agent-framework-core 1.20.0__tar.gz → 1.22.0__tar.gz

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: agent-framework-core
-Version: 1.20.0
+Version: 1.22.0
 Summary: Microsoft Agent Framework for building AI Agents with Python. This is the core package that has all the core abstractions and implementations.
 Author-email: Microsoft <af-support@microsoft.com>
 Requires-Python: >=3.10
@@ -14,6 +14,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Typing :: Typed
 License-File: LICENSE
 Requires-Dist: msgspec>=0.20.0,<0.23
@@ -24,40 +25,41 @@ Requires-Dist: opentelemetry-api>=1.39.0,<2
 Requires-Dist: pyyaml>=6.0,<7.0
 Requires-Dist: regex>=2024.11.6
 Requires-Dist: mcp>=1.24.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-a2a>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-ag-ui>=1.5.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-anthropic>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-azure-ai-search>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-azure-contentunderstanding>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-azure-cosmos>=1.0.0b261002,<2 ; extra == "all"
+Requires-Dist: agent-framework-a2a>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-ag-ui>=1.6.0,<2 ; extra == "all"
+Requires-Dist: agent-framework-anthropic>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-azure-ai-search>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-azure-contentunderstanding>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-azure-cosmos>=1.0.0b261015,<2 ; extra == "all"
 Requires-Dist: agent-framework-azurefunctions>=1.0.0b260922,<2 ; extra == "all"
-Requires-Dist: agent-framework-bedrock>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-chatkit>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-claude>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-copilotstudio>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-declarative>=1.2.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-devui>=1.0.0b261002,<2 ; extra == "all"
+Requires-Dist: agent-framework-bedrock>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-chatkit>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-claude>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-copilotstudio>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-declarative>=1.3.0,<2 ; extra == "all"
+Requires-Dist: agent-framework-devui>=1.0.0b261015,<2 ; extra == "all"
 Requires-Dist: agent-framework-durabletask>=1.0.0b260922,<2 ; extra == "all"
-Requires-Dist: agent-framework-foundry>=1.14.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-foundry-hosting>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-foundry-local>=1.0.0b260730,<2 ; extra == "all"
-Requires-Dist: agent-framework-gemini>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-github-copilot>=2.0.1,<3 ; extra == "all" and ( python_version >= '3.11')
-Requires-Dist: agent-framework-hyperlight>=1.0.0b261002,<2 ; extra == "all" and ( python_version < '3.15' and ((sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')))
-Requires-Dist: agent-framework-mem0>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-mistral>=1.0.0b260918,<2 ; extra == "all"
-Requires-Dist: agent-framework-monty>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-ollama>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-openai>=1.15.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-orchestrations>=1.3.0,<2 ; extra == "all"
-Requires-Dist: agent-framework-purview>=1.0.0b261002,<2 ; extra == "all"
-Requires-Dist: agent-framework-redis>=1.0.0b261002,<2 ; extra == "all" and ( python_version < '3.15')
-Requires-Dist: agent-framework-tools>=1.0.0b261002,<2 ; extra == "all"
+Requires-Dist: agent-framework-foundry>=1.15.0,<2 ; extra == "all"
+Requires-Dist: agent-framework-foundry-hosting>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-foundry-local>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-gemini>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-github-copilot>=2.1.0,<3 ; extra == "all" and ( python_version >= '3.11')
+Requires-Dist: agent-framework-hyperlight>=1.0.0b261015,<2 ; extra == "all" and ( python_version < '3.15' and ((sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')))
+Requires-Dist: agent-framework-mem0>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-mistral>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-monty>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-ollama>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-openai>=1.17.0,<2 ; extra == "all"
+Requires-Dist: agent-framework-orchestrations>=1.3.2,<2 ; extra == "all"
+Requires-Dist: agent-framework-purview>=1.0.0b261015,<2 ; extra == "all"
+Requires-Dist: agent-framework-redis>=1.0.0b261015,<2 ; extra == "all" and ( python_version < '3.15')
+Requires-Dist: agent-framework-tools>=1.0.0b261015,<2 ; extra == "all"
 Project-URL: homepage, https://aka.ms/agent-framework
 Project-URL: issues, https://github.com/microsoft/agent-framework/issues
 Project-URL: release_notes, https://github.com/microsoft/agent-framework/releases?q=tag%3Apython-1&expanded=true
 Project-URL: source, https://github.com/microsoft/agent-framework/tree/main/python
 Provides-Extra: all
+Import-Name: agent_framework
 
 # Get Started with Microsoft Agent Framework
 
@@ -83,9 +85,14 @@ pip install agent-framework-openai
 
 Supported Platforms:
 
-- Python: 3.10+
+- Python: 3.10–3.15
 - OS: Windows, macOS, Linux
 
+Python 3.10 remains supported and tested for this release, but it is deprecated
+because upstream Python 3.10 has reached end of life. New environments should
+use Python 3.11 or later. Removing Python 3.10 support will be handled in a
+future release rather than by this compatibility update.
+
 ## 1. Setup API Keys
 
 Depending on the client you want to use, there are various environment variables you can set to configure the chat clients. This can be done in the environment itself, or with a `.env` file in your project root, some examples of environment variables include:

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/README.md

@@ -22,9 +22,14 @@ pip install agent-framework-openai
 
 Supported Platforms:
 
-- Python: 3.10+
+- Python: 3.10–3.15
 - OS: Windows, macOS, Linux
 
+Python 3.10 remains supported and tested for this release, but it is deprecated
+because upstream Python 3.10 has reached end of life. New environments should
+use Python 3.11 or later. Removing Python 3.10 support will be handled in a
+future release rather than by this compatibility update.
+
 ## 1. Setup API Keys
 
 Depending on the client you want to use, there are various environment variables you can set to configure the chat clients. This can be done in the environment itself, or with a `.env` file in your project root, some examples of environment variables include:

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/__init__.py

@@ -277,12 +277,15 @@ _LAZY_MODULE_EXPORTS: Final[Mapping[str, tuple[str, ...]]] = {
         "UsageDetails",
         "add_usage_details",
         "detect_media_type_from_base64",
+        "get_namespaced_value",
         "map_chat_to_agent_update",
+        "merge_additional_properties",
         "merge_chat_options",
         "normalize_messages",
         "normalize_tools",
         "prepend_instructions_to_messages",
         "validate_chat_options",
+        "with_namespaced_value",
         "validate_tool_mode",
         "validate_tools",
     ),
@@ -696,6 +699,7 @@ __all__ = [
     "executor",
     "function_middleware",
     "get_agent_mode",
+    "get_namespaced_value",
     "get_run_context",
     "handler",
     "included_messages",
@@ -703,6 +707,7 @@ __all__ = [
     "keyword_check",
     "load_settings",
     "map_chat_to_agent_update",
+    "merge_additional_properties",
     "merge_chat_options",
     "normalize_function_invocation_configuration",
     "normalize_messages",
@@ -727,6 +732,7 @@ __all__ = [
     "validate_tools",
     "validate_workflow_graph",
     "vectorstoremodel",
+    "with_namespaced_value",
     "workflow",
 ]
 

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/__init__.pyi

@@ -243,7 +243,9 @@ from ._types import (
     UsageDetails,
     add_usage_details,
     detect_media_type_from_base64,
+    get_namespaced_value,
     map_chat_to_agent_update,
+    merge_additional_properties,
     merge_chat_options,
     normalize_messages,
     normalize_tools,
@@ -251,6 +253,7 @@ from ._types import (
     validate_chat_options,
     validate_tool_mode,
     validate_tools,
+    with_namespaced_value,
 )
 from ._vector_filters import Filter, FilterGroup, FilterGroupOperator, FilterOperator, Param
 from ._vectors import (
@@ -651,6 +654,7 @@ __all__ = [
     "executor",
     "function_middleware",
     "get_agent_mode",
+    "get_namespaced_value",
     "get_run_context",
     "handler",
     "included_messages",
@@ -658,6 +662,7 @@ __all__ = [
     "keyword_check",
     "load_settings",
     "map_chat_to_agent_update",
+    "merge_additional_properties",
     "merge_chat_options",
     "normalize_function_invocation_configuration",
     "normalize_messages",
@@ -682,5 +687,6 @@ __all__ = [
     "validate_tools",
     "validate_workflow_graph",
     "vectorstoremodel",
+    "with_namespaced_value",
     "workflow",
 ]

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_agent_hooks.py

@@ -825,42 +825,6 @@ class _OutputCodec:
 # region Enforcement helpers
 
 
-def _chat_updates_from_response(response: ChatResponse[Any]) -> list[ChatResponseUpdate]:
-    """Re-derive stream updates from a (transformed) assembled chat response."""
-    updates = [
-        ChatResponseUpdate(
-            contents=list(message.contents),
-            role=cast(Any, message.role),
-            author_name=message.author_name,
-            message_id=message.message_id,
-            response_id=response.response_id,
-            model=response.model,
-        )
-        for message in response.messages
-    ]
-    if not updates:
-        updates = [ChatResponseUpdate(role="assistant", response_id=response.response_id)]
-    updates[-1].finish_reason = response.finish_reason
-    return updates
-
-
-def _agent_updates_from_response(response: AgentResponse[Any]) -> list[AgentResponseUpdate]:
-    """Re-derive stream updates from a (transformed) assembled agent response."""
-    updates = [
-        AgentResponseUpdate(
-            contents=list(message.contents),
-            role=message.role,
-            author_name=message.author_name,
-            message_id=message.message_id,
-            response_id=response.response_id,
-        )
-        for message in response.messages
-    ]
-    if not updates:
-        updates = [AgentResponseUpdate(role="assistant", response_id=response.response_id)]
-    return updates
-
-
 def _normalized_tools(tools: Any, *, point: str) -> list[Any]:
     """Normalize a tools value for projection; empty (with a warning) when it cannot be.
 
@@ -1313,7 +1277,7 @@ class _AgentHooksAgentMiddleware(_AgentHooksMiddlewareBase, AgentMiddleware):
             await self._emit_shutdown(state, "cancelled" if isinstance(exc, asyncio.CancelledError) else "error")
 
         context._stream_terminal_result_transforms.append(_transform)  # pyright: ignore[reportPrivateUsage]
-        context._stream_terminal_result_to_updates = _agent_updates_from_response  # pyright: ignore[reportPrivateUsage]
+        context._stream_terminal_result_to_updates = AgentResponse.to_updates  # pyright: ignore[reportPrivateUsage]
         context._stream_terminal_result_is_authoritative = True  # pyright: ignore[reportPrivateUsage]
         context._stream_release_hooks.append(_release)  # pyright: ignore[reportPrivateUsage]
         context._stream_release_error_hooks.append(_release_error)  # pyright: ignore[reportPrivateUsage]
@@ -1443,7 +1407,7 @@ class _AgentHooksChatMiddleware(_AgentHooksMiddlewareBase, ChatMiddleware):
             gate_handle.drop()
 
         context._stream_terminal_result_transforms.append(_transform)  # pyright: ignore[reportPrivateUsage]
-        context._stream_terminal_result_to_updates = _chat_updates_from_response  # pyright: ignore[reportPrivateUsage]
+        context._stream_terminal_result_to_updates = ChatResponse.to_updates  # pyright: ignore[reportPrivateUsage]
         context._stream_terminal_result_is_authoritative = True  # pyright: ignore[reportPrivateUsage]
         context._stream_release_hooks.append(_release)  # pyright: ignore[reportPrivateUsage]
         context._stream_release_error_hooks.append(_release_error)  # pyright: ignore[reportPrivateUsage]

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_agents.py

@@ -81,6 +81,8 @@ else:
     from typing_extensions import Self, TypedDict  # pragma: no cover
 
 if TYPE_CHECKING:
+    from collections.abc import Collection
+
     from mcp import types
     from mcp.server.lowlevel import Server
     from pydantic import BaseModel
@@ -113,6 +115,17 @@ def _tool_approval_source_ids(middleware: Sequence[MiddlewareTypes] | None) -> f
     return frozenset(item.source_id for item in middleware if isinstance(item, ToolApprovalMiddleware))
 
 
+def _provider_service_session_state_keys(agent: object) -> frozenset[str]:
+    """Return provider-owned session-state keys declared by an agent or its client."""
+    keys: set[str] = set()
+    # A generic Agent can use a provider client that persists its own continuation state.
+    for owner in (agent, getattr(agent, "client", None)):
+        declared = getattr(owner, "service_session_state_keys", ())
+        if isinstance(declared, (list, tuple, set, frozenset)):
+            keys.update(key for key in cast("Collection[Any]", declared) if isinstance(key, str))
+    return frozenset(keys)
+
+
 def _merge_delegated_session_state(
     parent_state: MutableMapping[str, Any],
     initial_child_state: Mapping[str, Any],
@@ -665,9 +678,10 @@ class BaseAgent(SerializationMixin):
             propagate_session: If True, the parent agent's session is forwarded
                 to this sub-agent's ``run()`` call. Application-state changes
                 propagate back to the parent, while framework approval continuation
-                state remains isolated. Defaults to False. The sub-agent always
-                receives an AgentSession so session-backed middleware can run.
-                When False, that session is private to this invocation.
+                state and provider-owned service session state remain isolated.
+                Defaults to False. The sub-agent always receives an AgentSession
+                so session-backed middleware can run. When False, that session is
+                private to this invocation.
 
         Returns:
             A FunctionTool that can be used as a tool by other agents.
@@ -683,6 +697,10 @@ class BaseAgent(SerializationMixin):
             values. The delegated call raises ToolExecutionException before running
             the child when their shared session-state keys overlap.
 
+            Direct or custom-loop invocation with ``propagate_session=True`` must set
+            :attr:`FunctionInvocationContext.parent_service_session_state_keys` when
+            the parent session is non-empty. Automatic function calling supplies it.
+
         Examples:
             .. code-block:: python
 
@@ -733,10 +751,24 @@ class BaseAgent(SerializationMixin):
             session = AgentSession()
             child_approval_source_ids = _tool_approval_source_ids(self.middleware)
             parent_approval_source_ids: frozenset[str] = frozenset()
+            parent_service_session_state_keys: frozenset[str] = frozenset()
 
             if propagate_session and parent_session is not None:
                 from ._tools import _PARENT_TOOL_APPROVAL_SOURCE_IDS_CONTEXT_KEY  # pyright: ignore[reportPrivateUsage]
 
+                # A custom loop can bypass the framework seam that identifies the parent provider's state.
+                # Refuse a non-empty shared session rather than guessing which keys are safe to delegate.
+                if ctx.parent_service_session_state_keys is None:
+                    if parent_session.state:
+                        raise ToolExecutionException(
+                            f"Agent tool {tool_name!r} cannot safely propagate a non-empty parent session because "
+                            "the invocation path did not provide parent provider-owned session state keys. "
+                            "Use the automatic function-calling loop, set "
+                            "FunctionInvocationContext.parent_service_session_state_keys in a custom loop, "
+                            "or set propagate_session=False."
+                        )
+                else:
+                    parent_service_session_state_keys = ctx.parent_service_session_state_keys
                 raw_parent_approval_source_ids = ctx.metadata.get(_PARENT_TOOL_APPROVAL_SOURCE_IDS_CONTEXT_KEY)
                 parent_approval_source_ids = (
                     cast("frozenset[str]", raw_parent_approval_source_ids)
@@ -770,6 +802,10 @@ class BaseAgent(SerializationMixin):
                     _TOOL_APPROVAL_STATE_KEY,
                     _FUNCTION_INVOCATION_BUDGET_STATE_KEY,
                     _FUNCTION_RESULT_PAYLOAD_BUDGET_STATE_KEY,
+                    # Service handles belong to one agent's remote resources, not shared application state.
+                    # Exclude them in both directions so later children cannot inherit an earlier child's handles.
+                    *_provider_service_session_state_keys(self),
+                    *parent_service_session_state_keys,
                     *child_approval_source_ids,
                     *parent_approval_source_ids,
                 })
@@ -959,7 +995,7 @@ class RawAgent(BaseAgent, Generic[OptionsCoT]):
         tokenizer: TokenizerProtocol | None = None,
         additional_properties: MutableMapping[str, Any] | None = None,
     ) -> None:
-        """Initialize a Agent instance.
+        """Initialize an Agent instance.
 
         Args:
             client: The chat client to use for the agent.
@@ -1589,7 +1625,10 @@ class RawAgent(BaseAgent, Generic[OptionsCoT]):
 
         agent_name = self._get_agent_name()
         from ._mcp import MCPTool
-        from ._tools import _PARENT_TOOL_APPROVAL_SOURCE_IDS_CONTEXT_KEY  # pyright: ignore[reportPrivateUsage]
+        from ._tools import (
+            _PARENT_SERVICE_SESSION_STATE_KEYS_CONTEXT_KEY,  # pyright: ignore[reportPrivateUsage]
+            _PARENT_TOOL_APPROVAL_SOURCE_IDS_CONTEXT_KEY,  # pyright: ignore[reportPrivateUsage]
+        )
 
         base_tools = _normalize_tools(chat_options.pop("tools", None))
         mcp_duplicate_message = "Tool names must be unique. Consider setting `tool_name_prefix` on the MCPTool."
@@ -1637,6 +1676,10 @@ class RawAgent(BaseAgent, Generic[OptionsCoT]):
         additional_function_arguments[_PARENT_TOOL_APPROVAL_SOURCE_IDS_CONTEXT_KEY] = _tool_approval_source_ids(
             self.middleware
         )
+        # Recompute ownership for this invoking agent; caller kwargs must not replace its declarations.
+        additional_function_arguments[_PARENT_SERVICE_SESSION_STATE_KEYS_CONTEXT_KEY] = (
+            _provider_service_session_state_keys(self)
+        )
 
         model = opts.pop("model", None)
 
@@ -2061,7 +2104,7 @@ class Agent(
         tokenizer: TokenizerProtocol | None = None,
         additional_properties: MutableMapping[str, Any] | None = None,
     ) -> None:
-        """Initialize a Agent instance."""
+        """Initialize an Agent instance."""
         super().__init__(
             client=client,
             instructions=instructions,

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_compaction.py

@@ -1013,11 +1013,9 @@ def _serialize_content(content: Content) -> dict[str, Any]:
     else:
         payload.pop("protected_data", None)
     additional_properties = payload.get("additional_properties")
-    if isinstance(additional_properties, dict) and "encrypted_content" in additional_properties:
-        typed_properties = cast("dict[str, Any]", additional_properties)
-        payload["additional_properties"] = {
-            key: value for key, value in typed_properties.items() if key != "encrypted_content"
-        }
+    if isinstance(additional_properties, dict) and additional_properties:
+        filtered_properties = _strip_opaque_reasoning_payload(additional_properties)
+        payload["additional_properties"] = filtered_properties or {}
     return payload
 
 

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_harness/_file_access.py

@@ -28,6 +28,8 @@ import logging
 import os
 import threading
 import time
+import unicodedata
+import weakref
 from abc import ABC, abstractmethod
 from collections.abc import Awaitable, Mapping, MutableMapping
 from pathlib import Path
@@ -1718,6 +1720,52 @@ class _SearchFilesInput(BaseModel):
     ] = None
 
 
+# Locks handed out by ``_store_write_lock``. Values are held weakly, so an entry lasts only while an
+# edit holds or awaits its lock, and the map never grows with the number of paths ever edited.
+_STORE_WRITE_LOCKS: weakref.WeakValueDictionary[tuple[int, asyncio.AbstractEventLoop, str], asyncio.Lock] = (
+    weakref.WeakValueDictionary()
+)
+
+
+def _store_write_lock(store: AgentFileStore, folder: str) -> asyncio.Lock:
+    """Return the lock that serializes edits of the files directly inside ``folder`` in ``store``.
+
+    Mutating tools hold it across their read-modify-write. It belongs to the store
+    instance rather than to one provider, so two providers sharing a store cannot both
+    read a file before either writes it back and silently drop one of the edits.
+    File-access tools lock the folder of the file they edit (see ``_parent_folder``) and
+    file-memory tools lock their working folder, so the two kinds of provider also wait
+    for each other when they edit the same file. Edits of different files in one folder
+    therefore run one at a time.
+
+    The folder name is folded to NFC and lowercased because a store can treat such
+    spellings as one folder: :class:`InMemoryAgentFileStore` ignores case, and macOS
+    file systems resolve the NFC and NFD forms of a name to one entry. Elsewhere two
+    spellings merely share a lock.
+
+    Locks are per event loop, because an :class:`asyncio.Lock` that has had a waiter on
+    one loop raises when a caller has to wait for it on another. The key holds
+    ``id(store)`` rather than the store, so a store need not be hashable (a default
+    ``@dataclass`` is not) and is never kept alive by this map; the id cannot be reused
+    while its lock is in use, because whoever holds or awaits the lock still references
+    the store.
+
+    The lock is process-local: other processes, and other store instances over the same
+    backing storage, are not coordinated.
+    """
+    key = (id(store), asyncio.get_running_loop(), unicodedata.normalize("NFC", folder).lower())
+    lock = _STORE_WRITE_LOCKS.get(key)
+    if lock is None:
+        lock = asyncio.Lock()
+        _STORE_WRITE_LOCKS[key] = lock
+    return lock
+
+
+def _parent_folder(path: str) -> str:
+    """Return the folder of a normalized store path (``""`` for a file at the root)."""
+    return path.rpartition("/")[0]
+
+
 @experimental(feature_id=ExperimentalFeature.HARNESS)
 class FileAccessProvider(ContextProvider):
     """Context provider that gives an agent CRUD/search access to a shared file store.
@@ -1878,12 +1926,6 @@ class FileAccessProvider(ContextProvider):
         self.disable_write_tool_approval = disable_write_tool_approval
         self.session_scoped = session_scoped
         self.scope = scope
-        # Serializes mutating tool operations (write/delete/replace/replace_lines).
-        # The provider is shared across sessions/agents, so read-modify-write tools
-        # (replace/replace_lines) could otherwise interleave and lose updates. Note
-        # this only serializes within a single event loop/process, not across
-        # processes sharing a FileSystemAgentFileStore on disk.
-        self._write_lock = asyncio.Lock()
 
     def _resolve_session_key(self, context: SessionContext) -> str:
         """Resolve the working folder key for session-scoped mode.
@@ -1919,15 +1961,14 @@ class FileAccessProvider(ContextProvider):
     def _is_local_tool_call(function_call: Content) -> bool:
         """Return whether a function call targets this provider's local tools.
 
-        Hosted-tool calls carry a ``server_label`` in their
-        ``additional_properties`` and are a separate server-scoped approval
+        Hosted-tool calls set ``hosted=True`` and are a separate server-scoped approval
         boundary that must be passed through untouched (see
         :func:`agent_framework._tools._is_hosted_tool_approval`). These rules
         only ever auto-approve the provider's own local tools, so any call that
-        carries a ``server_label`` is rejected even if its name collides with a
+        is hosted is rejected even if its name collides with a
         file-access tool name.
         """
-        return not function_call.additional_properties.get("server_label")
+        return not function_call.hosted
 
     @staticmethod
     def read_only_tools_auto_approval_rule(function_call: Content) -> bool:
@@ -1941,7 +1982,7 @@ class FileAccessProvider(ContextProvider):
         the tools that modify it (``file_access_write``, ``file_access_delete``,
         ``file_access_replace``, and ``file_access_replace_lines``).
 
-        Hosted-tool calls (those carrying a ``server_label``) are never
+        Hosted-tool calls are never
         auto-approved, even when their name matches a file-access tool, so the
         rule stays scoped to this provider's local tools.
 
@@ -1978,7 +2019,7 @@ class FileAccessProvider(ContextProvider):
         ``file_access_delete``, ``file_access_replace``, and
         ``file_access_replace_lines``).
 
-        Hosted-tool calls (those carrying a ``server_label``) are never
+        Hosted-tool calls are never
         auto-approved, even when their name matches a file-access tool, so the
         rule stays scoped to this provider's local tools.
 
@@ -2036,7 +2077,9 @@ class FileAccessProvider(ContextProvider):
             try:
                 normalized = _normalize_relative_path(file_name)
                 store_path = _session_path(normalized)
-                async with self._write_lock:
+                # Every mutating tool takes the lock of the file's folder, which all providers
+                # on the store share, so a write cannot land between another edit's read and write.
+                async with _store_write_lock(self.store, _parent_folder(store_path)):
                     await self.store.write(store_path, content, overwrite=overwrite)
             except NotADirectoryError:
                 return f"Could not write file '{file_name}': a parent path is already a file. Choose a different path."
@@ -2091,7 +2134,7 @@ class FileAccessProvider(ContextProvider):
             try:
                 normalized = _normalize_relative_path(file_name)
                 store_path = _session_path(normalized)
-                async with self._write_lock:
+                async with _store_write_lock(self.store, _parent_folder(store_path)):
                     deleted = await self.store.delete(store_path)
             except ValueError as exc:
                 return f"Could not delete file '{file_name}': {exc}"
@@ -2132,7 +2175,7 @@ class FileAccessProvider(ContextProvider):
             try:
                 normalized = _normalize_relative_path(file_name)
                 store_path = _session_path(normalized)
-                async with self._write_lock:
+                async with _store_write_lock(self.store, _parent_folder(store_path)):
                     content = await self.store.read(store_path)
                     if content is None:
                         return f"File '{file_name}' not found."
@@ -2154,7 +2197,7 @@ class FileAccessProvider(ContextProvider):
             try:
                 normalized = _normalize_relative_path(file_name)
                 store_path = _session_path(normalized)
-                async with self._write_lock:
+                async with _store_write_lock(self.store, _parent_folder(store_path)):
                     content = await self.store.read(store_path)
                     if content is None:
                         return f"File '{file_name}' not found."

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_harness/_file_memory.py

@@ -42,7 +42,6 @@ per-invocation :class:`~agent_framework.SessionContext` in
 
 from __future__ import annotations
 
-import asyncio
 import logging
 from typing import Annotated, Any
 
@@ -60,6 +59,7 @@ from ._file_access import (
     _line_edits,  # pyright: ignore[reportPrivateUsage]
     _matches_glob,  # pyright: ignore[reportPrivateUsage]
     _normalize_relative_path,  # pyright: ignore[reportPrivateUsage]
+    _store_write_lock,  # pyright: ignore[reportPrivateUsage]
 )
 
 logger = logging.getLogger(__name__)
@@ -297,10 +297,6 @@ class FileMemoryProvider(ContextProvider):
         self.store = store
         self.scope = scope
         self.instructions = instructions or DEFAULT_FILE_MEMORY_INSTRUCTIONS
-        # Serializes write/delete operations (and their index rebuilds) so the
-        # ``memories.md`` index stays consistent. A single per-instance lock is
-        # sufficient for v1; concurrent writes across scopes are rare in practice.
-        self._write_lock = asyncio.Lock()
 
     def _resolve_working_folder(self, context: SessionContext) -> str:
         """Resolve the working folder for the current invocation.
@@ -382,7 +378,11 @@ class FileMemoryProvider(ContextProvider):
 
             path = _combine_paths(working_folder, normalized)
             desc_path = _combine_paths(working_folder, _description_file_name(normalized))
-            async with self._write_lock:
+            # Every mutating tool locks the whole working folder, not just the file, because each
+            # write and delete rebuilds the folder's memories.md index. The lock is shared by all
+            # providers on the store, including file-access tools editing a file in this folder, so
+            # they cannot interleave edits or index rebuilds.
+            async with _store_write_lock(self.store, working_folder):
                 try:
                     await self.store.write(path, content)
                     if description and description.strip():
@@ -427,7 +427,7 @@ class FileMemoryProvider(ContextProvider):
 
             path = _combine_paths(working_folder, normalized)
             desc_path = _combine_paths(working_folder, _description_file_name(normalized))
-            async with self._write_lock:
+            async with _store_write_lock(self.store, working_folder):
                 try:
                     deleted = await self.store.delete(path)
                     await self.store.delete(desc_path)
@@ -478,7 +478,7 @@ class FileMemoryProvider(ContextProvider):
                     "Please choose a different file name."
                 )
             path = _combine_paths(working_folder, normalized)
-            async with self._write_lock:
+            async with _store_write_lock(self.store, working_folder):
                 try:
                     content = await self.store.read(path)
                     if content is None:
@@ -506,7 +506,7 @@ class FileMemoryProvider(ContextProvider):
                     "Please choose a different file name."
                 )
             path = _combine_paths(working_folder, normalized)
-            async with self._write_lock:
+            async with _store_write_lock(self.store, working_folder):
                 try:
                     content = await self.store.read(path)
                     if content is None:

{agent_framework_core-1.20.0 → agent_framework_core-1.22.0}/agent_framework/_harness/_memory.py

@@ -506,10 +506,10 @@ class MemoryTopicRecord:
                 topic = stripped[2:].strip()
                 current_section = None
                 continue
-            if stripped.startswith("Updated: "):
+            if current_section is None and stripped.startswith("Updated: "):
                 updated_at = stripped.removeprefix("Updated: ").strip()
                 continue
-            if stripped.startswith("Sessions: "):
+            if current_section is None and stripped.startswith("Sessions: "):
                 raw_sessions = stripped.removeprefix("Sessions: ").strip()
                 session_ids = (
                     []