agentapprovalprotocol 0.3.1__tar.gz → 0.3.2__tar.gz

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentapprovalprotocol
-Version: 0.3.1
+Version: 0.3.2
 Summary: Put an AI agent's tool calls behind an Agent Approval Protocol (AAP) approval provider.
 Project-URL: Homepage, https://agentapprovalprotocol.io
 Project-URL: Source, https://github.com/agentapprovalprotocol/agentapprovalprotocol

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentapprovalprotocol"
-version = "0.3.1"
+version = "0.3.2"
 description = "Put an AI agent's tool calls behind an Agent Approval Protocol (AAP) approval provider."
 readme = "README.md"
 license = "Apache-2.0"

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.2}/src/agentapprovalprotocol/langgraph.py

@@ -13,11 +13,13 @@ Install with ``pip install "agentapprovalprotocol[langgraph]"``.
 from __future__ import annotations
 
 import asyncio
+import contextvars
 from typing import Any, Awaitable, Callable, Iterable, Literal, Mapping, Sequence
 
 from langchain.agents.middleware import AgentMiddleware
 from langchain_core.messages import AIMessage, ToolMessage
 from langchain_core.runnables.config import var_child_runnable_config
+from langgraph.errors import GraphBubbleUp
 from langgraph.prebuilt.tool_node import ToolCallRequest
 from langgraph.types import Command, interrupt
 
@@ -27,6 +29,15 @@ from ._wire import Request
 
 INTERRUPT_KEY = "aap_request_id"
 
+# Set while an approved tool runs. A call made inside it, such as one by an
+# agent the tool invokes, waits instead of pausing: on resume LangGraph would
+# run the outer tool again, and its approval is already consumed.
+_running = contextvars.ContextVar("aap_running_tool", default=False)
+
+# Deep Agents' delegation tool. It changes nothing itself, so once every
+# subagent is gated it runs without approval, and its subagents can pause.
+DEEP_AGENTS_TASK_TOOL = "task"
+
 Handler = Callable[[ToolCallRequest], "ToolMessage | Command"]
 AsyncHandler = Callable[[ToolCallRequest], Awaitable["ToolMessage | Command"]]
 
@@ -103,6 +114,7 @@ class ApprovalMiddleware(AgentMiddleware):
         self._async_gate = async_gate
         self._make = lambda client_cls, gate_cls: gate_cls(client_cls(base_url, token), mode=mode, **gate_options)
         self.mode = mode
+        self._ungated: set[str] = set()
 
     @property
     def gate(self) -> Gate:
@@ -132,9 +144,11 @@ class ApprovalMiddleware(AgentMiddleware):
             context=self.context,
             resume=resume,
         )
-        return call, thread is not None
+        return call, thread is not None and not _running.get()
 
     def wrap_tool_call(self, request: ToolCallRequest, handler: Handler) -> ToolMessage | Command:
+        if request.tool_call["name"] in self._ungated:
+            return handler(request)
         call, can_pause = self._call(request)
         verdict: Verdict = self.gate.check(call, can_pause=can_pause)
         while isinstance(verdict, Pending):
@@ -142,17 +156,24 @@ class ApprovalMiddleware(AgentMiddleware):
             verdict = self.gate.check(call, can_pause=can_pause)
         if isinstance(verdict, Deny):
             return _denied(request, verdict)
+        running = _running.set(True)
         try:
             result = handler(request)
+        except GraphBubbleUp:
+            raise  # an interrupt or a command for the parent graph, not a failure
         except BaseException:
             if self.gate.report_outcomes:
                 verdict.report("failed")
             raise
+        finally:
+            _running.reset(running)
         if self.gate.report_outcomes:
             verdict.report("failed" if _failed(result) else "succeeded")
         return result
 
     async def awrap_tool_call(self, request: ToolCallRequest, handler: AsyncHandler) -> ToolMessage | Command:
+        if request.tool_call["name"] in self._ungated:
+            return await handler(request)
         call, can_pause = self._call(request)
         verdict: Verdict = await self.async_gate.check(call, can_pause=can_pause)
         while isinstance(verdict, Pending):
@@ -161,12 +182,17 @@ class ApprovalMiddleware(AgentMiddleware):
         if isinstance(verdict, Deny):
             return _denied(request, verdict)
         assert isinstance(verdict, Allow)
+        running = _running.set(True)
         try:
             result = await handler(request)
+        except GraphBubbleUp:
+            raise  # an interrupt or a command for the parent graph, not a failure
         except BaseException:
             if self.async_gate.report_outcomes:
                 await verdict.report("failed")
             raise
+        finally:
+            _running.reset(running)
         if self.async_gate.report_outcomes:
             await verdict.report("failed" if _failed(result) else "succeeded")
         return result
@@ -242,6 +268,11 @@ def deep_agent_subagents(middleware: ApprovalMiddleware, subagents: Sequence[Map
     the default general-purpose subagent with the same spec plus approvals.
     Compiled and async subagents run their own graphs and are refused: add
     the middleware to those graphs yourself.
+
+    With every subagent gated, the middleware stops gating the ``task`` tool
+    that delegates to them. ``task`` changes nothing itself, and gating it
+    would stop its subagents' calls from pausing: on resume LangGraph runs
+    ``task`` again, and its approval would already be consumed.
     """
     from deepagents.middleware.subagents import GENERAL_PURPOSE_SUBAGENT
 
@@ -252,4 +283,5 @@ def deep_agent_subagents(middleware: ApprovalMiddleware, subagents: Sequence[Map
         out.append({**spec, "middleware": [*spec.get("middleware", []), middleware]})
     if not any(spec.get("name") == GENERAL_PURPOSE_SUBAGENT["name"] for spec in out):
         out.append({**GENERAL_PURPOSE_SUBAGENT, "middleware": [middleware]})
+    middleware._ungated.add(DEEP_AGENTS_TASK_TOOL)
     return out

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.2}/tests/test_langgraph.py

@@ -150,7 +150,75 @@ def test_deep_agent_subagent_calls_are_gated():
     graph = create_deep_agent(model=model, tools=[refund], middleware=[middleware], subagents=deep_agent_subagents(middleware))
     graph.invoke({"messages": [HumanMessage("Refund payment_123")]})
     assert ran == [{"payment_id": "payment_123", "amount": 4900}]
-    assert sorted(s.body["tool"] for s in provider.requests.values()) == ["refund", "task"]
+    # task only delegates; the subagent's own call is the one sent for approval.
+    assert [s.body["tool"] for s in provider.requests.values()] == ["refund"]
+
+
+@pytest.mark.skipif(sys.version_info < (3, 11), reason="Deep Agents needs Python 3.11")
+def test_deep_agent_subagent_calls_pause_in_async_mode():
+    from deepagents import create_deep_agent
+
+    provider = FakeProvider(auto=None)
+    middleware = ApprovalMiddleware(gate=Gate(provider.client(), mode="async"), async_gate=AsyncGate(provider.async_client(), mode="async"))
+    model = Scripted(
+        messages=iter(
+            [
+                turn(("t1", "task", {"description": "Refund payment_123", "subagent_type": "general-purpose"})),
+                turn(REFUND),
+                AIMessage("Refunded."),
+                AIMessage("The subagent refunded it."),
+            ]
+        )
+    )
+    graph = create_deep_agent(model=model, tools=[refund], middleware=[middleware], subagents=deep_agent_subagents(middleware), checkpointer=InMemorySaver())
+    config = {"configurable": {"thread_id": "t3"}}
+    paused = graph.invoke({"messages": [HumanMessage("Refund payment_123")]}, config)
+    (pending,) = paused["__interrupt__"]
+    assert pending.value["tool"] == "refund" and ran == []
+
+    provider.decide(pending.value["aap_request_id"])
+    receiver = Receiver(secret=SECRET, client=provider.async_client(), resumers={"langgraph": resumer(graph)})
+    assert asyncio.run(receiver.wake(pending.value["aap_request_id"]))
+    # task runs again on resume, and the subagent continues from its own checkpoint.
+    assert ran == [{"payment_id": "payment_123", "amount": 4900}]
+    assert [(s.body["tool"], s.outcome["status"]) for s in provider.requests.values()] == [("refund", "succeeded")]
+    state = graph.get_state(config)
+    assert not state.interrupts and state.values["messages"][-1].content == "The subagent refunded it."
+
+
+def test_calls_inside_a_running_tool_wait_in_async_mode():
+    provider = FakeProvider(auto=None)
+    middleware = ApprovalMiddleware(gate=Gate(provider.client(), mode="async"), async_gate=AsyncGate(provider.async_client(), mode="async"))
+    inner = create_agent(Scripted(messages=iter([turn(REFUND), AIMessage("Refunded.")])), tools=[refund], middleware=[middleware])
+
+    def billing(request: str) -> str:
+        """Ask the billing agent to do something."""
+        return inner.invoke({"messages": [HumanMessage(request)]})["messages"][-1].content
+
+    def approve_the_waiting_refund(request):
+        if request.method == "GET":
+            for stored in provider.requests.values():
+                if stored.body["tool"] == "refund":
+                    provider._decide(stored, "approved", None)
+
+    provider.intercept = approve_the_waiting_refund
+    outer = create_agent(
+        Scripted(messages=iter([turn(("b1", "billing", {"request": "Refund payment_123"})), AIMessage("Billing refunded it.")])),
+        tools=[billing],
+        middleware=[middleware],
+        checkpointer=InMemorySaver(),
+    )
+    config = {"configurable": {"thread_id": "t4"}}
+    (pending,) = outer.invoke({"messages": [HumanMessage("Refund payment_123")]}, config)["__interrupt__"]
+    assert pending.value["tool"] == "billing"
+
+    provider.decide(pending.value["aap_request_id"])
+    receiver = Receiver(secret=SECRET, client=provider.async_client(), resumers={"langgraph": resumer(outer)})
+    assert asyncio.run(receiver.wake(pending.value["aap_request_id"]))
+    # The refund waited inside the approved billing call: pausing would run billing again, refused as consumed.
+    assert ran == [{"payment_id": "payment_123", "amount": 4900}]
+    assert sorted((s.body["tool"], s.outcome["status"]) for s in provider.requests.values()) == [("billing", "succeeded"), ("refund", "succeeded")]
+    assert outer.get_state(config).values["messages"][-1].content == "Billing refunded it."
 
 
 @pytest.mark.skipif(sys.version_info < (3, 11), reason="Deep Agents needs Python 3.11")

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.2}/uv.lock

@@ -27,7 +27,7 @@ constraints = [{ name = "onnxruntime", marker = "python_full_version < '3.11'",
 
 [[package]]
 name = "agentapprovalprotocol"
-version = "0.3.1"
+version = "0.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },