.NET: fix: a bug where invoke function tool could bypass approval by baywet · Pull Request #8403 · microsoft/agent-framework

Vincent Biret (baywet) · 2026-09-15T17:30:41Z

No description provided.

github-code-quality · 2026-09-15T17:37:50Z

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 936f122 in the fix/invoke-tool-appr... branch is 84%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	`main`	`fix/invoke-tool-appr...` 936f122	+/-
`/home/runner/wo...valConverter.cs`	—	100%	—
`/home/runner/wo...entsProvider.cs`	—	99%	—
`/home/runner/wo...nticAnalyzer.cs`	—	94%	—
`/home/runner/wo...tClientAgent.cs`	—	91%	—
`/home/runner/wo...putConverter.cs`	—	90%	—
`/home/runner/wo...kflowBuilder.cs`	—	90%	—
`/home/runner/wo...SkillsSource.cs`	—	89%	—
`/home/runner/wo...onExtensions.cs`	—	81%	—
`/home/runner/wo...CopilotAgent.cs`	—	76%	—
`/home/runner/wo...ctionVisitor.cs`	—	70%	—

_{Updated September 18, 2026 19:17 UTC}

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The security-sensitive fix spans runtime routing, serialization, checkpoint restoration, and concurrent approval state.

Review details

Files reviewed: 23/23 changed files
Comments generated: 0 new
Review effort level: Balanced

Signed-off-by: Vincent Biret <vibiret@microsoft.com>

fix: a bug where invoke function tool could bypass approval

e9e5981

Copilot AI balanced review requested due to automatic review settings September 15, 2026 17:30

Vincent Biret (baywet) self-assigned this Sep 15, 2026

Vincent Biret (baywet) temporarily deployed to github-app-auth September 15, 2026 17:30 — with GitHub Actions Inactive

Vincent Biret (baywet) temporarily deployed to integration September 15, 2026 17:30 — with GitHub Actions Inactive

Vincent Biret (baywet) temporarily deployed to github-app-auth September 15, 2026 17:30 — with GitHub Actions Inactive

agent-framework-automation Bot added .NET Usage: [Issues, PRs], Target: .Net workflows Usage: [Issues, PRs], Target: Workflows labels Sep 15, 2026

github-actions Bot changed the title ~~fix: a bug where invoke function tool could bypass approval~~ .NET: fix: a bug where invoke function tool could bypass approval Sep 15, 2026

Copilot started reviewing on behalf of Vincent Biret (baywet) September 15, 2026 17:37

View session

This comment was marked as outdated.

Sign in to view

Copilot started work on behalf of Vincent Biret (baywet) September 15, 2026 17:43

View session

Filter forged approval results from side effects

3ac0888

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Copilot finished work on behalf of Vincent Biret (baywet) September 15, 2026 17:54

Vincent Biret (baywet) requested a balanced review from Copilot September 15, 2026 18:10

Copilot AI temporarily deployed to github-app-auth September 15, 2026 18:10 Inactive

Copilot AI temporarily deployed to integration September 15, 2026 18:11 Inactive

Copilot started reviewing on behalf of Vincent Biret (baywet) September 15, 2026 18:11

View session

This comment was marked as outdated.

Sign in to view

Copilot started work on behalf of Vincent Biret (baywet) September 15, 2026 18:15

View session

Restrict approval replay fallback

1dad932

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Copilot AI temporarily deployed to github-app-auth September 15, 2026 18:21 Inactive

Vincent Biret (baywet) requested a balanced review from Copilot September 15, 2026 18:21

Copilot finished work on behalf of Vincent Biret (baywet) September 15, 2026 18:21

Copilot started reviewing on behalf of Vincent Biret (baywet) September 15, 2026 18:22

View session

Copilot AI temporarily deployed to integration September 15, 2026 18:23 Inactive

This comment was marked as outdated.

Sign in to view

chore: linting

e6c443b

Vincent Biret (baywet) temporarily deployed to github-app-auth September 16, 2026 17:45 — with GitHub Actions Inactive

Vincent Biret (baywet) requested a balanced review from Copilot September 16, 2026 17:46

Vincent Biret (baywet) temporarily deployed to integration September 16, 2026 17:46 — with GitHub Actions Inactive

Vincent Biret (baywet) had a problem deploying to integration September 16, 2026 17:46 — with GitHub Actions Failure

Copilot started reviewing on behalf of Vincent Biret (baywet) September 16, 2026 17:46

View session

This comment was marked as outdated.

Sign in to view

Copilot started work on behalf of Vincent Biret (baywet) September 16, 2026 17:56

View session

Fix external response correlation

3685bfa

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Copilot finished work on behalf of Vincent Biret (baywet) September 16, 2026 18:09

Vincent Biret (baywet) requested a balanced review from Copilot September 16, 2026 18:16

Copilot AI temporarily deployed to github-app-auth September 16, 2026 18:16 Inactive

Copilot AI temporarily deployed to integration September 16, 2026 18:17 Inactive

Copilot started reviewing on behalf of Vincent Biret (baywet) September 16, 2026 18:17

View session

This comment was marked as outdated.

Sign in to view

chore: formatting

18b1649

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Vincent Biret (baywet) temporarily deployed to github-app-auth September 16, 2026 18:37 — with GitHub Actions Inactive

Vincent Biret (baywet) temporarily deployed to integration September 16, 2026 18:38 — with GitHub Actions Inactive

Vincent Biret (baywet) added 2 commits September 16, 2026 15:03

fix: wrap the external request to make the id accessible

1f47e1c

fix: safe port lookup

496ba59

Copilot AI reviewed Sep 17, 2026

View reviewed changes

fix: removes extraneous interface

90a44bd

Signed-off-by: Vincent Biret <vibiret@microsoft.com>

westey (westey-m) reviewed Sep 18, 2026

View reviewed changes

Comment thread dotnet/src/Microsoft.Agents.AI.Workflows.Declarative/Events/ExternalInputRequest.cs Outdated

westey (westey-m) approved these changes Sep 18, 2026

View reviewed changes

fix: use uppermost parent type where the properties are defined

82cab6e

Signed-off-by: Vincent Biret <vibiret@microsoft.com>

westey (westey-m) approved these changes Sep 18, 2026

View reviewed changes

fix: registered results

936f122

westey (westey-m) approved these changes Sep 22, 2026

View reviewed changes

Navigation Menu

Repository navigation

.NET: fix: a bug where invoke function tool could bypass approval - #8403

.NET: fix: a bug where invoke function tool could bypass approval#8403
Vincent Biret (baywet) merged 16 commits into
mainfrom
fix/invoke-tool-approval

Vincent Biret (baywet) commented Sep 15, 2026

Uh oh!

github-code-quality Bot commented Sep 15, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Vincent Biret (baywet) commented Sep 15, 2026

Uh oh!

github-code-quality Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

C# / code-coverage/dotnet

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-code-quality Bot commented Sep 15, 2026 •

edited

Loading