agent-framework-declarative 1.1.0__tar.gz → 1.2.1__tar.gz

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-declarative
-Version: 1.1.0
+Version: 1.2.1
 Summary: Declarative specification support for Microsoft Agent Framework.
 Author-email: Microsoft <af-support@microsoft.com>
 Requires-Python: >=3.10
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Typing :: Typed
 License-File: LICENSE
-Requires-Dist: agent-framework-core>=1.19.0,<2
+Requires-Dist: agent-framework-core>=1.20.0,<2
 Requires-Dist: httpx>=0.27,<1
 Requires-Dist: powerfx>=0.0.32,<0.0.35; python_version < '3.14'
 Requires-Dist: pyyaml>=6.0,<7.0

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_declarative_base.py

@@ -45,6 +45,10 @@ from agent_framework import (
 )
 from agent_framework._workflows._state import State
 
+from ._errors import DeclarativeWorkflowError
+from ._powerfx_limits import _PowerFxStateBudget, _validate_powerfx_state  # pyright: ignore[reportPrivateUsage]
+from ._state_path import _is_safe_path_segment  # pyright: ignore[reportPrivateUsage]
+
 try:
     from powerfx import Engine
 except (ImportError, RuntimeError):
@@ -63,9 +67,6 @@ logger = logging.getLogger(__name__)
 
 _ENV_REFERENCE_RE = re.compile(r"\bEnv\.([A-Za-z_][A-Za-z0-9_]*)")
 
-# Allowed identifier shape for object-attribute steps in declarative state paths
-_SAFE_PATH_SEGMENT_RE = re.compile(r"^[A-Za-z][A-Za-z0-9_]*$")
-
 
 def _skip_powerfx_opaque_token(formula: str, start: int) -> int:
     """Return the end of an ordinary quoted token or comment, or start if neither."""
@@ -167,6 +168,8 @@ class DeclarativeEnvConfig:
         # contents of ``values`` / ``referenced_names``: caller mutations
         # to the original objects after construction cannot leak into
         # ``resolve()``.
+        _validate_powerfx_state(self.values)
+        _validate_powerfx_state(self.referenced_names)
         object.__setattr__(self, "values", MappingProxyType(dict(self.values)))
         object.__setattr__(self, "referenced_names", frozenset(self.referenced_names))
 
@@ -179,6 +182,8 @@ class DeclarativeEnvConfig:
         unrelated environment variables never enter the PowerFx scope.
         Configuration values always win over the environment fallback.
         """
+        _validate_powerfx_state(self.values)
+        _validate_powerfx_state(self.referenced_names)
         resolved = {name: str(value) for name, value in self.values.items()}
         if self.restrict_to_configuration:
             return resolved
@@ -197,6 +202,10 @@ def discover_env_references(node: Any) -> set[str]:
     happen to mention ``Env.SOMETHING`` as plain text, the scan only inspects
     strings that begin with ``=`` (PowerFx expression marker, matching the
     convention enforced by :meth:`DeclarativeWorkflowState.eval`).
+    Shared containers are scanned once by identity without Python recursion.
+    Cyclic mappings and lists are rejected rather than silently skipped.
+    This avoids repeated container traversal, but does not impose a definition-size,
+    depth, parsing-time, or execution budget.
 
     Args:
         node: A parsed workflow definition (typically the dict produced by
@@ -205,23 +214,43 @@ def discover_env_references(node: Any) -> set[str]:
     Returns:
         The set of ``Env`` identifier names referenced in PowerFx
         expressions inside ``node``.
+
+    Raises:
+        DeclarativeWorkflowError: If the definition contains a mapping/list cycle.
     """
     names: set[str] = set()
+    active: set[int] = set()
+    # Retain containers so their identities cannot be reused during the walk.
+    visited: dict[int, Mapping[Any, Any] | list[Any]] = {}
+    stack: list[tuple[int | None, Iterator[Any]]] = [(None, iter((node,)))]
 
-    def visit(value: Any) -> None:
+    while stack:
+        parent_id, children = stack[-1]
+        try:
+            value = next(children)
+        except StopIteration:
+            stack.pop()
+            if parent_id is not None:
+                active.remove(parent_id)
+            continue
         if isinstance(value, str):
             if value.startswith("="):
                 names.update(_ENV_REFERENCE_RE.findall(value))
-            return
-        if isinstance(value, Mapping):
-            for inner in cast(Mapping[Any, Any], value).values():
-                visit(inner)
-            return
-        if isinstance(value, list):
-            for item in cast(list[Any], value):
-                visit(item)
+            continue
+        if not isinstance(value, (Mapping, list)):
+            continue
+
+        container = cast(Mapping[Any, Any] | list[Any], value)
+        container_id = id(container)
+        if container_id in active:
+            raise DeclarativeWorkflowError("Cyclic mappings or lists are not supported in workflow definitions.")
+        if container_id in visited:
+            continue
+        visited[container_id] = container
+        active.add(container_id)
+        children = iter(container.values()) if isinstance(container, Mapping) else iter(container)
+        stack.append((container_id, children))
 
-    visit(node)
     return names
 
 
@@ -288,10 +317,16 @@ def _make_powerfx_safe(value: Any) -> Any:
 
     Returns:
         A PowerFx-safe representation of the value
+
+    Raises:
+        ValueError: If the input or converted symbols exceed the state budget.
     """
-    if value is None:
-        return value
+    _validate_powerfx_state(value)
+    return _convert_powerfx_value(value, _PowerFxStateBudget(), 0)
+
 
+def _convert_powerfx_value(value: Any, budget: _PowerFxStateBudget, depth: int) -> Any:
+    """Convert an already bounded value without restarting its traversal budget."""
     # Enum coercion must run BEFORE the primitive type check: many MAF
     # enums (e.g. MessageRole) are ``str``-subclass enums, so they pass
     # ``isinstance(v, str)`` but pythonnet refuses to convert them to
@@ -300,25 +335,27 @@ def _make_powerfx_safe(value: Any) -> Any:
     # to the underlying value (or its string form) so PowerFx sees a
     # plain ``str``/``int``.
     if isinstance(value, Enum):
-        return _make_powerfx_safe(value.value)
+        return _convert_powerfx_value(value.value, budget, depth)
 
+    if not isinstance(value, (*_POWERFX_SAFE_TYPES, dict, list)):
+        if hasattr(value, "__dict__"):
+            return _convert_powerfx_value(vars(value), budget, depth)
+        value = str(value)
+
+    budget.consume(value, depth)
     if isinstance(value, _POWERFX_SAFE_TYPES):
         return value
 
     if isinstance(value, dict):
         value_dict = cast(Mapping[Any, Any], value)
-        return {str(k): _make_powerfx_safe(v) for k, v in value_dict.items()}
-
-    if isinstance(value, list):
-        value_list = cast(list[Any], value)
-        return [_make_powerfx_safe(item) for item in value_list]
-
-    # Try to convert objects with __dict__ or dataclass-style attributes
-    if hasattr(value, "__dict__"):
-        return _make_powerfx_safe(vars(value))
+        result: dict[str, Any] = {}
+        for key, member in value_dict.items():
+            name = str(key)
+            budget.consume(name, depth + 1)
+            result[name] = _convert_powerfx_value(member, budget, depth + 1)
+        return result
 
-    # For other objects, try to convert to string representation
-    return str(value)
+    return [_convert_powerfx_value(item, budget, depth + 1) for item in cast(list[Any], value)]
 
 
 class DeclarativeWorkflowState:
@@ -358,6 +395,7 @@ class DeclarativeWorkflowState:
         Args:
             inputs: Initial workflow inputs (become Workflow.Inputs.*)
         """
+        _validate_powerfx_state(inputs)
         conversation_id = str(uuid.uuid4())
         state_data: DeclarativeStateData = {
             "Inputs": dict(inputs) if inputs else {},
@@ -376,10 +414,11 @@ class DeclarativeWorkflowState:
             "Conversation": {"messages": [], "history": []},
             "Custom": {},
         }
-        self._state.set(DECLARATIVE_STATE_KEY, state_data)
+        self.set_state_data(state_data)
 
     def get_state_data(self) -> DeclarativeStateData:
         """Get the full state data dict from state."""
+        self._state._validate(DECLARATIVE_STATE_KEY, _validate_powerfx_state)  # pyright: ignore[reportPrivateUsage]
         result = self._state.get(DECLARATIVE_STATE_KEY)
         if result is None:
             # Initialize if not present
@@ -395,10 +434,12 @@ class DeclarativeWorkflowState:
         scenarios), the start executor needs to avoid calling initialize()
         and clobbering the prior turn's Conversation/Local/System data.
         """
+        self._state._validate(DECLARATIVE_STATE_KEY, _validate_powerfx_state)  # pyright: ignore[reportPrivateUsage]
         return self._state.get(DECLARATIVE_STATE_KEY) is not None
 
     def set_state_data(self, data: DeclarativeStateData) -> None:
         """Set the full state data dict in state."""
+        _validate_powerfx_state(data)
         self._state.set(DECLARATIVE_STATE_KEY, data)
 
     def get(self, path: str, default: Any = None) -> Any:
@@ -457,7 +498,7 @@ class DeclarativeWorkflowState:
                     return default
             else:
                 # Attribute access is only allowed for safe declarative identifiers.
-                if not _SAFE_PATH_SEGMENT_RE.match(part):
+                if not _is_safe_path_segment(part):
                     logger.warning(
                         "DeclarativeWorkflowState.get: rejecting attribute segment %r in path %r",
                         part,
@@ -591,6 +632,8 @@ class DeclarativeWorkflowState:
         Raises:
             RuntimeError: If the powerfx package is not installed and the
                 expression requires PowerFx evaluation.
+            ValueError: If state copying or symbol conversion exceeds the
+                PowerFx state budget.
         """
         if not expression:
             return expression
@@ -914,10 +957,10 @@ class DeclarativeWorkflowState:
             symbols["Env"] = env_bound
         # Debug log the Local symbols to help diagnose type issues
         if local_data:
-            for key, value in local_data.items():
+            for value in local_data.values():
                 logger.debug(
-                    f"PowerFx symbol Local.{key}: type={type(value).__name__}, "
-                    f"value_preview={str(value)[:100] if value else None}"
+                    "PowerFx Local symbol type=%s",
+                    type(value).__name__,
                 )
         result = _make_powerfx_safe(symbols)
         return cast(dict[str, Any], result)

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_executors_agents.py

@@ -506,6 +506,13 @@ def _normalize_variable_path(variable: str) -> str:
 class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
     """Executor that invokes a Microsoft Foundry agent.
 
+    ``output.autoSend`` defaults to true and accepts a Boolean or a
+    ``=``-prefixed PowerFx Boolean expression, such as ``=Local.publishResult``.
+    Expressions use current state before each invocation, including resumed
+    external-loop turns. False suppresses automatic output, not invocation,
+    result storage or conversation history; later actions can explicitly emit
+    the stored results.
+
     This executor supports both Python-style and .NET-style YAML schemas:
 
     Python-style (simple):
@@ -615,8 +622,8 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
 
         return arguments, messages, external_loop_when, max_iterations
 
-    def _get_output_config(self) -> tuple[str | None, str | None, str | None, bool]:
-        """Parse output configuration.
+    def _get_output_config(self, state: DeclarativeWorkflowState) -> tuple[str | None, str | None, str | None, bool]:
+        """Parse output bindings and evaluate autoSend against the current state.
 
         Returns:
             Tuple of (messages var, responseObject var, resultProperty, autoSend)
@@ -637,7 +644,7 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
         property_val: Any = output_dict.get("property")
         property_var: str | None = str(property_val) if property_val is not None else None
         auto_send_val: Any = output_dict.get("autoSend", True)
-        auto_send: bool = bool(auto_send_val)
+        auto_send: bool = bool(state.eval_if_expression(auto_send_val))
 
         return messages_var, response_obj_var, property_var or result_property, auto_send
 
@@ -675,6 +682,12 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
     async def _build_input_text(self, state: Any, arguments: dict[str, Any], messages_expr: Any) -> str:
         """Build input text from arguments and messages.
 
+        ``input.arguments`` are formatted as ``key: value`` lines (same shape as the
+        multi-value ``Workflow.Inputs`` fallback) and included in the text sent to
+        ``agent.run()``. Python's agent ``run()`` has no separate structured-inputs
+        channel, so arguments must be folded into this text rather than discarded
+        (#7902).
+
         Args:
             state: Workflow state for expression evaluation
             arguments: Input arguments to evaluate
@@ -683,55 +696,61 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
         Returns:
             Input text for the agent
         """
-        # Evaluate arguments
         evaluated_args: dict[str, Any] = {}
         for key, value in arguments.items():
             evaluated_args[key] = state.eval_if_expression(value)
+        args_text = "\n".join(f"{k}: {v}" for k, v in evaluated_args.items()) if evaluated_args else ""
 
-        # Evaluate messages/input
+        messages_text = ""
         if messages_expr:
             evaluated_input: Any = state.eval_if_expression(messages_expr)
             if isinstance(evaluated_input, str):
-                return evaluated_input
-            if isinstance(evaluated_input, list) and evaluated_input:
+                messages_text = evaluated_input
+            elif isinstance(evaluated_input, list) and evaluated_input:
                 # Extract text from last message
                 last: Any = evaluated_input[-1]  # type: ignore
                 if isinstance(last, str):
-                    return last
-                if isinstance(last, dict):
+                    messages_text = last
+                elif isinstance(last, dict):
                     last_dict = cast(dict[str, Any], last)
                     content_val: Any = last_dict.get("content", last_dict.get("text", ""))
-                    return str(content_val) if content_val else ""
-                if last is not None and hasattr(last, "text"):  # type: ignore
-                    return str(getattr(last, "text", ""))  # type: ignore
-            if evaluated_input:
-                return str(cast(Any, evaluated_input))
-            return ""
-
-        # Fallback chain for implicit input (like .NET conversationId pattern):
-        # 1. Local.input / Local.userInput (explicit turn state)
-        # 2. System.LastMessage.Text (previous agent's response)
-        # 3. Workflow.Inputs (first agent gets workflow inputs)
-        input_text: str = str(state.get("Local.input") or state.get("Local.userInput") or "")
-        if not input_text:
-            # Try System.LastMessage.Text (used by external loop and agent chaining)
-            last_message: Any = state.get("System.LastMessage")
-            if isinstance(last_message, dict):
-                last_msg_dict = cast(dict[str, Any], last_message)
-                text_val: Any = last_msg_dict.get("Text", "")
-                input_text = str(text_val) if text_val else ""
-        if not input_text:
-            # Fall back to workflow inputs (for first agent in chain)
-            inputs: Any = state.get("Workflow.Inputs")
-            if isinstance(inputs, dict):
-                inputs_dict = cast(dict[str, Any], inputs)
-                # If single input, use its value directly
-                if len(inputs_dict) == 1:
-                    input_text = str(next(iter(inputs_dict.values())))
-                else:
-                    # Multiple inputs - format as key: value pairs
-                    input_text = "\n".join(f"{k}: {v}" for k, v in inputs_dict.items())
-        return input_text if input_text else ""
+                    messages_text = str(content_val) if content_val else ""
+                elif last is not None and hasattr(last, "text"):  # type: ignore
+                    messages_text = str(getattr(last, "text", ""))  # type: ignore
+            elif evaluated_input:
+                messages_text = str(cast(Any, evaluated_input))
+        elif not evaluated_args:
+            # Fallback chain for implicit input (like .NET conversationId pattern):
+            # Only when neither explicit messages nor explicit arguments are present.
+            # Otherwise arguments-only actions (e.g. customer-support TicketingAgent)
+            # would append System.LastMessage (prior agent's response) or
+            # Workflow.Inputs to their structured fields in chained workflows.
+            # 1. Local.input / Local.userInput (explicit turn state)
+            # 2. System.LastMessage.Text (previous agent's response)
+            # 3. Workflow.Inputs (first agent gets workflow inputs)
+            messages_text = str(state.get("Local.input") or state.get("Local.userInput") or "")
+            if not messages_text:
+                # Try System.LastMessage.Text (used by external loop and agent chaining)
+                last_message: Any = state.get("System.LastMessage")
+                if isinstance(last_message, dict):
+                    last_msg_dict = cast(dict[str, Any], last_message)
+                    text_val: Any = last_msg_dict.get("Text", "")
+                    messages_text = str(text_val) if text_val else ""
+            if not messages_text:
+                # Fall back to workflow inputs (for first agent in chain)
+                inputs: Any = state.get("Workflow.Inputs")
+                if isinstance(inputs, dict):
+                    inputs_dict = cast(dict[str, Any], inputs)
+                    # If single input, use its value directly
+                    if len(inputs_dict) == 1:
+                        messages_text = str(next(iter(inputs_dict.values())))
+                    else:
+                        # Multiple inputs - format as key: value pairs
+                        messages_text = "\n".join(f"{k}: {v}" for k, v in inputs_dict.items())
+
+        if args_text and messages_text:
+            return f"{args_text}\n{messages_text}"
+        return args_text or messages_text or ""
 
     def _get_agent(self, agent_name: str, ctx: WorkflowContext[Any, Any]) -> Any:
         """Get agent from registry (sync helper for response handler)."""
@@ -788,28 +807,16 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
             _validate_conversation_history(messages_for_agent, agent_name)
 
         # Retrieve kwargs passed to workflow.run() so they propagate to agent tools
-        from agent_framework._workflows import _agent_utils as workflow_agent_utils
-        from agent_framework._workflows import _const as workflow_const
-
-        run_kwargs: dict[str, Any] = ctx.get_state(workflow_const.WORKFLOW_RUN_KWARGS_KEY, {})
-        prepare_run_kwargs = getattr(workflow_agent_utils, "prepare_executor_run_kwargs", None)
-        resolved_state_key = getattr(workflow_const, "RESOLVED_WORKFLOW_RUN_KWARGS_KEY", None)
-        if callable(prepare_run_kwargs) and isinstance(resolved_state_key, str):
-            missing_resolved_state = object()
-            resolved_run_kwargs: Any = ctx.get_state(resolved_state_key, missing_resolved_state)
-            if resolved_run_kwargs is not missing_resolved_state:
-                if not isinstance(resolved_run_kwargs, dict):
-                    raise TypeError("Resolved workflow run kwargs state must be a dict.")
-                run_kwargs = cast(Any, prepare_run_kwargs)(self.id, run_kwargs, resolved_run_kwargs)
-        options: dict[str, Any] | None = None
-        if run_kwargs:
-            # Merge caller-provided options to avoid duplicate keyword argument
-            options = dict(run_kwargs.get("options") or {})
-            options["additional_function_arguments"] = run_kwargs
-            # Exclude 'options' from splat to avoid TypeError on duplicate keyword,
-            # and keep internal workflow-routing copies (stored under underscore
-            # keys for nested executors) out of the public Agent.run signature
-            run_kwargs = {k: v for k, v in run_kwargs.items() if k != "options" and not k.startswith("_")}
+        from agent_framework._workflows._agent_utils import prepare_executor_run_kwargs
+        from agent_framework._workflows._const import RESOLVED_WORKFLOW_RUN_KWARGS_KEY, WORKFLOW_RUN_KWARGS_KEY
+
+        run_kwargs = prepare_executor_run_kwargs(
+            self.id,
+            ctx.get_state(WORKFLOW_RUN_KWARGS_KEY, {}),
+            ctx.get_state(RESOLVED_WORKFLOW_RUN_KWARGS_KEY),
+        )
+        options = run_kwargs.pop("options", None)
+        run_kwargs = {k: v for k, v in run_kwargs.items() if not k.startswith("_")}
 
         # Use run() method to get properly structured messages (including tool calls and results)
         # This is critical for multi-turn conversations where tool calls must be followed
@@ -925,7 +932,7 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
         logger.debug("handle_action: starting agent '%s'", agent_name)
 
         arguments, messages_expr, external_loop_when, max_iterations = self._get_input_config()
-        messages_var, response_obj_var, result_property, auto_send = self._get_output_config()
+        messages_var, response_obj_var, result_property, auto_send = self._get_output_config(state)
 
         # Get conversation-specific messages path if conversationId is specified
         conversation_id_expr = self._get_conversation_id()
@@ -1095,6 +1102,9 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
                 f"Agent '{agent_name}' invocation failed: not found during loop resumption"
             )
 
+        _, _, _, auto_send = self._get_output_config(state)
+        loop_state.auto_send = auto_send
+
         try:
             accumulated_response, all_messages, tool_calls = await self._invoke_agent_and_store_results(
                 agent=agent,
@@ -1105,7 +1115,7 @@ class InvokeAzureAgentExecutor(DeclarativeActionExecutor):
                 messages_var=loop_state.messages_var,
                 response_obj_var=loop_state.response_obj_var,
                 result_property=loop_state.result_property,
-                auto_send=loop_state.auto_send,
+                auto_send=auto_send,
                 messages_path=loop_state.messages_path,
             )
         except (AgentInvalidRequestException, AgentInvalidResponseException):

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_executors_basic.py

@@ -224,6 +224,13 @@ class SendActivityExecutor(DeclarativeActionExecutor):
     """Executor for the SendActivity action.
 
     Sends a text message or activity as workflow output.
+    Authored text starting with ``=`` is evaluated and its result is emitted as data.
+    Other authored text supports ``{Variable.Path}`` template interpolation.
+
+    Expression results are not interpolated again. To migrate text that relied on
+    a second pass, author the template directly (``Hello, {Local.name}!``) or build
+    the final text in the expression (``="Hello, " & Local.name & "!"``).
+    Both forms work as a string activity or as a mapping's ``text`` field.
     """
 
     @handler
@@ -244,11 +251,7 @@ class SendActivityExecutor(DeclarativeActionExecutor):
             text = activity
 
         if isinstance(text, str):
-            # First evaluate any =expression syntax
-            text = state.eval_if_expression(text)
-            # Then interpolate any {Variable.Path} template syntax
-            if isinstance(text, str):
-                text = state.interpolate_string(text)
+            text = state.eval_if_expression(text) if text.startswith("=") else state.interpolate_string(text)
 
         # Yield the text as workflow output
         if text:

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_executors_mcp.py

@@ -13,16 +13,20 @@ Security notes:
 - Approval requests surface header NAMES only; header values are not echoed,
   matching the posture of :mod:`._executors_http`.
 - :class:`MCPToolApprovalRequest` carries the values the resume handler will
-  use; header values are re-evaluated on resume to keep secrets out of
-  checkpoint state.
+  use; header values are re-evaluated and checked against a workflow-local
+  keyed binding. Changed or unverifiable headers require fresh approval.
+  The key stays in trusted host checkpoint state, never in approval payloads;
+  header values are not checkpointed.
 - Tool outputs flow back into agent conversations through ``conversationId``
   and through Tool-role messages emitted to ``output.messages``. They share
   the same prompt-injection risk surface as ``HttpRequestAction``: workflow
   authors must trust the MCP server they invoke.
 """
 
+import hmac
 import json
 import logging
+import secrets
 import uuid
 from collections.abc import Mapping
 from dataclasses import dataclass, field
@@ -53,6 +57,7 @@ __all__ = [
 ]
 
 logger = logging.getLogger(__name__)
+_HEADER_BINDING_KEY = "_declarative_mcp_header_binding_key"
 
 
 # ---------------------------------------------------------------------------
@@ -74,6 +79,8 @@ class MCPToolApprovalRequest:
         connection_name: Connection identifier the invocation will use.
         metadata: Internal routing data pinned at approval-request time
             (e.g. ``conversation_id``) for use by the resume handler.
+        header_binding: Opaque binding of the reviewed headers. The verification
+            key is retained separately in trusted workflow state.
     """
 
     request_id: str
@@ -84,6 +91,7 @@ class MCPToolApprovalRequest:
     header_names: list[str] = field(default_factory=lambda: [])
     connection_name: str | None = None
     metadata: dict[str, Any] = field(default_factory=lambda: {})
+    header_binding: str | None = None
 
 
 # ---------------------------------------------------------------------------
@@ -156,7 +164,8 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
     - When ``requireApproval=true``: emits a :class:`MCPToolApprovalRequest`
       via ``ctx.request_info()`` and yields. On resume, the response is
       checked; on rejection, ``output.result`` is set to ``"Error: ..."`` and
-      no tool call is made.
+      no tool call is made. Changed headers, legacy unbound headers, or a
+      missing verification state require another approval.
     - On success: parses each :class:`agent_framework.Content` output (text →
       JSON-first / data / uri → URI string) and assigns the parsed list to
       ``output.result``. Builds a single Tool-role :class:`Message`
@@ -220,29 +229,6 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
         output_messages_path = _get_output_path(self._action_def, "messages")
         output_result_path = _get_output_path(self._action_def, "result")
 
-        if require_approval:
-            request_id = str(uuid.uuid4())
-            conversation_id = _evaluate_conversation_id(state, conversation_id_expr)
-            request = MCPToolApprovalRequest(
-                request_id=request_id,
-                tool_name=tool_name,
-                server_url=server_url,
-                server_label=server_label,
-                arguments=arguments,
-                header_names=sorted(headers.keys()),
-                connection_name=connection_name,
-                metadata={"conversation_id": conversation_id},
-            )
-            logger.info(
-                "%s: requesting approval for MCP tool '%s' on '%s'",
-                self.__class__.__name__,
-                tool_name,
-                server_url,
-            )
-            await ctx.request_info(request, ToolApprovalResponse, request_id=request_id)
-            return
-
-        # No approval required - invoke directly.
         invocation = MCPToolInvocation(
             server_url=server_url,
             tool_name=tool_name,
@@ -251,6 +237,12 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
             headers=headers,
             connection_name=connection_name,
         )
+        if require_approval:
+            await self._request_approval(
+                invocation, {"conversation_id": _evaluate_conversation_id(state, conversation_id_expr)}, ctx
+            )
+            return
+
         result = await self._invoke_with_narrow_catch(invocation)
         await self._process_result(
             ctx=ctx,
@@ -265,6 +257,54 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
 
     # ----- Approval response handler ------------------------------------------
 
+    def _bind_headers(
+        self,
+        ctx: WorkflowContext[ActionComplete, str],
+        request_id: str,
+        headers: Mapping[str, str],
+        *,
+        create_key: bool = False,
+    ) -> str | None:
+        key = ctx.state.get(_HEADER_BINDING_KEY, None)
+        if key is None:
+            if not create_key:
+                return None
+            key = secrets.token_hex(32)
+            ctx.state.set(_HEADER_BINDING_KEY, key)
+        if not isinstance(key, str) or len(key) != 64 or any(char not in "0123456789abcdef" for char in key):
+            raise ValueError("Invalid MCP approval header binding state.")
+        # Stable sorting preserves the order of duplicate case-insensitive names.
+        canonical_headers = sorted(((name.lower(), value) for name, value in headers.items()), key=lambda item: item[0])
+        payload = json.dumps(
+            [request_id, canonical_headers],
+            ensure_ascii=True,
+            separators=(",", ":"),
+        ).encode()
+        return hmac.digest(key.encode(), payload, "sha256").hex()
+
+    async def _request_approval(
+        self,
+        invocation: MCPToolInvocation,
+        metadata: dict[str, Any],
+        ctx: WorkflowContext[ActionComplete, str],
+    ) -> None:
+        request_id = str(uuid.uuid4())
+        request = MCPToolApprovalRequest(
+            request_id=request_id,
+            tool_name=invocation.tool_name,
+            server_url=invocation.server_url,
+            server_label=invocation.server_label,
+            arguments=invocation.arguments,
+            header_names=sorted(invocation.headers),
+            connection_name=invocation.connection_name,
+            metadata=metadata,
+            header_binding=(
+                self._bind_headers(ctx, request_id, invocation.headers, create_key=True) if invocation.headers else None
+            ),
+        )
+        logger.info("%s: requesting approval for MCP tool '%s'", self.__class__.__name__, invocation.tool_name)
+        await ctx.request_info(request, ToolApprovalResponse, request_id=request_id)
+
     @response_handler
     async def handle_approval_response(
         self,
@@ -272,7 +312,7 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
         response: ToolApprovalResponse,
         ctx: WorkflowContext[ActionComplete, str],
     ) -> None:
-        """Resume the invocation using the values pinned on ``original_request``."""
+        """Resume the pinned operation only with the reviewed header context."""
         state = self._get_state(ctx.state)
 
         tool_name = original_request.tool_name
@@ -303,6 +343,20 @@ class InvokeMcpToolActionExecutor(DeclarativeActionExecutor):
             headers=self._evaluate_headers(state, self._action_def.get("headers")),
             connection_name=getattr(original_request, "connection_name", None),
         )
+        if invocation.headers or original_request.header_names:
+            binding = getattr(original_request, "header_binding", None)
+            expected_binding = self._bind_headers(ctx, original_request.request_id, invocation.headers)
+            if (
+                not isinstance(binding, str)
+                or expected_binding is None
+                or not hmac.compare_digest(binding.encode(), expected_binding.encode())
+            ):
+                logger.warning(
+                    "%s: MCP header context changed or could not be verified; requesting fresh approval.",
+                    self.__class__.__name__,
+                )
+                await self._request_approval(invocation, dict(metadata), ctx)
+                return
         result = await self._invoke_with_narrow_catch(invocation)
         await self._process_result(
             ctx=ctx,

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_executors_tools.py

@@ -243,24 +243,23 @@ class BaseToolExecutor(DeclarativeActionExecutor):
 
         return None
 
-    def _get_output_config(self) -> tuple[str | None, str | None, bool]:
-        """Parse output configuration from action definition.
+    def _get_output_config(self) -> tuple[str | None, str | None, Any]:
+        """Parse output bindings and the unevaluated autoSend setting.
 
         Returns:
-            Tuple of (messages_var, result_var, auto_send)
+            Tuple of (messages_var, result_var, auto_send_expr)
         """
-        output_config: dict[str, str | bool] = self._action_def.get("output", {})
+        output_config: dict[str, Any] = self._action_def.get("output", {})
 
         if not isinstance(output_config, Mapping):
             return None, None, True
 
         messages_var = output_config.get("messages")
         result_var = output_config.get("result")
-        auto_send = bool(output_config.get("autoSend", True))
         return (
             str(messages_var) if messages_var else None,
             str(result_var) if result_var else None,
-            auto_send,
+            output_config.get("autoSend", True),
         )
 
     def _store_result(
@@ -443,7 +442,7 @@ class BaseToolExecutor(DeclarativeActionExecutor):
         state = await self._ensure_state_initialized(ctx, trigger)
 
         # Parse output configuration early so we can store errors
-        messages_var, result_var, auto_send = self._get_output_config()
+        messages_var, result_var, auto_send_expr = self._get_output_config()
 
         # Get and evaluate function name (required)
         function_name_expr = self._action_def.get("functionName")
@@ -496,6 +495,7 @@ class BaseToolExecutor(DeclarativeActionExecutor):
             return
 
         # No approval required - invoke directly
+        auto_send = bool(state.eval_if_expression(auto_send_expr))
         result = await self._execute_tool_invocation(
             function_name=function_name,
             arguments=arguments,
@@ -521,12 +521,14 @@ class BaseToolExecutor(DeclarativeActionExecutor):
         ``function_name`` and ``arguments`` are sourced from
         ``original_request`` (the payload the reviewer approved); output
         configuration is re-derived from the executor's action definition.
+        Rejected calls store the rejection and complete without evaluating
+        ``autoSend``.
         """
         state = self._get_state(ctx.state)
 
         function_name = original_request.function_name
         arguments = original_request.arguments
-        messages_var, result_var, auto_send = self._get_output_config()
+        messages_var, result_var, auto_send_expr = self._get_output_config()
 
         # Check if approved
         if response.approved is not True:
@@ -551,6 +553,7 @@ class BaseToolExecutor(DeclarativeActionExecutor):
             return
 
         # Approved - execute the invocation
+        auto_send = bool(state.eval_if_expression(auto_send_expr))
         result = await self._execute_tool_invocation(
             function_name=function_name,
             arguments=arguments,
@@ -572,6 +575,12 @@ class BaseToolExecutor(DeclarativeActionExecutor):
 class InvokeFunctionToolExecutor(BaseToolExecutor):
     """Executor that invokes a Python function as a tool.
 
+    ``output.autoSend`` defaults to true and accepts a Boolean or a
+    ``=``-prefixed PowerFx Boolean expression, such as ``=Local.publishResult``.
+    Expressions use current state immediately before direct or approved
+    invocation. False suppresses automatic output, not tool execution or result
+    storage; later actions can explicitly emit the stored results.
+
     This executor supports invoking registered Python functions with:
     - Expression evaluation for functionName and arguments
     - Optional approval flow (yield/resume pattern)

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_factory.py

@@ -210,7 +210,8 @@ class WorkflowFactory:
             An executable Workflow object with action nodes for each YAML action.
 
         Raises:
-            DeclarativeWorkflowError: If the YAML is invalid or cannot be parsed.
+            DeclarativeWorkflowError: If the YAML is invalid, cannot be parsed, or
+                environment-reference discovery encounters a mapping/list cycle.
             FileNotFoundError: If the YAML file doesn't exist.
 
         Examples:
@@ -262,7 +263,8 @@ class WorkflowFactory:
             An executable Workflow object with action nodes for each YAML action.
 
         Raises:
-            DeclarativeWorkflowError: If the YAML is invalid or cannot be parsed.
+            DeclarativeWorkflowError: If the YAML is invalid, cannot be parsed, or
+                environment-reference discovery encounters a mapping/list cycle.
 
         Examples:
             .. code-block:: python
@@ -338,7 +340,8 @@ class WorkflowFactory:
             An executable Workflow object with action nodes for each YAML action.
 
         Raises:
-            DeclarativeWorkflowError: If the definition is invalid or missing required fields.
+            DeclarativeWorkflowError: If the definition is invalid, is missing required
+                fields, or environment-reference discovery encounters a mapping/list cycle.
 
         Examples:
             .. code-block:: python

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_http_handler.py

@@ -22,10 +22,10 @@ from __future__ import annotations
 
 import asyncio
 from collections.abc import Awaitable, Callable, Mapping
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from http.cookiejar import CookieJar, DefaultCookiePolicy
 from typing import Any, Protocol, runtime_checkable
-from urllib.parse import parse_qsl, quote, urlencode, urlsplit, urlunsplit
+from urllib.parse import parse_qsl, quote, urlencode, urlsplit
 
 import httpx
 
@@ -131,6 +131,12 @@ class DefaultHttpRequestHandler:
        provider's clients retain their cookie behavior and are not closed by :meth:`aclose`.
        Returning ``None`` falls back to ``client``, if supplied, then to the owned client.
 
+    The provider receives a new :class:`HttpRequestInfo` with an absolute HTTP(S) URL
+    normalized by ``httpx`` and ``query_parameters`` already appended to ``url``.
+    The snapshot's ``query_parameters`` is empty; the original request is not modified.
+    Client-level query defaults are applied after selection, and supplied clients retain
+    their redirect behavior. The provider is not called again for automatic redirects.
+
     Applications requiring persistent cookies must supply a client through ``client``
     or ``client_provider`` scoped to one authenticated principal and manage its lifetime.
     Explicit outbound ``Cookie`` headers and response ``Set-Cookie`` headers are preserved;
@@ -162,6 +168,22 @@ class DefaultHttpRequestHandler:
         if not info.method:
             raise ValueError("HttpRequestInfo.method must be a non-empty string.")
 
+        url = httpx.URL(info.url)
+        if not url.is_absolute_url or url.scheme not in {"http", "https"}:
+            raise ValueError("HttpRequestInfo.url must be an absolute HTTP or HTTPS URL.")
+
+        # Preserve the authored query bytes, appending rather than replacing duplicate
+        # keys. QueryParams would rewrite escapes, bare flags and duplicate ordering.
+        query = urlsplit(info.url).query
+        explicit_pairs = [(key, value) for key, value in info.query_parameters.items() if key]
+        if explicit_pairs:
+            query += ("&" if query else "") + urlencode(explicit_pairs, quote_via=quote)
+        raw_path = url.raw_path.split(b"?", 1)[0]
+        if query:
+            raw_path += b"?" + _encode_query(query)
+        url = url.copy_with(raw_path=raw_path)
+
+        info = replace(info, url=str(url), headers=dict(info.headers), query_parameters={})
         client = await self._resolve_client(info)
 
         timeout: httpx.Timeout | object
@@ -181,54 +203,26 @@ class DefaultHttpRequestHandler:
                 # callers (not just the YAML executor) get sensible defaults.
                 headers["Content-Type"] = info.body_content_type or "text/plain"
 
-        # Compose the query as raw bytes rather than routing it through ``params=``.
-        # Anything that reaches ``httpx.QueryParams`` -- ``params=`` or the client's own
-        # ``AsyncClient.params`` merge -- is decoded and re-encoded. Measured against
-        # httpx 0.28.1, that rewrites ``%20`` in a value as ``+``, expands a bare
-        # ``download`` into ``download=``, and reorders interleaved duplicates
-        # (``x=1&y=2&x=3`` becomes ``x=1&x=3&y=2``), all of it even when nothing needed
-        # merging. Base64 and ``%3A`` round-trip unchanged, so a signature is not
-        # rewritten by itself, but any scheme that signs a value holding an encoded
-        # space is, and a server that distinguishes ``download`` from ``download=`` or
-        # reads repeated keys positionally sees a different request either way.
-        # Building the query here and writing it back over the request's ``raw_path``
-        # keeps the caller's bytes exactly as given.
-        raw = urlsplit(info.url)
-
-        # ``query_parameters`` append rather than replace, so a URL carrying
-        # ``filter=region&filter=status`` plus ``{"filter": "tenant"}`` sends all three,
-        # matching the .NET handler. Client-level params are defaults only: they apply
-        # for a key absent from both request-level sources.
-        explicit_pairs = [(key, value) for key, value in info.query_parameters.items() if key]
-        request_keys = {key for key, _ in parse_qsl(raw.query, keep_blank_values=True)}
-        request_keys.update(key for key, _ in explicit_pairs)
+        # Selected-client params remain defaults for keys absent from the workflow's
+        # composed query. They are host configuration, unavailable before selection.
+        request_keys = {key for key, _ in parse_qsl(url.query.decode("ascii"), keep_blank_values=True)}
         client_defaults = [(key, value) for key, value in client.params.multi_items() if key not in request_keys]
-
-        query_segments: list[str] = []
-        if raw.query:
-            query_segments.append(raw.query)
-        # ``quote_via=quote`` keeps spaces as ``%20`` instead of ``+``, so appended
-        # parameters are encoded the same way the preserved URL query is.
-        for pairs in (explicit_pairs, client_defaults):
-            if pairs:
-                query_segments.append(urlencode(pairs, quote_via=quote))
-        query = "&".join(segment for segment in query_segments if segment)
+        if client_defaults:
+            encoded_query = url.query + (b"&" if url.query else b"")
+            encoded_query += urlencode(client_defaults, quote_via=quote).encode("ascii")
+            url = url.copy_with(query=encoded_query)
 
         # Build without the query so the client's params merge has nothing to clobber --
         # it drops the URL's query outright -- then overwrite the query httpx composed
         # with ours. The fragment stays on the built URL; httpx does not send it.
         request = client.build_request(
             method=info.method,
-            url=urlunsplit((raw.scheme, raw.netloc, raw.path, "", raw.fragment)),
+            url=url.copy_with(query=None),
             headers=headers or None,
             content=content,
             timeout=timeout,
         )
-        # Reuse httpx's own path encoding and replace only the query part of ``raw_path``.
-        raw_path = request.url.raw_path.split(b"?", 1)[0]
-        if query:
-            raw_path += b"?" + _encode_query(query)
-        request.url = request.url.copy_with(raw_path=raw_path)
+        request.url = url
 
         response = await client.send(request)
 

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_powerfx_functions.py

@@ -455,7 +455,9 @@ def search_table(table: Any, value: Any, column: str) -> list[Any]:
         return []
 
     results: list[Any] = []
-    search_value = str(value).lower() if value else ""
+    # Only Blank (None) and "" mean "no search value, return every row"; a
+    # falsy 0 or False is still the value the caller asked to match.
+    search_value = str(value).lower() if value is not None else ""
 
     for item in cast(list[Any], table):
         item_value: Any = None

agent_framework_declarative-1.2.1/agent_framework_declarative/_workflows/_powerfx_limits.py

@@ -0,0 +1,76 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+"""Structural budgets for state copying and PowerFx symbol conversion.
+
+Each traversal has its own budget and rejects cycles or excess with ValueError,
+rather than truncating values. These limits do not bound expression execution
+or application-defined Python copy/conversion hooks.
+"""
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any, cast
+
+_MAX_POWERFX_STATE_DEPTH = 64
+_MAX_POWERFX_STATE_NODES = 10_000
+_MAX_POWERFX_STATE_TEXT_SIZE = 1_048_576
+
+
+class _PowerFxStateLimitError(ValueError):
+    """State cannot be copied or marshalled within the PowerFx budget."""
+
+
+@dataclass
+class _PowerFxStateBudget:
+    """Count values, containers, and mapping keys, including repeated aliases.
+
+    Depth starts at zero. Text size counts string characters and binary bytes,
+    not encoded size or total memory.
+    """
+
+    nodes: int = 0
+    text_size: int = 0
+
+    def consume(self, item: Any, depth: int) -> None:
+        self.nodes += 1
+        if self.nodes > _MAX_POWERFX_STATE_NODES:
+            raise _PowerFxStateLimitError("PowerFx state exceeds the node budget")
+        if depth > _MAX_POWERFX_STATE_DEPTH:
+            raise _PowerFxStateLimitError("PowerFx state exceeds the depth budget")
+        if isinstance(item, (str, bytes, bytearray)):
+            self.text_size += len(item)
+            if self.text_size > _MAX_POWERFX_STATE_TEXT_SIZE:
+                raise _PowerFxStateLimitError("PowerFx state exceeds the text size budget")
+
+
+def _validate_powerfx_state(value: Any) -> None:  # pyright: ignore[reportUnusedFunction]
+    """Reject cyclic or over-budget data before copying or conversion."""
+    budget = _PowerFxStateBudget()
+    active: set[int] = set()
+
+    def visit(item: Any, depth: int) -> None:
+        budget.consume(item, depth)
+        if item is None or isinstance(item, (str, bytes, bytearray, bool, int, float)):
+            return
+
+        identity = id(item)
+        if identity in active:
+            raise _PowerFxStateLimitError("PowerFx state contains a cycle")
+        active.add(identity)
+        try:
+            if isinstance(item, Enum):
+                visit(item.value, depth + 1)
+            elif isinstance(item, Mapping):
+                for key, member in cast(Mapping[Any, Any], item).items():
+                    visit(key, depth + 1)
+                    visit(member, depth + 1)
+            elif isinstance(item, (list, tuple, set, frozenset)):
+                for member in cast(list[Any] | tuple[Any, ...] | set[Any] | frozenset[Any], item):
+                    visit(member, depth + 1)
+            elif hasattr(item, "__dict__"):
+                visit(vars(item), depth + 1)
+        finally:
+            active.remove(identity)
+
+    visit(value, 0)

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/agent_framework_declarative/_workflows/_state.py

@@ -16,6 +16,9 @@ import uuid
 from collections.abc import Mapping
 from typing import Any, cast
 
+from ._powerfx_limits import _PowerFxStateLimitError, _validate_powerfx_state  # pyright: ignore[reportPrivateUsage]
+from ._state_path import _is_safe_path_segment  # pyright: ignore[reportPrivateUsage]
+
 try:
     from powerfx import Engine
 
@@ -29,7 +32,10 @@ logger = logging.getLogger("agent_framework.declarative")
 
 
 class WorkflowState:
-    """Manages variables and state during declarative workflow execution.
+    """Manages standalone workflow state and expression evaluation.
+
+    Workflows created by ``WorkflowFactory`` use a separate, checkpoint-backed
+    ``DeclarativeWorkflowState`` implementation.
 
     WorkflowState provides a unified interface for:
 
@@ -105,6 +111,7 @@ class WorkflowState:
             inputs: Initial inputs to the workflow. These become available
                    as Workflow.Inputs.* and are immutable after initialization.
         """
+        _validate_powerfx_state(inputs)
         self._inputs: dict[str, Any] = dict(inputs) if inputs else {}
         self._local: dict[str, Any] = {}
         self._outputs: dict[str, Any] = {}
@@ -158,12 +165,16 @@ class WorkflowState:
     def get(self, path: str, default: Any = None) -> Any:
         """Get a value from the state using a dot-notated path.
 
+        Dict-keyed segments may use arbitrary string keys. Segments resolved
+        through object-attribute access must match ``[A-Za-z][A-Za-z0-9_]*``;
+        other shapes return ``default`` without accessing the attribute.
+
         Args:
             path: Dot-notated path like 'Local.results' or 'Workflow.Inputs.query'
             default: Default value if path doesn't exist
 
         Returns:
-            The value at the path, or default if not found
+            The value at the path, or default if not found or unreachable
         """
         parts = path.split(".")
         if not parts:
@@ -203,10 +214,18 @@ class WorkflowState:
                 obj = obj_dict.get(part, default)
                 if obj is default:
                     return default
-            elif hasattr(obj, part):
-                obj = getattr(obj, part)
             else:
-                return default
+                if not _is_safe_path_segment(part):
+                    logger.warning(
+                        "WorkflowState.get: rejecting attribute segment %r in path %r",
+                        part,
+                        path,
+                    )
+                    return default
+                if hasattr(obj, part):
+                    obj = getattr(obj, part)
+                else:
+                    return default
 
         return obj
 
@@ -329,7 +348,19 @@ class WorkflowState:
 
         Returns:
             A dictionary suitable for passing to PowerFx Engine.eval()
+
+        Raises:
+            ValueError: If the state or projected symbols exceed the PowerFx state budget.
         """
+        _validate_powerfx_state({
+            "Inputs": self._inputs,
+            "Outputs": self._outputs,
+            "Local": self._local,
+            "System": self._system,
+            "Agent": self._agent,
+            "Conversation": self._conversation,
+            "Custom": self._custom,
+        })
         symbols = {
             "Workflow": {
                 "Inputs": dict(self._inputs),
@@ -345,24 +376,31 @@ class WorkflowState:
         }
         # Debug log the Local symbols to help diagnose type issues
         if self._local:
-            for key, value in self._local.items():
+            for value in self._local.values():
                 logger.debug(
-                    f"PowerFx symbol Local.{key}: type={type(value).__name__}, "
-                    f"value_preview={str(value)[:100] if value else None}"
+                    "PowerFx Local symbol type=%s",
+                    type(value).__name__,
                 )
+        _validate_powerfx_state(symbols)
         return symbols
 
     def eval(self, expression: str) -> Any:
         """Evaluate a PowerFx expression with the current state.
 
         Expressions starting with '=' are evaluated as PowerFx.
-        Other strings are returned as-is (after variable interpolation if applicable).
+        Other strings are returned as-is. If PowerFx is unavailable or raises
+        an ordinary evaluation error, the simple evaluator is used instead.
+        Its state references follow :meth:`get`'s object-member rules.
+        State-budget errors propagate without falling back.
 
         Args:
             expression: The expression to evaluate
 
         Returns:
             The evaluated result, or the original expression if not a PowerFx expression
+
+        Raises:
+            ValueError: If symbol construction exceeds the PowerFx state budget.
         """
         if not expression:
             return expression
@@ -378,6 +416,8 @@ class WorkflowState:
             try:
                 symbols = self.to_powerfx_symbols()
                 return _powerfx_engine.eval(formula, symbols=symbols)
+            except _PowerFxStateLimitError:
+                raise
             except Exception as exc:
                 logger.warning(f"PowerFx evaluation failed for '{expression[:50]}': {exc}")
                 # Fall through to simple evaluation

agent_framework_declarative-1.2.1/agent_framework_declarative/_workflows/_state_path.py

@@ -0,0 +1,12 @@
+# Copyright (c) Microsoft. All rights reserved.
+
+"""Shared identifier policy for object-attribute steps in workflow state paths."""
+
+import regex
+
+_SAFE_PATH_SEGMENT_RE = regex.compile(r"[A-Za-z][A-Za-z0-9_]*")
+
+
+def _is_safe_path_segment(segment: str) -> bool:  # pyright: ignore[reportUnusedFunction]
+    """Return whether an object-attribute segment is a declarative identifier."""
+    return _SAFE_PATH_SEGMENT_RE.fullmatch(segment) is not None

{agent_framework_declarative-1.1.0 → agent_framework_declarative-1.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ description = "Declarative specification support for Microsoft Agent Framework."
 authors = [{ name = "Microsoft", email = "af-support@microsoft.com"}]
 readme = "README.md"
 requires-python = ">=3.10"
-version = "1.1.0"
+version = "1.2.1"
 license-files = ["LICENSE"]
 urls.homepage = "https://aka.ms/agent-framework"
 urls.source = "https://github.com/microsoft/agent-framework/tree/main/python"
@@ -22,7 +22,7 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-    "agent-framework-core>=1.19.0,<2",
+    "agent-framework-core>=1.20.0,<2",
     "httpx>=0.27,<1",
     "powerfx>=0.0.32,<0.0.35; python_version < '3.14'",
     "pyyaml>=6.0,<7.0",