `HarnessAgent` and background-agents harness provider ([#6041](https://github.com/microsoft/agent-framework/pull/6041), [#6069](https://github.com/microsoft/agent-framework/pull/6069)) - **agent-framework-core**, **agent-framework-a2a**: Add `A2AAgentSession` with referenced task IDs and input-required support ([#5980](https://github.com/microsoft/agent-framework/pull/5980)) - **agent-framework-foundry**: Add experimental prompt-agent conversion and deployment APIs ([#5959](https://github.com/microsoft/agent-framework/pull/5959)) - **agent-framework-declarative**: Add Foundry Toolbox MCP invocation support and sample ([#5933](https://github.com/microsoft/agent-framework/pull/5933)) - **samples**: Add hosting samples overview README ([#5407](https://github.com/microsoft/agent-framework/pull/5407)) ### Changed - **agent-framework-core**: Align TodoProvider tool names with the C# implementation ([#6107](https://github.com/microsoft/agent-framework/pull/6107)) - **agent-framework-core**: Align ModeProvider tool names and instructions ([#6071](https://github.com/microsoft/agent-framework/pull/6071)) - **agent-framework-chatkit**: Raise the `openai-chatkit` dependency floor to `>=1.6.4` to match the current typed API usage. - **agent-framework-declarative**: [BREAKING] Remove Python-only declarative actions and rename alias kinds to C# canonical names ([#6126](https://github.com/microsoft/agent-framework/pull/6126)) - **tests**: Replace deprecated `asyncio.iscoroutinefunction` usage in DevUI cleanup-hook tests ([#4563](https://github.com/microsoft/agent-framework/pull/4563)) ### Fixed - **agent-framework-core**: Point `@experimental` warnings at user code ([#5996](https://github.com/microsoft/agent-framework/pull/5996)) - **agent-framework-declarative**: Fix Foreach body exit wiring ([#6050](https://github.com/microsoft/agent-framework/pull/6050)) - **agent-framework-devui**: Fix streaming memory growth regression ([#6038](https://github.com/microsoft/agent-framework/pull/6038)) - **agent-framework-foundry**: Pass default headers to Foundry agents ([#6040](https://github.com/microsoft/agent-framework/pull/6040)) - **agent-framework-foundry-hosting**: Fix hosted handoff argument serialization ([#5861](https://github.com/microsoft/agent-framework/pull/5861)) - **agent-framework-foundry-hosting**: Allow hosted checkpoints to restore `MessageRole` values ([#6049](https://github.com/microsoft/agent-framework/pull/6049)) - **agent-framework-openai**: Preserve citation `get_url` metadata ([#6037](https://github.com/microsoft/agent-framework/pull/6037)) - **agent-framework-openai**: Guard Chat Completions streaming against null deltas ([#5734](https://github.com/microsoft/agent-framework/pull/5734)) - **agent-framework-openai**: Read response headers defensively for stream wrappers without `.headers` ([#6028](https://github.com/microsoft/agent-framework/pull/6028), [#6029](https://github.com/microsoft/agent-framework/pull/6029)) - **samples**: Fix sequential workflow sample output handling ([#5976](https://github.com/microsoft/agent-framework/pull/5976)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.6.0...python-1.7.0 ## 1.6.1 ## What's Changed * .NET: Add hyperlight to release slnf by @westey-m in https://github.com/microsoft/agent-framework/pull/5695 * .NET: Update FoundryAgent to address HostedAgents strict URL routing by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5677 * .NET: Add IChatMessageInjector for message injection during function loop by @westey-m in https://github.com/microsoft/agent-framework/pull/5679 * .NET: Foundry.Hosting IT - eliminate MSBuild parallel-output races by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5725 * .NET: Hosted-Files sample + AgentSessionFiles SDK companion + integration test by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5698 * .NET: Simplify ClientHeadersScope to rely on AsyncLocal natural restoration by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5676 * .NET: Hosted Agents - RAG Sample with Azure AI Search (#5693) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5701 * .NET: Fix/per service input persistence on stream error by @alliscode in https://github.com/microsoft/agent-framework/pull/5744 * .NET: Remove Foundry Toolbox server-side tools support by @alliscode in https://github.com/microsoft/agent-framework/pull/5753 * .NET: DevUI: add configurable access controls for the DevUI HTTP surface by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5739 * .NET: Add A2A input-request content for human-in-the-loop scenarios by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5743 * .NET fix: Synthesized Handoff FunctionResult is never sent to agent by @lokitoth in https://github.com/microsoft/agent-framework/pull/5718 * .NET: Refactor harness console rendering by @westey-m in https://github.com/microsoft/agent-framework/pull/5751 * .NET: fix: align Anthropic Extensions AI version by @danyalahmed1995 in https://github.com/microsoft/agent-framework/pull/5709 * .NET: declare Magentic protocol messages by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5778 * .NET: Feat/dotnet shell tool by @alliscode in https://github.com/microsoft/agent-framework/pull/5604 * .NET: Fix OpenAIResponsesAgentClient to include agentName in endpoint path by @giles17 in https://github.com/microsoft/agent-framework/pull/5748 * .NET: CI hardening — split Functions tests, re-enable skipped integration tests by @giles17 in https://github.com/microsoft/agent-framework/pull/5717 * .NET: Add harness agent package by @westey-m in https://github.com/microsoft/agent-framework/pull/5782 * .NET: [Breaking Change] Auto-wire ChatClient with OpenTelemetryChatClient in OpenTelemetryAgent by @Copilot in https://github.com/microsoft/agent-framework/pull/5750 * Dotnet: Fixing FoundryToolboxMcp sample to use created toolbox by @alliscode in https://github.com/microsoft/agent-framework/pull/5786 * .NET: fix: avoid mutating handoff message roles by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5808 * .NET: feat(evals): add ground_truth/expected_output support for workflow evaluation by @alliscode in https://github.com/microsoft/agent-framework/pull/5755 * .NET: Update version for release. by @alliscode in https://github.com/microsoft/agent-framework/pull/5789 * .NET: Fix build issue CA1873 in DevUI by using LoggerMessage source generator by @alliscode in https://github.com/microsoft/agent-framework/pull/5831 * [BREAKING] Python: DevUI: tighten default access controls and CORS posture by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5740 * [BREAKING] Python: Align file skill folder discovery with agentskills.io spec by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5807 * .NET: Filestore improvements by @westey-m in https://github.com/microsoft/agent-framework/pull/5842 * .NET: DevUI: quarantine flaky discovery integration test (#5845) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5846 * .NET: Update version to 1.6.1 for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5843 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.5.0...dotnet-1.6.1 ## 1.6.0 ## [1.6.0] - 2026-05-21 ### Added - **agent-framework-core**: Shell tool with support for local and Docker execution ([#5664](https://github.com/microsoft/agent-framework/pull/5664)) - **agent-framework-monty**: New Monty-backed CodeAct provider package ([#5915](https://github.com/microsoft/agent-framework/pull/5915)) - **agent-framework-foundry**: Add experimental hosted tool factories on `FoundryChatClient` ([#5958](https://github.com/microsoft/agent-framework/pull/5958)) - **agent-framework-foundry**: Include tool definitions for Foundry agent evals ([#5974](https://github.com/microsoft/agent-framework/pull/5974)) - **agent-framework-a2a**: Use non-streaming transport and `return_immediately` for background ops ([#5963](https://github.com/microsoft/agent-framework/pull/5963)) ### Changed - **agent-framework-core**, **agent-framework-foundry**: [BREAKING] Enable instrumentation by default ([#5865](https://github.com/microsoft/agent-framework/pull/5865)) - **agent-framework-foundry**: Show more authentication methods in Foundry Toolbox MCP ([#5719](https://github.com/microsoft/agent-framework/pull/5719)) ### Fixed - **agent-framework-core**: Skip MCP prompt loading when unsupported ([#5370](https://github.com/microsoft/agent-framework/pull/5370)) ## 1.5.0 ## What's Changed * .NET: feat: Implement message filtering to exclude non-portable content typ… by @tarockey in https://github.com/microsoft/agent-framework/pull/5410 * .NET: Add allow listing for WebBrowsingTool by @westey-m in https://github.com/microsoft/agent-framework/pull/5605 * .NET: fix: JSON Serialization issue with MultiPartyConversation by @lokitoth in https://github.com/microsoft/agent-framework/pull/5653 * .NET: Improve Todo multithreading and inject todos into message list by @westey-m in https://github.com/microsoft/agent-framework/pull/5655 * .NET: fix: Add missing Workflows "Shared" sources to solution by @lokitoth in https://github.com/microsoft/agent-framework/pull/5656 * .NET: Fix QuestionExecutor looping after GotoAction re-entry in declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5635 * .NET: Fix YAML block scalar parsing for file skills by @tejakusireddy in https://github.com/microsoft/agent-framework/pull/5610 * .NET: Add hosted agent observability sample by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5660 * .NET: Bump MEAI to 10.5.1 and add Foundry per-call x-client header support by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5652 * .NET: Fix flaky declarative test by @peibekwe in https://github.com/microsoft/agent-framework/pull/5669 * .NET: Add Foundry.Hosting.IntegrationTests by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5598 * .NET: Issue 5662 by @alliscode in https://github.com/microsoft/agent-framework/pull/5668 * .NET: Support reasoning events in AGUI by @jeffinsibycoremont in https://github.com/microsoft/agent-framework/pull/4953 * .NET: feat: Update Github Copilot SDK to 1.0.0-beta.2 by @lokitoth in https://github.com/microsoft/agent-framework/pull/5699 * .NET: feat: Implement Magentic Orchestration for .NET by @lokitoth in https://github.com/microsoft/agent-framework/pull/5595 * .NET: Foundry.Hosting IT - avoid MSB3026 in publish step by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5689 * .NET: Python: Add dotnet integration test report to CI by @giles17 in https://github.com/microsoft/agent-framework/pull/5515 * .NET: Non-thread-safe sequence number generation may cause duplicate or out-of-order IDs by @tuanaiseo in https://github.com/microsoft/agent-framework/pull/5320 * .NET: Fix typo: sesionElement -> sessionElement by @XiongHaoTrigger in https://github.com/microsoft/agent-framework/pull/5674 * .NET: Mark Magentic Orchestration Experimental by @lokitoth in https://github.com/microsoft/agent-framework/pull/5704 * .NET: Fix function_call_output.output to be a JSON string on the wire by @alliscode in https://github.com/microsoft/agent-framework/pull/5705 * .NET: Update version for release by @lokitoth in https://github.com/microsoft/agent-framework/pull/5703 ## New Contributors * @tarockey made their first contribution in https://github.com/microsoft/agent-framework/pull/5410 * @tejakusireddy made their first contribution in https://github.com/microsoft/agent-framework/pull/5610 * @jeffinsibycoremont made their first contribution in https://github.com/microsoft/agent-framework/pull/4953 * @tuanaiseo made their first contribution in https://github.com/microsoft/agent-framework/pull/5320 * @XiongHaoTrigger made their first contribution in https://github.com/microsoft/agent-framework/pull/5674 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.4.0...dotnet-1.5.0 ## 1.4.0 ## What's Changed * .NET: Bump OpenTelemetry packages to 1.15.3 by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5478 * .NET: Support returning durable workflow results from HTTP trigger endpoint by @kshyju in https://github.com/microsoft/agent-framework/pull/5321 * .NET: [Breaking] Support string[] arguments for file-based skill scripts by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5475 * .NET: Add HttpRequestAction support to declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5474 * .NET: Add declarative HttpRequestAction sample by @peibekwe in https://github.com/microsoft/agent-framework/pull/5572 * .NET: dotnet: Add hosted-agent User-Agent supplement to outgoing requests by @alliscode in https://github.com/microsoft/agent-framework/pull/5453 * .NET: Add dedicated Foundry.Hosting UnitTest project by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5592 * .NET: Harness Feature branch by @westey-m in https://github.com/microsoft/agent-framework/pull/5310 * .NET: Hosting updates to declarative workflows by @alliscode in https://github.com/microsoft/agent-framework/pull/5589 * docs: enhance README with 1.0 features and improved structure by @chetantoshniwal in https://github.com/microsoft/agent-framework/pull/5534 * .NET: Update version for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5636 * .NET: Add Microsoft.Agents.AI.Hyperlight package for CodeAct integration (.NET) by @eavanvalkenburg in https://github.com/microsoft/agent-framework/pull/5329 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.3.0...dotnet-1.4.0 ## 1.3.0 ## What's Changed * .NET: Add dynamic tool expansion sample by @westey-m in https://github.com/microsoft/agent-framework/pull/5425 * .NET: Update Aspire package to be preview by @westey-m in https://github.com/microsoft/agent-framework/pull/5444 * .NET: Fix off-thread RunStatus race where GetStatusAsync can return Running after ResumeAsync halts by @peibekwe in https://github.com/microsoft/agent-framework/pull/5412 * .NET: Update versions for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5449 * .NET: Add streaming support to A2A agent handler by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5427 * .NET: dotnet: Add server-side Foundry Toolbox support and fix SDK beta.4 br… by @alliscode in https://github.com/microsoft/agent-framework/pull/5450 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.2.0...dotnet-1.3.0 ## 1.2.2 ## [1.2.2] - 2026-04-29 ### Added - **agent-framework-azure-contentunderstanding**: New alpha package — Azure AI Content Understanding context provider that auto-analyzes file attachments (documents, images, audio, video) and injects structured results into the LLM context, with multi-document session state, configurable timeout, output filtering via `AnalysisSection`, and auto-registered `list_documents` / `get_analyzed_document` tools ([#4829](https://github.com/microsoft/agent-framework/pull/4829)) - **agent-framework-foundry-hosting**: Add hosted Durable Workflow support — propagate full conversation history to workflow agents and wire `Workflow.as_agent()` end-to-end via the foundry hosting layer ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) ### Changed - **agent-framework-orchestrations**: [BREAKING] Standardize orchestration terminal outputs as `AgentResponse` so `Workflow.as_agent()` returns the final answer only; aligns sequential-approval (`with_request_info`) and concurrent (`intermediate_outputs=True`) flows on the same output contract ([#5301](https://github.com/microsoft/agent-framework/pull/5301)) - **agent-framework-core**, **agent-framework-declarative**: Preserve `Workflow.run()` shared state across calls so multi-turn `WorkflowAgent` invocations retain context, accept `list[Message]` input in the declarative start executor, and coerce `Enum` values when serializing PowerFx symbols ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) - **dependencies**: Update workspace package dependencies and preserve `mcp[ws]` / `uvicorn[standard]` extras through override-dependencies in `/python` ([#5555](https://github.com/microsoft/agent-framework/pull/5555)) ### Fixed - **agent-framework-core**: Fix observability spans not being correctly nested when using streaming ([#5552](https://github.com/microsoft/agent-framework/pull/5552)) - **agent-framework-openai**: Fix `file_search` citations breaking the assistant-message history roundtrip — skip `hosted_file` content in the assistant role so the Responses API no longer rejects `input_file` ([#5557](https://github.com/microsoft/agent-framework/pull/5557)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.1...python-1.2.2 ## 1.2.1 ## [1.2.1] - 2026-04-28 ### Added - **agent-framework-foundry-hosting**: Add file data type support to hosted-agent Responses, refresh `foundry-hosted-agents` samples, and add response test coverage ([#5485](https://github.com/microsoft/agent-framework/pull/5485)) - **samples**: Add `requirements.txt` and `.env.example` to the `a2a/` hosting sample for pip-based setup ([#5510](https://github.com/microsoft/agent-framework/pull/5510)) ### Changed - **dependencies**: Update `rich` requirement from `<15.0.0,>=13.7.1` to `>=13.7.1,<16.0.0` in `/python` ([#5227](https://github.com/microsoft/agent-framework/pull/5227)) - **dependencies**: Bump `prek` from `0.3.8` to `0.3.9` in `/python` ([#5228](https://github.com/microsoft/agent-framework/pull/5228)) - **dependencies**: Bump `python-multipart` from `0.0.22` to `0.0.26` in `/python` ([#5286](https://github.com/microsoft/agent-framework/pull/5286)) - **dependencies**: Bump `pyasn1` from `0.6.2` to `0.6.3` in `/python` ([#4748](https://github.com/microsoft/agent-framework/pull/4748)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/ag-ui` ([#5461](https://github.com/microsoft/agent-framework/pull/5461)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/devui` ([#5492](https://github.com/microsoft/agent-framework/pull/5492)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/lab` ([#5470](https://github.com/microsoft/agent-framework/pull/5470)) - **dependencies**: Bump `uv` from `0.11.3` to `0.11.6` in `/python/packages/lab` ([#5469](https://github.com/microsoft/agent-framework/pull/5469)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/packages/devui/frontend` ([#5127](https://github.com/microsoft/agent-framework/pull/5127)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5126](https://github.com/microsoft/agent-framework/pull/5126)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/packages/devui/frontend` ([#5484](https://github.com/microsoft/agent-framework/pull/5484)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5491](https://github.com/microsoft/agent-framework/pull/5491)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.12` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5527](https://github.com/microsoft/agent-framework/pull/5527)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/packages/devui/frontend` ([#4921](https://github.com/microsoft/agent-framework/pull/4921)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#4936](https://github.com/microsoft/agent-framework/pull/4936)) ### Fixed - **agent-framework-core**: Prevent `inner_exception` from being lost in `AgentFrameworkException` ([#5167](https://github.com/microsoft/agent-framework/pull/5167)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.0...python-1.2.1 ## 1.2.0 ## Changes: * f2b215a2f6d4767fd37b17dd33195100ea2e498f .NET [WIP] Foundry Hosted Agents Support (#5312) [ #5091, #5287, #5278, #5281, #5316, #5336, #5341, #5367, #5368, #5371, #5374, #5406, #5408 ] * 57fa8ea9022ac9ec39fb5ececb020aa042599c8f Python: Fix OpenAIEmbeddingClient to use AsyncOpenAI for /openai/v1 endpoints (#5137) [ #5068 ] * aa582d021d69dd3b047d7664ced090dcc08b56f2 Python: feat(evals): add ground_truth support for similarity evaluator (#5234) * 8f17067383154e87e3a3c8ae673c7b5f1cf71add .NET: Update .NET package version 1.2.0 (#5364) * 267351b7607595cfcb2d64c739587bc50a476e2f .NET: Expand Workflow Unit Test Coverage (#5390) * adcd2d33f5e32be85ea141fc8cc6fbe590aa0981 .NET: Declarative workflows - Gracefully handle agent scenarios when no response is returned (#5376) * d5777bc546ba48652d85cec6093b445965533a4a fix: Duplicate CallIds cause Handoff Message Filtering to fail (#5359) * b6b191ad9c2ddaaa8a647419135f01a2d3fce73a Python: Add second approval-required tool (set_stop_loss) to concurrent_builder_tool_approval sample (#4875) [ #4874 ] * 2c8036779c20e5fa2feb6304c01e28c594e801a9 Python: Bump versions for a release. Update CHANGELOG (#5385) * ce8b6305d8e7280ac9d22226a17e2e4f0828ef97 Python: Foundry hosted agent V2 (#5379) [ #5177, #5215, #5235, #5261, #5281, #5284, #5298, #5372, #5378 ] <details><summary><b>See More</b></summary> * 07f4c8a8d66d2fba40bdd086f16cc6dca059d054 Python: Expose forwardedProps to agents and tools via session metadata (#5264) [ #5239 ] * 04aaf0c1fe6023a579a334f9d2afe5b79ca497f0 Python: Add support for Foundry Toolboxes (#5346) * 3e54a689fc96d681a072fe7e7cfc445909dac74b Python: Add search tool content for OpenAI responses (#5302) * 60af59ba8b3c871065d0a288f21bfd7f0d6be3c1 .NET: Features/3768-devui-aspire-integration (#3771) * 69894eded89d6e8ebf7bdb75cd0d9da54ade8b21 Python: Flatten hyperlight execute_code output (#5333) * 495e1dad6bf3c62b14929805cfd5f0409c897876 Python: Fix CopilotStudioAgent to reuse conversation ID from existing session (#5299) [ #5285 ] * 5777ed26e62e721375f78c404b8df1dfbc322560 .NET: fix: Add session support for Handoff-hosted Agents (#5280) * 52303a8d07e8f9f2c3f056d969d99a9062c06219 .NET: Add Code Interpreter container file download samples (#5014) [ #3081 ] * c85d24da440ebe5266852f6356aecdadc41379c6 .NET: Fix declarative resume edge predicates to recognize both direct and PortableValue-wrapped forms after checkpoint restore (#5323) * b03cb324d5cc5e91a55b5eb9045b8ead244aaf11 Python: Add Hyperlight CodeAct package and docs (#5185) * dbf935b4e30cf9ae2553cad54f6bc09668f7eb62 .NET: fix: Foundry Agents without description in Handoff (#5311) * ca580a8316a904e947e48aaba8f3c00eb738ae36 .NET: Add error checking to workflow samples (#5175) * 101e07b0610e2a73e0c369be7e81907a44fb243f .NET: Add Handoff sample (#5245) * aee1acbf8baeb9fb3b3f196975aae9e7f7481096 .NET: Foundry Evals integration for .NET (#4914) [ #5269 ] * 91e34358eb4f2643b13537b470d8ea0aeaec7307 Python: Feat: Add finish_reason support to AgentResponse and AgentResponseUpdate (#5211) [ #4622 ] * 90a633967ca60601fc696d335d770f9f05e236e2 Python: Fix Gemini client support for Gemini API and Vertex AI (#5258) * c14beedb3af8bdee168e3a06a245a5b9d8fa5f75 test: Add Handoff composability test (#5208) * 43d98974d3994486a35602467efcffb85839ce66 fix: propagate A2A metadata with namespaced key in additional_properties (#5240) (#5256) * 60da0ffb4803e0db18d3d3bde8e008eb4277882c .NET: Improve local release build perf by only formatting for one build target framework (#5266) * a2044829b13659ac40f7f4112f74efcce15397cc .NET: Update Microsoft.Extensions.AI to 10.5.0 and OpenAI to 2.10.0 and remove unused refs (#5269) * 435c66e9c9f215fdea4b041da35e6ca774b63094 Python: Handle url_citation annotations in `FoundryChatClient` streaming responses (#5071) [ #5029 ] * 52d50be9e06456aa8dc4adb2525b0bbd4f60d4d3 Bump Anthropic SDK to 12.13.0 and Anthropic.Foundry to 0.5.0 (#5279) * d20f9b5f973b0b8f693f530a8e3c0f9d9c99bb94 Add AgentExecutorResponse.with_text() to preserve conversation history through custom executors (#5255) [ #5246 ] * 87a8fa2a9d0ffd3d0b4b31882e70c4f60462bb29 .NET: Fix intermittent checkpoint-restore race in in-process workflow runs (#5134) * 8f7fd9525d1bf24f9606779ba7f8d41b66ce2ff1 Python: Add OpenAI types to default checkpoint encoding allow list (#5297) * 69697065ab78502c5e58a7e6bc90ae14fdc46c20 Python: Add context_providers and description to `workflow.as_agent()` (#4651) * fe4cd3cddc99f157710296dad892bec427cae991 Revert to public MCP server and skip on transient upstream errors (#5296) * 611230cc8ebde031d6c15dbc15d7053ddf56b40c Python: improve misc-integration test robustness (#5295) * f112150cfbc4d514b21b60a81bbe5239b4b2c81f Python: bump misc-integration retry delay to 30s (#5293) * ff05c22c5853a51b83c05b6fdb3b8e982bbf3b31 Python: add experimental file history provider (#5248) * eab7f09d03387a2b393f9785963353c1a09e8b6b Forward provider config to SessionConfig in GitHubCopilotAgent (fixes #5190) (#5195) * 68b93641b6802abd2d00a5191cb16c6074d39fe1 Python: Bump agent-framework-devui to 1.0.0b260414 for release (#5259) * 2b251d904f1cb045ec3b7e13411cac3c1aa1e019 Python: Fix reasoning replay when store=False (#5250) * 485af07b8c21896b7f24a0313b5a226b3bd711f8 Python: Add GeminiChatClient (#4847) ... (truncated) ## 1.1.1 ## [1.1.1] - 2026-04-23 ### Added - **agent-framework-core**: Add `expected_output` ground-truth support to `evaluate_workflow` for similarity evaluators ([#5234](https://github.com/microsoft/agent-framework/pull/5234)) - **agent-framework-ag-ui**, **agent-framework-a2a**: Propagate `thread_id` and `forwarded_props` through AG-UI to A2A `context_id` ([#5383](https://github.com/microsoft/agent-framework/pull/5383)) - **samples**: Add second approval-required tool (`set_stop_loss`) to `concurrent_builder_tool_approval` sample ([#4875](https://github.com/microsoft/agent-framework/pull/4875)) - **agent-framework-core**: Add `SKIP_PARSING` sentinel for `FunctionTool.invoke` to bypass `Content`-wrapping and return raw function results ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Changed - **agent-framework-foundry-hosting**: Correct Development Status classifier from Beta (4) to Alpha (3) to match the package's lifecycle stage ([#5387](https://github.com/microsoft/agent-framework/pull/5387)) - **tests**: Add Python flaky test report workflow ([#5342](https://github.com/microsoft/agent-framework/pull/5342)) - **agent-framework-hyperlight**: Simplify host callback to pass raw Python results via `SKIP_PARSING`, switch `execute_code` input schema to a plain JSON-schema dict, and tighten public API surface ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Fixed - **agent-framework-openai**: Fix OpenAI Responses streaming to propagate `created_at` from the final `response.completed` event ([#5382](https://github.com/microsoft/agent-framework/pull/5382)) - **agent-framework-openai**: Fix `OpenAIEmbeddingClient` to use `AsyncOpenAI` for `/openai/v1` endpoints ([#5137](https://github.com/microsoft/agent-framework/pull/5137)) - **agent-framework-openai**: Exclude null `file_id` from `input_image` payload to prevent schema 400 errors ([#5125](https://github.com/microsoft/agent-framework/pull/5125)) - **agent-framework-foundry**: Reconcile Toolbox hosted-tool payloads with the Responses API ([#5414](https://github.com/microsoft/agent-framework/pull/5414)) - **agent-framework-ag-ui**: Pass client `thread_id` as `session_id` when constructing `AgentSession` ([#5384](https://github.com/microsoft/agent-framework/pull/5384)) - **agent-framework-hyperlight**: Thread-confine `WasmSandbox` interactions via per-entry `ThreadPoolExecutor` to eliminate the PyO3 `unsendable` panic when touched from asyncio worker threads ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.1.0...python-1.1.1 ## 1.1.0 ## Changes: * 3e864cdb4c6031cf93096fa6af4d927b31126d8a .NET: Update version to 1.1.0 (#5204) * 14d2ab3262580a383472b406d97b36cfd86b2787 Standardize file skills terminology on 'directory' (#5205) * e5f7b9c260961916e108ca10780988aeefd51662 .NET: Support reflection for discovery of resources and scripts in class-based skills (#5183) <details><summary><b>See More</b></summary> * 1dd828d25502a1d4b4facff8e278da0668b40d28 CHANGELOG Update with V1.0.0 Release (#5069) * 8348584ac29f91a2c5e5e3db05166add1bb7b2af VerifySamples: Filter projects to net10 only (#5184) * 6d6cb840aec8b85c6bb5e95dc680c8fdd6110394 .NET: Improve resilience of verify-samples by building separately and improving evaluation instructions (#5151) * 79afda1a6c4103baa5ae3a42b3004a9e1d28f892 Samples fixes (#5169) * a7a02c1abd87cdb69637aa6f51b98632b9b980c4 Fix test compat for entity key validation (#5179) * 7010dd7439d1fd8f377ad062c7483edb1da60118 .NET: Support custom types in skill resource and script functions (#5152) * e10d448ae29417f3aa107973ab7f7c2745cf7993 Fix handoff workflow context management and improve AG-UI demo (#5136) * 942cb04ccb5adb3726f292659a7b61b5d67681b6 .NET: Fix compaction chat history duplication bug (#5149) * e224f06e601a8ae16ea78c28f434848f332595a3 .NET: Update models used in dotnet samples to gpt-5.4-mini (#5080) * 826d8db84c25389defa7aa13caa2016689c1b975 .NET: fix: Concurrent Workflow Sample (#5090) * 4134c74060d37db60c600a5b748a4f7bfeb2ae41 Add CreateSessionAsync(conversationId) to FoundryAgent (#5144) [ #5138 ] * 86b49d800e9dc37df9d07f7924c9445ba5b8d2c2 Fix and simplify ComputerUse sample (#5075) * d73c06fa8c1bcb9dc3351d3c80f023d4192765b7 .NET: Align skill folder discovery with spec (#5078) * 746c7da216b9cf8d8affbfe40445fd6bcd3ae291 Revise agent examples in README.md (#5067) * d30103fee6b03e2322dc13d590ef43661692b7c9 .NET: Fix input signal issue during checkpoint restoration (#5085) * 55ae57c0ed403c10fc3520505198ca32e71e76d8 .NET: Add Message Delivery Callback Overloads to Executor (#5081) * d284d96a9ed6cbe9220837e139ccb7202e5b5659 fix: 04_MultiModelService sample (#5074) * d1a81159de1b51113c7a0357fdde14aebf1afb79 Bump Anthropic from 12.8.0 to 12.11.0 (#5055) * 9f0dbe5f8dc0c22861e761a26c4c6ed6e2436581 .NET: Improve workflow unit test coverage (#5072) * 3fc1d000265e0db1f434fa5617d6e641b58c61a7 .NET: skill as class (#5027) * e4defadc799cea13efa912e7ee21ce833a5a5c92 .NET: Add github actions workflow for verify-samples (#5034) This list of changes was [auto generated](https://msdata.visualstudio.com/Vienna/_build/results?buildId=214703013&view=logs).</details> ## 1.0.1 ## 1.0.1 - 2026-04-09 > [!IMPORTANT] > **Security hardening for `FileCheckpointStorage`:** Checkpoint deserialization now flows through a restricted unpickler by default, which only permits a built-in set of safe Python types and all `agent_framework` framework types. If your application stores custom types in checkpoints, pass their `"module:qualname"` identifiers via the new `allowed_checkpoint_types` constructor parameter — otherwise loads will raise `WorkflowCheckpointException`. See [Security Considerations](https://learn.microsoft.com/en-us/agent-framework/workflows/checkpoints?pivots=programming-language-python#security-considerations) for details and the opt-in format. ### Added - **samples**: Add sample documentation for two separate Neo4j context providers for retrieval and memory ([#4010](https://github.com/microsoft/agent-framework/pull/4010)) - **agent-framework-azure-cosmos**: Add Cosmos DB NoSQL checkpoint storage for Python workflows ([#4916](https://github.com/microsoft/agent-framework/pull/4916)) ### Changed - **docs**: Remove pre-release flag from agent-framework installation instructions ([#5082](https://github.com/microsoft/agent-framework/pull/5082)) - **samples**: Revise agent examples in `README.md` ([#5067](https://github.com/microsoft/agent-framework/pull/5067)) - **repo**: Update `CHANGELOG` with v1.0.0 release ([#5069](https://github.com/microsoft/agent-framework/pull/5069)) - **agent-framework-core**: [BREAKING] Fix handoff workflow context management and improve AG-UI demo ([#5136](https://github.com/microsoft/agent-framework/pull/5136)) - **agent-framework-core**: Restrict persisted checkpoint deserialization by default ([#4941](https://github.com/microsoft/agent-framework/pull/4941)) - **samples**: Bump `vite` from 7.3.1 to 7.3.2 in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5132](https://github.com/microsoft/agent-framework/pull/5132)) - **python**: Bump `cryptography` from 46.0.6 to 46.0.7 ([#5176](https://github.com/microsoft/agent-framework/pull/5176)) - **python**: Bump `mcp` from 1.26.0 to 1.27.0 ([#5117](https://github.com/microsoft/agent-framework/pull/5117)) - **python**: Bump `mcp[ws]` from 1.26.0 to 1.27.0 ([#5119](https://github.com/microsoft/agent-framework/pull/5119)) ### Fixed - **agent-framework-core**: Raise clear handler registration error for unresolved `TypeVar` annotations ([#4944](https://github.com/microsoft/agent-framework/pull/4944)) - **agent-framework-openai**: Fix `response_format` crash on background polling with empty text ([#5146](https://github.com/microsoft/agent-framework/pull/5146)) - **agent-framework-foundry**: Strip tools from `FoundryAgent` request when `agent_reference` is present ([#5101](https://github.com/microsoft/agent-framework/pull/5101)) - **agent-framework-core**: Fix test compatibility for entity key validation ([#5179](https://github.com/microsoft/agent-framework/pull/5179)) - **agent-framework-openai**: Stop emitting duplicate reasoning content from `response.reasoning_text.done` and `response.reasoning_summary_text.done` events ([#5162](https://github.com/microsoft/agent-framework/pull/5162)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.0.0...python-1.0.1 Commits viewable in [compare view](https://github.com/microsoft/agent-framework/commits). </details> Updated [Microsoft.Agents.AI.OpenAI](https://github.com/microsoft/agent-framework) from 1.0.0 to 1.8.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Agents.AI.OpenAI's releases](https://github.com/microsoft/agent-framework/releases)._ ## 1.7.0 ## [1.7.0] - 2026-05-28 ### Added - **agent-framework-core**: Add `HarnessAgent` and background-agents harness provider ([#6041](https://github.com/microsoft/agent-framework/pull/6041), [#6069](https://github.com/microsoft/agent-framework/pull/6069)) - **agent-framework-core**, **agent-framework-a2a**: Add `A2AAgentSession` with referenced task IDs and input-required support ([#5980](https://github.com/microsoft/agent-framework/pull/5980)) - **agent-framework-foundry**: Add experimental prompt-agent conversion and deployment APIs ([#5959](https://github.com/microsoft/agent-framework/pull/5959)) - **agent-framework-declarative**: Add Foundry Toolbox MCP invocation support and sample ([#5933](https://github.com/microsoft/agent-framework/pull/5933)) - **samples**: Add hosting samples overview README ([#5407](https://github.com/microsoft/agent-framework/pull/5407)) ### Changed - **agent-framework-core**: Align TodoProvider tool names with the C# implementation ([#6107](https://github.com/microsoft/agent-framework/pull/6107)) - **agent-framework-core**: Align ModeProvider tool names and instructions ([#6071](https://github.com/microsoft/agent-framework/pull/6071)) - **agent-framework-chatkit**: Raise the `openai-chatkit` dependency floor to `>=1.6.4` to match the current typed API usage. - **agent-framework-declarative**: [BREAKING] Remove Python-only declarative actions and rename alias kinds to C# canonical names ([#6126](https://github.com/microsoft/agent-framework/pull/6126)) - **tests**: Replace deprecated `asyncio.iscoroutinefunction` usage in DevUI cleanup-hook tests ([#4563](https://github.com/microsoft/agent-framework/pull/4563)) ### Fixed - **agent-framework-core**: Point `@experimental` warnings at user code ([#5996](https://github.com/microsoft/agent-framework/pull/5996)) - **agent-framework-declarative**: Fix Foreach body exit wiring ([#6050](https://github.com/microsoft/agent-framework/pull/6050)) - **agent-framework-devui**: Fix streaming memory growth regression ([#6038](https://github.com/microsoft/agent-framework/pull/6038)) - **agent-framework-foundry**: Pass default headers to Foundry agents ([#6040](https://github.com/microsoft/agent-framework/pull/6040)) - **agent-framework-foundry-hosting**: Fix hosted handoff argument serialization ([#5861](https://github.com/microsoft/agent-framework/pull/5861)) - **agent-framework-foundry-hosting**: Allow hosted checkpoints to restore `MessageRole` values ([#6049](https://github.com/microsoft/agent-framework/pull/6049)) - **agent-framework-openai**: Preserve citation `get_url` metadata ([#6037](https://github.com/microsoft/agent-framework/pull/6037)) - **agent-framework-openai**: Guard Chat Completions streaming against null deltas ([#5734](https://github.com/microsoft/agent-framework/pull/5734)) - **agent-framework-openai**: Read response headers defensively for stream wrappers without `.headers` ([#6028](https://github.com/microsoft/agent-framework/pull/6028), [#6029](https://github.com/microsoft/agent-framework/pull/6029)) - **samples**: Fix sequential workflow sample output handling ([#5976](https://github.com/microsoft/agent-framework/pull/5976)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.6.0...python-1.7.0 ## 1.6.1 ## What's Changed * .NET: Add hyperlight to release slnf by @westey-m in https://github.com/microsoft/agent-framework/pull/5695 * .NET: Update FoundryAgent to address HostedAgents strict URL routing by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5677 * .NET: Add IChatMessageInjector for message injection during function loop by @westey-m in https://github.com/microsoft/agent-framework/pull/5679 * .NET: Foundry.Hosting IT - eliminate MSBuild parallel-output races by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5725 * .NET: Hosted-Files sample + AgentSessionFiles SDK companion + integration test by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5698 * .NET: Simplify ClientHeadersScope to rely on AsyncLocal natural restoration by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5676 * .NET: Hosted Agents - RAG Sample with Azure AI Search (#5693) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5701 * .NET: Fix/per service input persistence on stream error by @alliscode in https://github.com/microsoft/agent-framework/pull/5744 * .NET: Remove Foundry Toolbox server-side tools support by @alliscode in https://github.com/microsoft/agent-framework/pull/5753 * .NET: DevUI: add configurable access controls for the DevUI HTTP surface by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5739 * .NET: Add A2A input-request content for human-in-the-loop scenarios by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5743 * .NET fix: Synthesized Handoff FunctionResult is never sent to agent by @lokitoth in https://github.com/microsoft/agent-framework/pull/5718 * .NET: Refactor harness console rendering by @westey-m in https://github.com/microsoft/agent-framework/pull/5751 * .NET: fix: align Anthropic Extensions AI version by @danyalahmed1995 in https://github.com/microsoft/agent-framework/pull/5709 * .NET: declare Magentic protocol messages by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5778 * .NET: Feat/dotnet shell tool by @alliscode in https://github.com/microsoft/agent-framework/pull/5604 * .NET: Fix OpenAIResponsesAgentClient to include agentName in endpoint path by @giles17 in https://github.com/microsoft/agent-framework/pull/5748 * .NET: CI hardening — split Functions tests, re-enable skipped integration tests by @giles17 in https://github.com/microsoft/agent-framework/pull/5717 * .NET: Add harness agent package by @westey-m in https://github.com/microsoft/agent-framework/pull/5782 * .NET: [Breaking Change] Auto-wire ChatClient with OpenTelemetryChatClient in OpenTelemetryAgent by @Copilot in https://github.com/microsoft/agent-framework/pull/5750 * Dotnet: Fixing FoundryToolboxMcp sample to use created toolbox by @alliscode in https://github.com/microsoft/agent-framework/pull/5786 * .NET: fix: avoid mutating handoff message roles by @he-yufeng in https://github.com/microsoft/agent-framework/pull/5808 * .NET: feat(evals): add ground_truth/expected_output support for workflow evaluation by @alliscode in https://github.com/microsoft/agent-framework/pull/5755 * .NET: Update version for release. by @alliscode in https://github.com/microsoft/agent-framework/pull/5789 * .NET: Fix build issue CA1873 in DevUI by using LoggerMessage source generator by @alliscode in https://github.com/microsoft/agent-framework/pull/5831 * [BREAKING] Python: DevUI: tighten default access controls and CORS posture by @moonbox3 in https://github.com/microsoft/agent-framework/pull/5740 * [BREAKING] Python: Align file skill folder discovery with agentskills.io spec by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5807 * .NET: Filestore improvements by @westey-m in https://github.com/microsoft/agent-framework/pull/5842 * .NET: DevUI: quarantine flaky discovery integration test (#5845) by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5846 * .NET: Update version to 1.6.1 for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5843 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.5.0...dotnet-1.6.1 ## 1.6.0 ## [1.6.0] - 2026-05-21 ### Added - **agent-framework-core**: Shell tool with support for local and Docker execution ([#5664](https://github.com/microsoft/agent-framework/pull/5664)) - **agent-framework-monty**: New Monty-backed CodeAct provider package ([#5915](https://github.com/microsoft/agent-framework/pull/5915)) - **agent-framework-foundry**: Add experimental hosted tool factories on `FoundryChatClient` ([#5958](https://github.com/microsoft/agent-framework/pull/5958)) - **agent-framework-foundry**: Include tool definitions for Foundry agent evals ([#5974](https://github.com/microsoft/agent-framework/pull/5974)) - **agent-framework-a2a**: Use non-streaming transport and `return_immediately` for background ops ([#5963](https://github.com/microsoft/agent-framework/pull/5963)) ### Changed - **agent-framework-core**, **agent-framework-foundry**: [BREAKING] Enable instrumentation by default ([#5865](https://github.com/microsoft/agent-framework/pull/5865)) - **agent-framework-foundry**: Show more authentication methods in Foundry Toolbox MCP ([#5719](https://github.com/microsoft/agent-framework/pull/5719)) ### Fixed - **agent-framework-core**: Skip MCP prompt loading when unsupported ([#5370](https://github.com/microsoft/agent-framework/pull/5370)) ## 1.5.0 ## What's Changed * .NET: feat: Implement message filtering to exclude non-portable content typ… by @tarockey in https://github.com/microsoft/agent-framework/pull/5410 * .NET: Add allow listing for WebBrowsingTool by @westey-m in https://github.com/microsoft/agent-framework/pull/5605 * .NET: fix: JSON Serialization issue with MultiPartyConversation by @lokitoth in https://github.com/microsoft/agent-framework/pull/5653 * .NET: Improve Todo multithreading and inject todos into message list by @westey-m in https://github.com/microsoft/agent-framework/pull/5655 * .NET: fix: Add missing Workflows "Shared" sources to solution by @lokitoth in https://github.com/microsoft/agent-framework/pull/5656 * .NET: Fix QuestionExecutor looping after GotoAction re-entry in declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5635 * .NET: Fix YAML block scalar parsing for file skills by @tejakusireddy in https://github.com/microsoft/agent-framework/pull/5610 * .NET: Add hosted agent observability sample by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5660 * .NET: Bump MEAI to 10.5.1 and add Foundry per-call x-client header support by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5652 * .NET: Fix flaky declarative test by @peibekwe in https://github.com/microsoft/agent-framework/pull/5669 * .NET: Add Foundry.Hosting.IntegrationTests by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5598 * .NET: Issue 5662 by @alliscode in https://github.com/microsoft/agent-framework/pull/5668 * .NET: Support reasoning events in AGUI by @jeffinsibycoremont in https://github.com/microsoft/agent-framework/pull/4953 * .NET: feat: Update Github Copilot SDK to 1.0.0-beta.2 by @lokitoth in https://github.com/microsoft/agent-framework/pull/5699 * .NET: feat: Implement Magentic Orchestration for .NET by @lokitoth in https://github.com/microsoft/agent-framework/pull/5595 * .NET: Foundry.Hosting IT - avoid MSB3026 in publish step by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5689 * .NET: Python: Add dotnet integration test report to CI by @giles17 in https://github.com/microsoft/agent-framework/pull/5515 * .NET: Non-thread-safe sequence number generation may cause duplicate or out-of-order IDs by @tuanaiseo in https://github.com/microsoft/agent-framework/pull/5320 * .NET: Fix typo: sesionElement -> sessionElement by @XiongHaoTrigger in https://github.com/microsoft/agent-framework/pull/5674 * .NET: Mark Magentic Orchestration Experimental by @lokitoth in https://github.com/microsoft/agent-framework/pull/5704 * .NET: Fix function_call_output.output to be a JSON string on the wire by @alliscode in https://github.com/microsoft/agent-framework/pull/5705 * .NET: Update version for release by @lokitoth in https://github.com/microsoft/agent-framework/pull/5703 ## New Contributors * @tarockey made their first contribution in https://github.com/microsoft/agent-framework/pull/5410 * @tejakusireddy made their first contribution in https://github.com/microsoft/agent-framework/pull/5610 * @jeffinsibycoremont made their first contribution in https://github.com/microsoft/agent-framework/pull/4953 * @tuanaiseo made their first contribution in https://github.com/microsoft/agent-framework/pull/5320 * @XiongHaoTrigger made their first contribution in https://github.com/microsoft/agent-framework/pull/5674 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.4.0...dotnet-1.5.0 ## 1.4.0 ## What's Changed * .NET: Bump OpenTelemetry packages to 1.15.3 by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5478 * .NET: Support returning durable workflow results from HTTP trigger endpoint by @kshyju in https://github.com/microsoft/agent-framework/pull/5321 * .NET: [Breaking] Support string[] arguments for file-based skill scripts by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5475 * .NET: Add HttpRequestAction support to declarative workflows by @peibekwe in https://github.com/microsoft/agent-framework/pull/5474 * .NET: Add declarative HttpRequestAction sample by @peibekwe in https://github.com/microsoft/agent-framework/pull/5572 * .NET: dotnet: Add hosted-agent User-Agent supplement to outgoing requests by @alliscode in https://github.com/microsoft/agent-framework/pull/5453 * .NET: Add dedicated Foundry.Hosting UnitTest project by @rogerbarreto in https://github.com/microsoft/agent-framework/pull/5592 * .NET: Harness Feature branch by @westey-m in https://github.com/microsoft/agent-framework/pull/5310 * .NET: Hosting updates to declarative workflows by @alliscode in https://github.com/microsoft/agent-framework/pull/5589 * docs: enhance README with 1.0 features and improved structure by @chetantoshniwal in https://github.com/microsoft/agent-framework/pull/5534 * .NET: Update version for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5636 * .NET: Add Microsoft.Agents.AI.Hyperlight package for CodeAct integration (.NET) by @eavanvalkenburg in https://github.com/microsoft/agent-framework/pull/5329 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.3.0...dotnet-1.4.0 ## 1.3.0 ## What's Changed * .NET: Add dynamic tool expansion sample by @westey-m in https://github.com/microsoft/agent-framework/pull/5425 * .NET: Update Aspire package to be preview by @westey-m in https://github.com/microsoft/agent-framework/pull/5444 * .NET: Fix off-thread RunStatus race where GetStatusAsync can return Running after ResumeAsync halts by @peibekwe in https://github.com/microsoft/agent-framework/pull/5412 * .NET: Update versions for release by @westey-m in https://github.com/microsoft/agent-framework/pull/5449 * .NET: Add streaming support to A2A agent handler by @SergeyMenshykh in https://github.com/microsoft/agent-framework/pull/5427 * .NET: dotnet: Add server-side Foundry Toolbox support and fix SDK beta.4 br… by @alliscode in https://github.com/microsoft/agent-framework/pull/5450 **Full Changelog**: https://github.com/microsoft/agent-framework/compare/dotnet-1.2.0...dotnet-1.3.0 ## 1.2.2 ## [1.2.2] - 2026-04-29 ### Added - **agent-framework-azure-contentunderstanding**: New alpha package — Azure AI Content Understanding context provider that auto-analyzes file attachments (documents, images, audio, video) and injects structured results into the LLM context, with multi-document session state, configurable timeout, output filtering via `AnalysisSection`, and auto-registered `list_documents` / `get_analyzed_document` tools ([#4829](https://github.com/microsoft/agent-framework/pull/4829)) - **agent-framework-foundry-hosting**: Add hosted Durable Workflow support — propagate full conversation history to workflow agents and wire `Workflow.as_agent()` end-to-end via the foundry hosting layer ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) ### Changed - **agent-framework-orchestrations**: [BREAKING] Standardize orchestration terminal outputs as `AgentResponse` so `Workflow.as_agent()` returns the final answer only; aligns sequential-approval (`with_request_info`) and concurrent (`intermediate_outputs=True`) flows on the same output contract ([#5301](https://github.com/microsoft/agent-framework/pull/5301)) - **agent-framework-core**, **agent-framework-declarative**: Preserve `Workflow.run()` shared state across calls so multi-turn `WorkflowAgent` invocations retain context, accept `list[Message]` input in the declarative start executor, and coerce `Enum` values when serializing PowerFx symbols ([#5531](https://github.com/microsoft/agent-framework/pull/5531)) - **dependencies**: Update workspace package dependencies and preserve `mcp[ws]` / `uvicorn[standard]` extras through override-dependencies in `/python` ([#5555](https://github.com/microsoft/agent-framework/pull/5555)) ### Fixed - **agent-framework-core**: Fix observability spans not being correctly nested when using streaming ([#5552](https://github.com/microsoft/agent-framework/pull/5552)) - **agent-framework-openai**: Fix `file_search` citations breaking the assistant-message history roundtrip — skip `hosted_file` content in the assistant role so the Responses API no longer rejects `input_file` ([#5557](https://github.com/microsoft/agent-framework/pull/5557)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.1...python-1.2.2 ## 1.2.1 ## [1.2.1] - 2026-04-28 ### Added - **agent-framework-foundry-hosting**: Add file data type support to hosted-agent Responses, refresh `foundry-hosted-agents` samples, and add response test coverage ([#5485](https://github.com/microsoft/agent-framework/pull/5485)) - **samples**: Add `requirements.txt` and `.env.example` to the `a2a/` hosting sample for pip-based setup ([#5510](https://github.com/microsoft/agent-framework/pull/5510)) ### Changed - **dependencies**: Update `rich` requirement from `<15.0.0,>=13.7.1` to `>=13.7.1,<16.0.0` in `/python` ([#5227](https://github.com/microsoft/agent-framework/pull/5227)) - **dependencies**: Bump `prek` from `0.3.8` to `0.3.9` in `/python` ([#5228](https://github.com/microsoft/agent-framework/pull/5228)) - **dependencies**: Bump `python-multipart` from `0.0.22` to `0.0.26` in `/python` ([#5286](https://github.com/microsoft/agent-framework/pull/5286)) - **dependencies**: Bump `pyasn1` from `0.6.2` to `0.6.3` in `/python` ([#4748](https://github.com/microsoft/agent-framework/pull/4748)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/ag-ui` ([#5461](https://github.com/microsoft/agent-framework/pull/5461)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/devui` ([#5492](https://github.com/microsoft/agent-framework/pull/5492)) - **dependencies**: Bump `pytest` from `9.0.2` to `9.0.3` in `/python/packages/lab` ([#5470](https://github.com/microsoft/agent-framework/pull/5470)) - **dependencies**: Bump `uv` from `0.11.3` to `0.11.6` in `/python/packages/lab` ([#5469](https://github.com/microsoft/agent-framework/pull/5469)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/packages/devui/frontend` ([#5127](https://github.com/microsoft/agent-framework/pull/5127)) - **dependencies**: Bump `vite` from `7.1.12` to `7.3.2` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5126](https://github.com/microsoft/agent-framework/pull/5126)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/packages/devui/frontend` ([#5484](https://github.com/microsoft/agent-framework/pull/5484)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.10` in `/python/samples/05-end-to-end/chatkit-integration/frontend` ([#5491](https://github.com/microsoft/agent-framework/pull/5491)) - **dependencies**: Bump `postcss` from `8.5.6` to `8.5.12` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#5527](https://github.com/microsoft/agent-framework/pull/5527)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/packages/devui/frontend` ([#4921](https://github.com/microsoft/agent-framework/pull/4921)) - **dependencies**: Bump `picomatch` from `4.0.3` to `4.0.4` in `/python/samples/05-end-to-end/ag_ui_workflow_handoff/frontend` ([#4936](https://github.com/microsoft/agent-framework/pull/4936)) ### Fixed - **agent-framework-core**: Prevent `inner_exception` from being lost in `AgentFrameworkException` ([#5167](https://github.com/microsoft/agent-framework/pull/5167)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.2.0...python-1.2.1 ## 1.2.0 ## Changes: * f2b215a2f6d4767fd37b17dd33195100ea2e498f .NET [WIP] Foundry Hosted Agents Support (#5312) [ #5091, #5287, #5278, #5281, #5316, #5336, #5341, #5367, #5368, #5371, #5374, #5406, #5408 ] * 57fa8ea9022ac9ec39fb5ececb020aa042599c8f Python: Fix OpenAIEmbeddingClient to use AsyncOpenAI for /openai/v1 endpoints (#5137) [ #5068 ] * aa582d021d69dd3b047d7664ced090dcc08b56f2 Python: feat(evals): add ground_truth support for similarity evaluator (#5234) * 8f17067383154e87e3a3c8ae673c7b5f1cf71add .NET: Update .NET package version 1.2.0 (#5364) * 267351b7607595cfcb2d64c739587bc50a476e2f .NET: Expand Workflow Unit Test Coverage (#5390) * adcd2d33f5e32be85ea141fc8cc6fbe590aa0981 .NET: Declarative workflows - Gracefully handle agent scenarios when no response is returned (#5376) * d5777bc546ba48652d85cec6093b445965533a4a fix: Duplicate CallIds cause Handoff Message Filtering to fail (#5359) * b6b191ad9c2ddaaa8a647419135f01a2d3fce73a Python: Add second approval-required tool (set_stop_loss) to concurrent_builder_tool_approval sample (#4875) [ #4874 ] * 2c8036779c20e5fa2feb6304c01e28c594e801a9 Python: Bump versions for a release. Update CHANGELOG (#5385) * ce8b6305d8e7280ac9d22226a17e2e4f0828ef97 Python: Foundry hosted agent V2 (#5379) [ #5177, #5215, #5235, #5261, #5281, #5284, #5298, #5372, #5378 ] <details><summary><b>See More</b></summary> * 07f4c8a8d66d2fba40bdd086f16cc6dca059d054 Python: Expose forwardedProps to agents and tools via session metadata (#5264) [ #5239 ] * 04aaf0c1fe6023a579a334f9d2afe5b79ca497f0 Python: Add support for Foundry Toolboxes (#5346) * 3e54a689fc96d681a072fe7e7cfc445909dac74b Python: Add search tool content for OpenAI responses (#5302) * 60af59ba8b3c871065d0a288f21bfd7f0d6be3c1 .NET: Features/3768-devui-aspire-integration (#3771) * 69894eded89d6e8ebf7bdb75cd0d9da54ade8b21 Python: Flatten hyperlight execute_code output (#5333) * 495e1dad6bf3c62b14929805cfd5f0409c897876 Python: Fix CopilotStudioAgent to reuse conversation ID from existing session (#5299) [ #5285 ] * 5777ed26e62e721375f78c404b8df1dfbc322560 .NET: fix: Add session support for Handoff-hosted Agents (#5280) * 52303a8d07e8f9f2c3f056d969d99a9062c06219 .NET: Add Code Interpreter container file download samples (#5014) [ #3081 ] * c85d24da440ebe5266852f6356aecdadc41379c6 .NET: Fix declarative resume edge predicates to recognize both direct and PortableValue-wrapped forms after checkpoint restore (#5323) * b03cb324d5cc5e91a55b5eb9045b8ead244aaf11 Python: Add Hyperlight CodeAct package and docs (#5185) * dbf935b4e30cf9ae2553cad54f6bc09668f7eb62 .NET: fix: Foundry Agents without description in Handoff (#5311) * ca580a8316a904e947e48aaba8f3c00eb738ae36 .NET: Add error checking to workflow samples (#5175) * 101e07b0610e2a73e0c369be7e81907a44fb243f .NET: Add Handoff sample (#5245) * aee1acbf8baeb9fb3b3f196975aae9e7f7481096 .NET: Foundry Evals integration for .NET (#4914) [ #5269 ] * 91e34358eb4f2643b13537b470d8ea0aeaec7307 Python: Feat: Add finish_reason support to AgentResponse and AgentResponseUpdate (#5211) [ #4622 ] * 90a633967ca60601fc696d335d770f9f05e236e2 Python: Fix Gemini client support for Gemini API and Vertex AI (#5258) * c14beedb3af8bdee168e3a06a245a5b9d8fa5f75 test: Add Handoff composability test (#5208) * 43d98974d3994486a35602467efcffb85839ce66 fix: propagate A2A metadata with namespaced key in additional_properties (#5240) (#5256) * 60da0ffb4803e0db18d3d3bde8e008eb4277882c .NET: Improve local release build perf by only formatting for one build target framework (#5266) * a2044829b13659ac40f7f4112f74efcce15397cc .NET: Update Microsoft.Extensions.AI to 10.5.0 and OpenAI to 2.10.0 and remove unused refs (#5269) * 435c66e9c9f215fdea4b041da35e6ca774b63094 Python: Handle url_citation annotations in `FoundryChatClient` streaming responses (#5071) [ #5029 ] * 52d50be9e06456aa8dc4adb2525b0bbd4f60d4d3 Bump Anthropic SDK to 12.13.0 and Anthropic.Foundry to 0.5.0 (#5279) * d20f9b5f973b0b8f693f530a8e3c0f9d9c99bb94 Add AgentExecutorResponse.with_text() to preserve conversation history through custom executors (#5255) [ #5246 ] * 87a8fa2a9d0ffd3d0b4b31882e70c4f60462bb29 .NET: Fix intermittent checkpoint-restore race in in-process workflow runs (#5134) * 8f7fd9525d1bf24f9606779ba7f8d41b66ce2ff1 Python: Add OpenAI types to default checkpoint encoding allow list (#5297) * 69697065ab78502c5e58a7e6bc90ae14fdc46c20 Python: Add context_providers and description to `workflow.as_agent()` (#4651) * fe4cd3cddc99f157710296dad892bec427cae991 Revert to public MCP server and skip on transient upstream errors (#5296) * 611230cc8ebde031d6c15dbc15d7053ddf56b40c Python: improve misc-integration test robustness (#5295) * f112150cfbc4d514b21b60a81bbe5239b4b2c81f Python: bump misc-integration retry delay to 30s (#5293) * ff05c22c5853a51b83c05b6fdb3b8e982bbf3b31 Python: add experimental file history provider (#5248) * eab7f09d03387a2b393f9785963353c1a09e8b6b Forward provider config to SessionConfig in GitHubCopilotAgent (fixes #5190) (#5195) * 68b93641b6802abd2d00a5191cb16c6074d39fe1 Python: Bump agent-framework-devui to 1.0.0b260414 for release (#5259) * 2b251d904f1cb045ec3b7e13411cac3c1aa1e019 Python: Fix reasoning replay when store=False (#5250) * 485af07b8c21896b7f24a0313b5a226b3bd711f8 Python: Add GeminiChatClient (#4847) ... (truncated) ## 1.1.1 ## [1.1.1] - 2026-04-23 ### Added - **agent-framework-core**: Add `expected_output` ground-truth support to `evaluate_workflow` for similarity evaluators ([#5234](https://github.com/microsoft/agent-framework/pull/5234)) - **agent-framework-ag-ui**, **agent-framework-a2a**: Propagate `thread_id` and `forwarded_props` through AG-UI to A2A `context_id` ([#5383](https://github.com/microsoft/agent-framework/pull/5383)) - **samples**: Add second approval-required tool (`set_stop_loss`) to `concurrent_builder_tool_approval` sample ([#4875](https://github.com/microsoft/agent-framework/pull/4875)) - **agent-framework-core**: Add `SKIP_PARSING` sentinel for `FunctionTool.invoke` to bypass `Content`-wrapping and return raw function results ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Changed - **agent-framework-foundry-hosting**: Correct Development Status classifier from Beta (4) to Alpha (3) to match the package's lifecycle stage ([#5387](https://github.com/microsoft/agent-framework/pull/5387)) - **tests**: Add Python flaky test report workflow ([#5342](https://github.com/microsoft/agent-framework/pull/5342)) - **agent-framework-hyperlight**: Simplify host callback to pass raw Python results via `SKIP_PARSING`, switch `execute_code` input schema to a plain JSON-schema dict, and tighten public API surface ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) ### Fixed - **agent-framework-openai**: Fix OpenAI Responses streaming to propagate `created_at` from the final `response.completed` event ([#5382](https://github.com/microsoft/agent-framework/pull/5382)) - **agent-framework-openai**: Fix `OpenAIEmbeddingClient` to use `AsyncOpenAI` for `/openai/v1` endpoints ([#5137](https://github.com/microsoft/agent-framework/pull/5137)) - **agent-framework-openai**: Exclude null `file_id` from `input_image` payload to prevent schema 400 errors ([#5125](https://github.com/microsoft/agent-framework/pull/5125)) - **agent-framework-foundry**: Reconcile Toolbox hosted-tool payloads with the Responses API ([#5414](https://github.com/microsoft/agent-framework/pull/5414)) - **agent-framework-ag-ui**: Pass client `thread_id` as `session_id` when constructing `AgentSession` ([#5384](https://github.com/microsoft/agent-framework/pull/5384)) - **agent-framework-hyperlight**: Thread-confine `WasmSandbox` interactions via per-entry `ThreadPoolExecutor` to eliminate the PyO3 `unsendable` panic when touched from asyncio worker threads ([#5424](https://github.com/microsoft/agent-framework/pull/5424)) **Full Changelog**: https://github.com/microsoft/agent-framework/compare/python-1.1.0...python-1.1.1 ## 1.1.0 ## Changes: * 3e864cdb4c6031cf93096fa6af4d927b31126d8a .NET: Update version to 1.1.0 (#5204) * 14d2ab3262580a383472b406d97b36cfd86b2787 Standardize file skills terminology on 'directory' (#5205) * e5f7b9c260961916e108ca10780988aeefd51662 .NET: Support reflection for discovery of resources and scripts in class-based skills (#5183) <details><summary><b>See More</b></summary> * 1dd828d25502a1d4b4facff8e278da0668b40d28 CHANGELOG Update with V1.0.0 Release (#5069) * 8348584ac29f91a2c5e5e3db05166add1bb7b2af VerifySamples: Filter projects to net10 only (#5184) * 6d6cb840aec8b85c6bb5e95dc680c8fdd6110394 .NET: Improve resilience of verify-samples by building separately and improving evaluation instructions (#5151) * 79afda1a6…
This was referenced May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces a new built-in tools package for the Microsoft Agent Framework, focusing on a cross-platform local shell tool (
LocalShellTool) and its supporting infrastructure. It adds comprehensive documentation, licensing, and a Python package structure to support safe and extensible shell command execution, with future growth in mind.