[dotnet-port-api] Add tool approval bypass opt-out

[github-actions]

Summary

Port the public opt-out from microsoft/agent-framework#6970 for bypassing approval requests on tools that do not actually require approval.

This adds toolapproval.Config.DisableNonApprovalRequiredToolBypassing, wires it into the middleware's auto-approval decision path, adds focused coverage for the opt-out behavior, and updates the .NET/Go feature comparison note to reflect the exposed Go surface.

Upstream source commit: 76f2c1a0c974cd4168857dc71520597674650bf8 (https://github.com/microsoft/agent-framework/commit/76f2c1a0c974cd4168857dc71520597674650bf8).

Ported .NET PRs

• .NET: [BREAKING] Graduate per-service-call persistence and approval-not-required function bypassing agent-framework#6970 - graduate per-service-call persistence and approval-not-required function bypassing

Breaking Changes

No.

Tests and Examples

• go test ./agent/harness/toolapproval ./agent/harness/toolautocall -count=1
• Added focused toolapproval coverage verifying that queued non-approval-required tool requests are surfaced when bypassing is disabled.
• Updated docs/dotnet-go-sdk-feature-comparison.md
• No examples changed; this port adds a configuration opt-out to existing middleware behavior rather than a new end-user scenario.

Notes

• The other public change in upstream PR #6970 (RequirePerServiceCallChatHistoryPersistence) is a broader chat-client pipeline feature and was intentionally not bundled into this narrow nightly port.
• Existing Go behavior already matched the default bypass semantics; this PR only exposes the public opt-out needed for parity.

Generated by .NET to Go API Porting Agent · 732 AIC · ⌖ 17.9 AIC · ⊞ 21.7K · ◷

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch copilot/dotnet-port-api-toolapproval-bypass-optout-20260713-063604-230d44dc9dd8e156.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (132 of 132 lines)

From 885738d0921992e2578c40c6a9cf33240ffe4216 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 06:36:04 +0000
Subject: [PATCH] [dotnet-port-api] Add tool approval bypass opt-out

Port the public opt-out for approval-not-required tool bypassing from microsoft/agent-framework#6970 by adding a matching toolapproval middleware configuration flag and focused tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 agent/harness/toolapproval/toolapproval.go    | 12 +++-
 .../harness/toolapproval/toolapproval_test.go | 60 +++++++++++++++++++
 docs/dotnet-go-sdk-feature-comparison.md      |  2 +-
 3 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/agent/harness/toolapproval/toolapproval.go b/agent/harness/toolapproval/toolapproval.go
index a99ac19c4..3aa391057 100644
--- a/agent/harness/toolapproval/toolapproval.go
+++ b/agent/harness/toolapproval/toolapproval.go
@@ -94,6 +94,13 @@ type Config struct {
 	// to be auto-approved without prompting the caller. Returning an error fails
 	// the current run.
 	AutoApprovalRules []func(context.Context, *message.FunctionCallContent) (bool, error)
+
+	// DisableNonApprovalRequiredToolBypassing disables the default behavior that
+	// auto-approves requests for tools that do not actually require approval when
+	// they are surfaced alongside approval-required tools. When true, all such
+	// requests are surfaced to the caller instead of being transparently
+	// re-injected as approved on the next turn.
+	DisableNonApprovalRequiredToolBypassing bool
 }
 
 func run(cfg Config, next agent.RunFunc, ctx context.Context, messages []*message.Message, opts ...agent.Option) iter.Seq2[*agent.ResponseUpdate, error] {
@@ -331,7 +338,10 @@ func isNotApprovalRequired(req *message.ToolApprovalRequestContent, opts []agent
 // configured auto-approval rules. This matches the .NET MatchesRule || MatchesAutoApprovalRule
 // evaluation pattern 
... (truncated)

[michelle-clayton-work]

Pull request #1044 is linked to this issue and will close it when merged.