agentapprovalprotocol 0.3.1__tar.gz → 0.3.3__tar.gz

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentapprovalprotocol
-Version: 0.3.1
+Version: 0.3.3
 Summary: Put an AI agent's tool calls behind an Agent Approval Protocol (AAP) approval provider.
 Project-URL: Homepage, https://agentapprovalprotocol.io
 Project-URL: Source, https://github.com/agentapprovalprotocol/agentapprovalprotocol

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentapprovalprotocol"
-version = "0.3.1"
+version = "0.3.3"
 description = "Put an AI agent's tool calls behind an Agent Approval Protocol (AAP) approval provider."
 readme = "README.md"
 license = "Apache-2.0"

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/src/agentapprovalprotocol/_gate.py

@@ -117,7 +117,7 @@ def _settled(request: Request) -> Deny | None:
     """The deny for a terminal request, or None when it may be consumed."""
     if request.status == DENIED:
         note = request.decision.note if request.decision else None
-        return Deny(f"The AAP provider denied this call: {note}" if note else "The AAP provider denied this call.", DENIED, request.id)
+        return Deny(f"A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: {note}" if note else "A reviewer at the AAP (Agent Approval Protocol) provider denied this call.", DENIED, request.id)
     if request.status == CANCELLED:
         return Deny(CANCELLED_TEXT, CANCELLED, request.id)
     if request.status == EXPIRED:

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/src/agentapprovalprotocol/langgraph.py

@@ -13,11 +13,13 @@ Install with ``pip install "agentapprovalprotocol[langgraph]"``.
 from __future__ import annotations
 
 import asyncio
+import contextvars
 from typing import Any, Awaitable, Callable, Iterable, Literal, Mapping, Sequence
 
 from langchain.agents.middleware import AgentMiddleware
 from langchain_core.messages import AIMessage, ToolMessage
 from langchain_core.runnables.config import var_child_runnable_config
+from langgraph.errors import GraphBubbleUp
 from langgraph.prebuilt.tool_node import ToolCallRequest
 from langgraph.types import Command, interrupt
 
@@ -27,6 +29,15 @@ from ._wire import Request
 
 INTERRUPT_KEY = "aap_request_id"
 
+# Set while an approved tool runs. A call made inside it, such as one by an
+# agent the tool invokes, waits instead of pausing: on resume LangGraph would
+# run the outer tool again, and its approval is already consumed.
+_running = contextvars.ContextVar("aap_running_tool", default=False)
+
+# Deep Agents' delegation tool. It changes nothing itself, so once every
+# subagent is gated it runs without approval, and its subagents can pause.
+DEEP_AGENTS_TASK_TOOL = "task"
+
 Handler = Callable[[ToolCallRequest], "ToolMessage | Command"]
 AsyncHandler = Callable[[ToolCallRequest], Awaitable["ToolMessage | Command"]]
 
@@ -103,6 +114,7 @@ class ApprovalMiddleware(AgentMiddleware):
         self._async_gate = async_gate
         self._make = lambda client_cls, gate_cls: gate_cls(client_cls(base_url, token), mode=mode, **gate_options)
         self.mode = mode
+        self._ungated: set[str] = set()
 
     @property
     def gate(self) -> Gate:
@@ -132,9 +144,11 @@ class ApprovalMiddleware(AgentMiddleware):
             context=self.context,
             resume=resume,
         )
-        return call, thread is not None
+        return call, thread is not None and not _running.get()
 
     def wrap_tool_call(self, request: ToolCallRequest, handler: Handler) -> ToolMessage | Command:
+        if request.tool_call["name"] in self._ungated:
+            return handler(request)
         call, can_pause = self._call(request)
         verdict: Verdict = self.gate.check(call, can_pause=can_pause)
         while isinstance(verdict, Pending):
@@ -142,17 +156,24 @@ class ApprovalMiddleware(AgentMiddleware):
             verdict = self.gate.check(call, can_pause=can_pause)
         if isinstance(verdict, Deny):
             return _denied(request, verdict)
+        running = _running.set(True)
         try:
             result = handler(request)
+        except GraphBubbleUp:
+            raise  # an interrupt or a command for the parent graph, not a failure
         except BaseException:
             if self.gate.report_outcomes:
                 verdict.report("failed")
             raise
+        finally:
+            _running.reset(running)
         if self.gate.report_outcomes:
             verdict.report("failed" if _failed(result) else "succeeded")
         return result
 
     async def awrap_tool_call(self, request: ToolCallRequest, handler: AsyncHandler) -> ToolMessage | Command:
+        if request.tool_call["name"] in self._ungated:
+            return await handler(request)
         call, can_pause = self._call(request)
         verdict: Verdict = await self.async_gate.check(call, can_pause=can_pause)
         while isinstance(verdict, Pending):
@@ -161,12 +182,17 @@ class ApprovalMiddleware(AgentMiddleware):
         if isinstance(verdict, Deny):
             return _denied(request, verdict)
         assert isinstance(verdict, Allow)
+        running = _running.set(True)
         try:
             result = await handler(request)
+        except GraphBubbleUp:
+            raise  # an interrupt or a command for the parent graph, not a failure
         except BaseException:
             if self.async_gate.report_outcomes:
                 await verdict.report("failed")
             raise
+        finally:
+            _running.reset(running)
         if self.async_gate.report_outcomes:
             await verdict.report("failed" if _failed(result) else "succeeded")
         return result
@@ -242,6 +268,11 @@ def deep_agent_subagents(middleware: ApprovalMiddleware, subagents: Sequence[Map
     the default general-purpose subagent with the same spec plus approvals.
     Compiled and async subagents run their own graphs and are refused: add
     the middleware to those graphs yourself.
+
+    With every subagent gated, the middleware stops gating the ``task`` tool
+    that delegates to them. ``task`` changes nothing itself, and gating it
+    would stop its subagents' calls from pausing: on resume LangGraph runs
+    ``task`` again, and its approval would already be consumed.
     """
     from deepagents.middleware.subagents import GENERAL_PURPOSE_SUBAGENT
 
@@ -252,4 +283,5 @@ def deep_agent_subagents(middleware: ApprovalMiddleware, subagents: Sequence[Map
         out.append({**spec, "middleware": [*spec.get("middleware", []), middleware]})
     if not any(spec.get("name") == GENERAL_PURPOSE_SUBAGENT["name"] for spec in out):
         out.append({**GENERAL_PURPOSE_SUBAGENT, "middleware": [middleware]})
+    middleware._ungated.add(DEEP_AGENTS_TASK_TOOL)
     return out

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_adk.py

@@ -119,7 +119,7 @@ async def test_denied_call_returns_the_reason_to_the_model():
     runner, _ = build(provider, LlmAgent(name="support", model=Scripted(turn(REFUND), say("Understood.")), tools=[refund]))
     _, events = await start(runner)
     assert ran == []
-    assert responses(events, "refund") == [{"error": "The AAP provider denied this call."}]
+    assert responses(events, "refund") == [{"error": "A reviewer at the AAP (Agent Approval Protocol) provider denied this call."}]
     assert last_text(events) == "Understood."
 
 
@@ -204,7 +204,7 @@ async def test_async_denial_wakes_and_returns_the_reason():
     await resumer(runner)(provider.only().body["context"]["resume"], await provider.async_client().get(request_id))
     events = await session_events(runner, session_id)
     assert ran == []
-    assert responses(events, "refund")[-1] == {"error": "The AAP provider denied this call: Not this one."}
+    assert responses(events, "refund")[-1] == {"error": "A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Not this one."}
     assert last_text(events) == "Understood."
 
 
@@ -312,7 +312,7 @@ async def test_invented_tool_names_are_gated():
     runner, _ = build(provider, LlmAgent(name="support", model=Scripted(turn(("c1", "wire_money", {"to": "x"})), say("Ok.")), tools=[refund]))
     _, events = await start(runner)
     assert provider.only().body["tool"] == "wire_money"
-    assert responses(events, "wire_money") == [{"error": "The AAP provider denied this call."}]
+    assert responses(events, "wire_money") == [{"error": "A reviewer at the AAP (Agent Approval Protocol) provider denied this call."}]
 
 
 async def test_gemini_built_in_tools_are_refused():

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_claude_agent_sdk.py

@@ -198,7 +198,7 @@ async def test_denied_call_returns_the_reason_to_the_model(cli):
     (result,) = await run(hooks(provider).options(base))
     assert ran == [] and result.result == "Understood."
     (denied,) = api.tool_results()
-    assert denied["is_error"] and "The AAP provider denied this call." in json.dumps(denied["content"])
+    assert denied["is_error"] and "A reviewer at the AAP (Agent Approval Protocol) provider denied this call." in json.dumps(denied["content"])
 
 
 @needs_cli

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_crewai.py

@@ -157,7 +157,7 @@ def test_denied_call_returns_the_reason_to_the_model():
     hooks(provider)
     crew(llm)[0].kickoff()
     assert ran == []
-    assert llm.tool_results() == ["The AAP provider denied this call: Not this one."]
+    assert llm.tool_results() == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Not this one."]
 
 
 def test_text_tool_calls_are_gated():
@@ -166,7 +166,7 @@ def test_text_tool_calls_are_gated():
     hooks(provider)
     out = crew(llm)[0].kickoff()
     assert ran == [] and out.raw == "Not refunded."
-    assert "The AAP provider denied this call." in llm.tool_results()[-1]
+    assert "A reviewer at the AAP (Agent Approval Protocol) provider denied this call." in llm.tool_results()[-1]
 
     provider.auto = "approved"
     llm = Scripted(model="scripted", native=False, turns=[react("refund", REFUND[2]), "Thought: done\nFinal Answer: Refunded."])
@@ -204,7 +204,7 @@ def test_parallel_calls_get_their_own_decisions():
     hooks(provider)
     crew(llm)[0].kickoff()
     assert ran == [{"payment_id": "payment_456", "amount": 100}]
-    assert sorted(llm.tool_results()) == ["The AAP provider denied this call: Too large.", "refunded payment_456"]
+    assert sorted(llm.tool_results()) == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Too large.", "refunded payment_456"]
     assert len(provider.requests) == 2
 
 
@@ -223,7 +223,7 @@ def test_delegated_coworker_calls_are_gated():
     Crew(agents=[lead, billing], tasks=[task]).kickoff()
     assert ran == []
     assert sorted(s.body["tool"] for s in provider.requests.values()) == ["delegate_work_to_coworker", "refund"]
-    assert billing_llm.tool_results() == ["The AAP provider denied this call: No refunds today."]
+    assert billing_llm.tool_results() == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: No refunds today."]
     assert "The refund was denied." in lead_llm.tool_results()[0]
     delegated = next(s for s in provider.requests.values() if s.body["tool"] == "delegate_work_to_coworker")
     assert delegated.outcome["status"] == "succeeded"
@@ -235,7 +235,7 @@ def test_agent_kickoff_is_gated():
     hooks(provider)
     Agent(role="Support", goal="Refunds", backstory="b", llm=llm, tools=[refund]).kickoff("Refund payment_123")
     assert ran == [] and len(provider.requests) == 1
-    assert llm.tool_results() == ["The AAP provider denied this call."]
+    assert llm.tool_results() == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call."]
 
 
 def test_mcp_tools_send_the_server_and_original_name():

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_gate.py

@@ -42,7 +42,7 @@ def test_denial_carries_the_reviewers_note():
     provider.decide(pending.request_id, "denied", "Refunds over 40 GBP need a manager.")
     verdict = gate.check(call())
     assert isinstance(verdict, Deny) and verdict.status == "denied"
-    assert verdict.reason == "The AAP provider denied this call: Refunds over 40 GBP need a manager."
+    assert verdict.reason == "A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Refunds over 40 GBP need a manager."
 
 
 def test_same_call_cannot_run_twice_across_replicas():

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_langgraph.py

@@ -67,7 +67,7 @@ def test_denied_call_returns_the_reason_to_the_model():
     result = agent(provider, turn(REFUND), AIMessage("Understood.")).invoke({"messages": [HumanMessage("Refund it")]})
     assert ran == []
     message = next(m for m in result["messages"] if isinstance(m, ToolMessage))
-    assert message.status == "error" and message.content == "The AAP provider denied this call."
+    assert message.status == "error" and message.content == "A reviewer at the AAP (Agent Approval Protocol) provider denied this call."
 
 
 def test_async_mode_pauses_ignores_forged_resumes_and_wakes_on_the_decision():
@@ -150,7 +150,75 @@ def test_deep_agent_subagent_calls_are_gated():
     graph = create_deep_agent(model=model, tools=[refund], middleware=[middleware], subagents=deep_agent_subagents(middleware))
     graph.invoke({"messages": [HumanMessage("Refund payment_123")]})
     assert ran == [{"payment_id": "payment_123", "amount": 4900}]
-    assert sorted(s.body["tool"] for s in provider.requests.values()) == ["refund", "task"]
+    # task only delegates; the subagent's own call is the one sent for approval.
+    assert [s.body["tool"] for s in provider.requests.values()] == ["refund"]
+
+
+@pytest.mark.skipif(sys.version_info < (3, 11), reason="Deep Agents needs Python 3.11")
+def test_deep_agent_subagent_calls_pause_in_async_mode():
+    from deepagents import create_deep_agent
+
+    provider = FakeProvider(auto=None)
+    middleware = ApprovalMiddleware(gate=Gate(provider.client(), mode="async"), async_gate=AsyncGate(provider.async_client(), mode="async"))
+    model = Scripted(
+        messages=iter(
+            [
+                turn(("t1", "task", {"description": "Refund payment_123", "subagent_type": "general-purpose"})),
+                turn(REFUND),
+                AIMessage("Refunded."),
+                AIMessage("The subagent refunded it."),
+            ]
+        )
+    )
+    graph = create_deep_agent(model=model, tools=[refund], middleware=[middleware], subagents=deep_agent_subagents(middleware), checkpointer=InMemorySaver())
+    config = {"configurable": {"thread_id": "t3"}}
+    paused = graph.invoke({"messages": [HumanMessage("Refund payment_123")]}, config)
+    (pending,) = paused["__interrupt__"]
+    assert pending.value["tool"] == "refund" and ran == []
+
+    provider.decide(pending.value["aap_request_id"])
+    receiver = Receiver(secret=SECRET, client=provider.async_client(), resumers={"langgraph": resumer(graph)})
+    assert asyncio.run(receiver.wake(pending.value["aap_request_id"]))
+    # task runs again on resume, and the subagent continues from its own checkpoint.
+    assert ran == [{"payment_id": "payment_123", "amount": 4900}]
+    assert [(s.body["tool"], s.outcome["status"]) for s in provider.requests.values()] == [("refund", "succeeded")]
+    state = graph.get_state(config)
+    assert not state.interrupts and state.values["messages"][-1].content == "The subagent refunded it."
+
+
+def test_calls_inside_a_running_tool_wait_in_async_mode():
+    provider = FakeProvider(auto=None)
+    middleware = ApprovalMiddleware(gate=Gate(provider.client(), mode="async"), async_gate=AsyncGate(provider.async_client(), mode="async"))
+    inner = create_agent(Scripted(messages=iter([turn(REFUND), AIMessage("Refunded.")])), tools=[refund], middleware=[middleware])
+
+    def billing(request: str) -> str:
+        """Ask the billing agent to do something."""
+        return inner.invoke({"messages": [HumanMessage(request)]})["messages"][-1].content
+
+    def approve_the_waiting_refund(request):
+        if request.method == "GET":
+            for stored in provider.requests.values():
+                if stored.body["tool"] == "refund":
+                    provider._decide(stored, "approved", None)
+
+    provider.intercept = approve_the_waiting_refund
+    outer = create_agent(
+        Scripted(messages=iter([turn(("b1", "billing", {"request": "Refund payment_123"})), AIMessage("Billing refunded it.")])),
+        tools=[billing],
+        middleware=[middleware],
+        checkpointer=InMemorySaver(),
+    )
+    config = {"configurable": {"thread_id": "t4"}}
+    (pending,) = outer.invoke({"messages": [HumanMessage("Refund payment_123")]}, config)["__interrupt__"]
+    assert pending.value["tool"] == "billing"
+
+    provider.decide(pending.value["aap_request_id"])
+    receiver = Receiver(secret=SECRET, client=provider.async_client(), resumers={"langgraph": resumer(outer)})
+    assert asyncio.run(receiver.wake(pending.value["aap_request_id"]))
+    # The refund waited inside the approved billing call: pausing would run billing again, refused as consumed.
+    assert ran == [{"payment_id": "payment_123", "amount": 4900}]
+    assert sorted((s.body["tool"], s.outcome["status"]) for s in provider.requests.values()) == [("billing", "succeeded"), ("refund", "succeeded")]
+    assert outer.get_state(config).values["messages"][-1].content == "Billing refunded it."
 
 
 @pytest.mark.skipif(sys.version_info < (3, 11), reason="Deep Agents needs Python 3.11")

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_openai_agents.py

@@ -90,7 +90,7 @@ async def test_denied_call_returns_the_reason_to_the_model():
     agent = approvals(provider).protect(Agent(name="support", model=model, tools=[refund]))
     await Runner.run(agent, "Refund it")
     assert ran == []
-    assert outputs(model) == ["The AAP provider denied this call."]
+    assert outputs(model) == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call."]
 
 
 async def test_a_replayed_call_does_not_run_again():
@@ -181,7 +181,7 @@ async def test_async_mode_denial_returns_the_reason():
     receiver = Receiver(secret=SECRET, client=provider.async_client(), resumers={"openai-agents": gate.resumer(agent)})
     assert await receiver.wake(stored.id)
     assert ran == [] and model.remaining_steps == 0
-    assert outputs(model) == ["The AAP provider denied this call: Not today."]
+    assert outputs(model) == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Not today."]
 
 
 async def test_parallel_calls_wait_for_their_own_decisions():
@@ -204,7 +204,7 @@ async def test_parallel_calls_wait_for_their_own_decisions():
     await receiver.wake(ids["payment_123"])
     assert ran == [second]
     assert model.remaining_steps == 0
-    assert sorted(outputs(model)) == ["The AAP provider denied this call: Not this one.", "refunded payment_456"]
+    assert sorted(outputs(model)) == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call. Their note: Not this one.", "refunded payment_456"]
     assert len(provider.requests) == 2
 
 
@@ -341,7 +341,7 @@ async def test_local_mcp_denial_does_not_call_the_server():
     agent = approvals(provider).protect(Agent(name="support", model=model, mcp_servers=[crm]))
     await Runner.run(agent, "Update the contact")
     assert crm.calls == []
-    assert outputs(model) == ["The AAP provider denied this call."]
+    assert outputs(model) == ["A reviewer at the AAP (Agent Approval Protocol) provider denied this call."]
 
 
 @pytest.mark.parametrize("status", ["approved", "denied"])

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/tests/test_pydantic_ai.py

@@ -106,7 +106,7 @@ async def test_denied_call_returns_the_reason_to_the_model():
     result = await agent(provider, turn(REFUND), done("Understood.")).run("Refund it")
     assert ran == []
     (part,) = returns(result.all_messages())
-    assert part.outcome == "failed" and part.content == "The AAP provider denied this call."
+    assert part.outcome == "failed" and part.content == "A reviewer at the AAP (Agent Approval Protocol) provider denied this call."
     assert result.output == "Understood."
 
 

{agentapprovalprotocol-0.3.1 → agentapprovalprotocol-0.3.3}/uv.lock

@@ -27,7 +27,7 @@ constraints = [{ name = "onnxruntime", marker = "python_full_version < '3.11'",
 
 [[package]]
 name = "agentapprovalprotocol"
-version = "0.3.1"
+version = "0.3.3"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },