[dotnet-port-fixes] Bound tool approval auto-approval loop

[Michelle Clayton (michelle-clayton-work)]

Summary

Bound the tool-approval middleware's internal auto-approval re-entry loop to 40 passes and forward one final unsplit inner turn once the cap is hit. This aligns Go with the upstream .NET safety fix for runaway auto-approved tool requests without changing the public Go API.

Upstream commit: 74a144085a5fd05921b473001528f3ae0725b76a
(microsoft/agent-framework@74a1440)

Ported .NET PRs

• .NET: [Bug]: Sample can make endless "loop" resulting in Millions on tokens spent if you do not terminate process yourself :-( agent-framework#7472 - Bound the .NET tool-approval auto-approval loop.
• .NET: Bound the tool-approval auto-approval loop (#7472) agent-framework#7474 - Follow-up updates for the same fix.

Breaking Changes

No.

Tests and Examples

• go test ./agent/harness/toolapproval
• Added TestToolApproval_AutoApprovedRequestsStopAtIterationCap
• Examples updated: None

Notes

• Go keeps the safety cap internal at 40 iterations so this port stays within the no-public-API-change constraint for [dotnet-port-fixes].
• No examples or comparison-doc updates were needed because this is an internal behavior correction in an already supported area.

Generated by .NET to Go Fixes and Test Porting Agent · gpt54 · 151.1 AIC · ⌖ 12.7 AIC · ⊞ 24.2K · ◷

Closes #812

[Copilot]

Pull request overview

Ports the upstream safety fix to the Go tool-approval middleware by bounding the internal auto-approval re-entry loop to prevent runaway “auto-approved tool request” chains, while preserving the public Go API and surfacing a final unsplit inner turn once the cap is reached.

Changes:

• Introduced an internal max-iteration cap (40) for the auto-approval re-entry loop and, upon reaching it, forwards one final unsplit inner-agent turn to surface pending approval requests.
• Added a regression test ensuring auto-approved approval-requests stop at the iteration cap and the final approval request is surfaced.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
agent/harness/toolapproval/toolapproval.go	Adds an internal 40-iteration cap to the auto-approval re-entry loop and forwards one final unsplit inner turn when the cap is hit.
agent/harness/toolapproval/toolapproval_test.go	Adds a regression test verifying the capped behavior (40 auto-approved turns + 1 surfaced turn).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Cross-Repo Parity Review

PR #835 ports the .NET safety cap on the tool-approval auto-approval re-entry loop (upstream commit 74a144085) and touches only agent/harness/toolapproval/toolapproval.go (unexported internals) plus a test. No exported Go API surface changed; the public-api-change label is therefore not warranted.

---

⚠️ Parity Issue: MaxAutoApprovalIterations is not user-configurable in Go

The upstream .NET ToolApprovalAgentOptions exposes this cap as a public, nullable property:

// dotnet/src/Microsoft.Agents.AI/Harness/ToolApproval/ToolApprovalAgentOptions.cs
public int? MaxAutoApprovalIterations { get; set; }

It is accompanied by a public constant ToolApprovalAgent.DefaultMaxAutoApprovalIterations so callers can read the default and choose to override it when longer auto-approval chains are intentional.

The Go port hard-codes the cap as an unexported constant:

// agent/harness/toolapproval/toolapproval.go
const (
    defaultMaxAutoApprovalTurns = 40
)

The Go Config struct does not expose a corresponding field, so there is currently no way for Go callers to raise or lower the cap without forking the package.

Suggested resolution: Add MaxAutoApprovalTurns *int (or MaxAutoApprovalIterations *int) to Config, defaulting to 40 when nil, and optionally export the default constant. This would bring Go to full semantic parity with the .NET MaxAutoApprovalIterations option before this feature ships.

---

Upstream reference: dotnet/src/Microsoft.Agents.AI/Harness/ToolApproval/ToolApprovalAgentOptions.cs

Generated by Go API Consistency Review Agent for #835 · sonnet46 · 24.4 AIC · ⌖ 5.7 AIC · ⊞ 5.7K · ◷