Python: Extend hosted session scoping to approval handling

[eavanvalkenburg]

Motivation & Context

This change extends the hosted session scoping work in #6536 so that Foundry Hosting handles per-session state more consistently across multi-user and local scenarios. It aligns approval handling with the same session-ownership boundaries used for hosted workflow checkpoints, so related hosted state behaves predictably.

This PR is stacked on #6536 and depends on the HostedSessionContext / resolver primitives it introduces; it should merge after #6536.

Description & Review Guide

• What are the major changes?
  • Threads the resolved hosted session identity through the Foundry Hosting approval save/load path.
  • Reuses the HostedSessionContext, hosted_session_context_resolver, and strict_session_isolation hooks from Python: Improve hosted session scoping #6536 rather than introducing a parallel mechanism.
  • Adds regression coverage and a short README note.
• What is the impact of these changes?
  • Hosted approval state gets more consistent separation per session.
  • Default local behavior is unchanged unless strict session isolation is enabled without a resolvable identity.
• What do you want reviewers to focus on?
  • Whether the reuse of the session-scoping hooks fits the existing hosting APIs cleanly.

Related Issue

No issue. Follow-up to / stacked on #6536.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/ag-ui/agent_framework_ag_ui
_endpoint.py	102	4	96%	60, 175, 207–208
_workflow.py	199	16	91%	53, 111, 116, 155, 194–195, 278, 321, 323, 325–327, 329, 347–349
packages/foundry_hosting/agent_framework_foundry_hosting
_responses.py	887	89	89%	159, 249–252, 330, 356, 361, 441–442, 456, 459–460, 514–515, 525, 566, 637, 651, 732, 735, 741, 743, 807, 895, 925–927, 929, 951–952, 1275, 1288, 1775–1777, 1779, 1826–1827, 1829–1830, 1832–1833, 1835–1836, 1841, 1850, 1853–1855, 1857, 1871, 1884, 1931–1932, 1934, 1939–1943, 1945, 1952–1953, 1955–1956, 1962, 1964–1968, 1975, 1981, 2005, 2011, 2017, 2019, 2021–2024, 2032, 2034, 2086, 2089–2090, 2102, 2105
TOTAL	39953	4505	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8005	34 💤	0 ❌	0 🔥	2m 5s ⏱️

[Copilot]

Pull request overview

This PR extends the Python “hosted session scoping” work (stacked on #6536) so Foundry Hosting binds MCP approval handles to the same per-session identity boundaries used for hosted workflow checkpoints, improving multi-user isolation and preventing cross-session approval replay. It also clarifies/extends AG-UI snapshot-scope behavior so the resolver scopes the in-memory workflow cache even when snapshot persistence is disabled.

Changes:

• Add a hosted session identity model/resolver and thread the derived isolation key through approval save/load and approval response conversion to prevent cross-isolation redemption.
• Stamp workflow checkpoint directories with the hosted session context and reject resume/write when identity is missing/mismatched (plus tests to cover these cases).
• Update AG-UI endpoint behavior/docs/tests so snapshot_scope_resolver also scopes in-memory workflow instances even without a snapshot store.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/packages/hyperlight/tests/hyperlight/test_hyperlight_codeact.py	Skips a flaky Windows/Py3.10 integration test path for Hyperlight async threading.
python/packages/foundry_hosting/agent_framework_foundry_hosting/_responses.py	Implements hosted session context resolution/stamping and binds approval storage/redemption to a per-session isolation key.
python/packages/foundry_hosting/agent_framework_foundry_hosting/init.py	Exposes HostedSessionContext and HostedSessionContextResolver as public API exports.
python/packages/foundry_hosting/tests/test_responses.py	Adds regression tests for approval isolation binding and hosted session context stamping/mismatch enforcement.
python/packages/foundry_hosting/README.md	Documents strict hosted session isolation for checkpoints and approval-handle binding guidance.
python/packages/ag-ui/agent_framework_ag_ui/_endpoint.py	Applies snapshot_scope_resolver even without snapshot persistence (for scoping in-memory workflow cache).
python/packages/ag-ui/agent_framework_ag_ui/_workflow.py	Clarifies that snapshot scope is the isolation boundary for both snapshots and in-memory workflow instances.
python/packages/ag-ui/tests/ag_ui/test_endpoint.py	Adds coverage ensuring workflow-factory cache is scoped by resolver even without a snapshot store.
python/packages/ag-ui/README.md	Documents that snapshot scope resolver also scopes the in-memory workflow cache in multi-user deployments.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 86%

✓ Correctness

The PR correctly extends hosted session scoping to approval handling. The isolation binding logic in both InMemory and FileBased storage is sound, the checkpoint stamping uses exclusive-create to handle races, and the legacy entry rejection in FileBasedFunctionAprovalStorage is correct. One efficiency issue: the hosted session context resolver is invoked twice with identical arguments in _handle_inner_workflow — once for approval binding (line 723) and again for checkpoint stamping (line 781, which internally calls the same resolver via _resolve_hosted_session_context_optional). This doubles the cost for async resolvers that perform I/O and could theoretically yield inconsistent results with a non-deterministic resolver.

✓ Security Reliability

This PR extends hosted session scoping to approval handling, binding MCP approval handles to the caller's identity (CWE-863) and validating checkpoint ownership. The security implementation is sound: approval storage correctly uses isolation key matching, file-based context stamping uses exclusive create (O_CREAT|O_EXCL) to prevent races, legacy entries are rejected, and the default strict mode enforces identity resolution. The _hosted_session_key function uses json.dumps for safe composite key derivation, preventing delimiter injection. No high-severity security or reliability issues were found. One low-severity efficiency concern exists: the user-provided hosted session context resolver is invoked twice per workflow request (once for approval isolation binding, once for checkpoint validation), which doubles latency for network-backed resolvers and could theoretically yield inconsistent results if the resolver is non-deterministic.

✓ Test Coverage

The PR adds comprehensive test coverage for the new approval isolation binding and hosted session context features. The core isolation logic in _item_to_message and both storage implementations (InMemoryFunctionApprovalStorage, FileBasedFunctionApprovalStorage) are well tested with cross-isolation rejection, strict mode enforcement, and legacy entry handling. The workflow handler integration tests cover cross-user rejection, unstamped checkpoints, and non-strict fallback. However, the _output_item_to_message function has identical isolation plumbing (isolation_key, require_isolation) that is only exercised with default (None) values — the isolation-specific tests all go through _item_to_message only.

✓ Design Approach

I found one blocking design regression and one narrower API-coupling issue. In Foundry Hosting, the new strict approval-isolation path now breaks the default local/non-Foundry approval round-trip for plain agents, but the updated tests hide that by always injecting a fake hosted-session resolver. In AG-UI, the endpoint now resolves snapshot scope on every request even when the runner cannot use that value, which turns an optional scoping hook into an unnecessary request requirement for fixed-workflow endpoints.

---

Automated review by eavanvalkenburg's agents