[dotnet-port-api] Add tool approval bypass opt-out

[Michelle Clayton (michelle-clayton-work)]

Summary

Port the public opt-out from microsoft/agent-framework#6970 for bypassing approval requests on tools that do not actually require approval.

This adds toolapproval.Config.DisableNonApprovalRequiredToolBypassing, wires it into the middleware's auto-approval decision path, adds focused coverage for the opt-out behavior, and updates the .NET/Go feature comparison note to reflect the exposed Go surface.

Upstream source commit: 76f2c1a0c974cd4168857dc71520597674650bf8 (https://github.com/microsoft/agent-framework/commit/76f2c1a0c974cd4168857dc71520597674650bf8).

Ported .NET PRs

• .NET: [BREAKING] Graduate per-service-call persistence and approval-not-required function bypassing agent-framework#6970 - graduate per-service-call persistence and approval-not-required function bypassing

Breaking Changes

No.

Tests and Examples

• go test ./agent/harness/toolapproval ./agent/harness/toolautocall -count=1
• Added focused toolapproval coverage verifying that queued non-approval-required tool requests are surfaced when bypassing is disabled.
• Updated docs/dotnet-go-sdk-feature-comparison.md
• No examples changed; this port adds a configuration opt-out to existing middleware behavior rather than a new end-user scenario.

Notes

• The other public change in upstream PR #6970 (RequirePerServiceCallChatHistoryPersistence) is a broader chat-client pipeline feature and was intentionally not bundled into this narrow nightly port.
• Existing Go behavior already matched the default bypass semantics; this PR only exposes the public opt-out needed for parity.

Generated by .NET to Go API Porting Agent · 732 AIC · ⌖ 17.9 AIC · ⊞ 21.7K · ◷

Closes #480

[Copilot]

🟡 Changes recommended

A newly added public-facing doc comment describes narrower semantics than the actual implementation, which could mislead API consumers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a public toolapproval middleware configuration opt-out to stop automatically bypassing/silently auto-approving tool-approval requests for tools that don’t require approval, plus targeted tests and updated .NET/Go parity documentation.

Changes:

• Added toolapproval.Config.DisableNonApprovalRequiredToolBypassing and wired it into the auto-approval decision path.
• Added a focused toolapproval test ensuring queued non-approval-required requests are surfaced when bypassing is disabled.
• Updated the .NET/Go SDK feature comparison to reflect the new Go surface area.

File summaries

File	Description
agent/harness/toolapproval/toolapproval.go	Adds the opt-out config flag and changes auto-approval logic to respect it.
agent/harness/toolapproval/toolapproval_test.go	Adds coverage validating queued non-approval-required requests are surfaced when the opt-out is enabled.
docs/dotnet-go-sdk-feature-comparison.md	Updates parity documentation to mention/configure the new opt-out.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Michelle Clayton (michelle-clayton-work)]

Copilot resolve merge conflicts and address PR feedback

[Copilot]

Copilot resolve merge conflicts and address PR feedback

Merged main into the branch (conflicts in agent/harness/toolapproval/toolapproval.go and docs/dotnet-go-sdk-feature-comparison.md resolved so the opt-out sits alongside the new DisableApprovalResponseBinding/MaxAutoApprovalIterations config and the updated isAutoApprovable signature), and updated the DisableNonApprovalRequiredToolBypassing doc comment to describe the actual behavior: it gates all isNotApprovalRequired-based auto-approvals, with standing rules and AutoApprovalRules still applying.

go test ./agent/harness/toolapproval ./agent/harness/toolautocall -count=1 passes.

[github-actions]

Scope: public API, user-visible behavior

Changed Go contract: New exported field toolapproval.Config.DisableNonApprovalRequiredToolBypassing (agent/harness/toolapproval/toolapproval.go), wired into isAutoApprovable so !cfg.DisableNonApprovalRequiredToolBypassing && isNotApprovalRequired(...) gates the existing default auto-bypass of non-approval-required tool calls. Default false preserves prior always-bypass behavior; true surfaces those calls as approval requests unless matched by a standing rule or AutoApprovalRules.

Upstream evidence reviewed:

• dotnet/src/Microsoft.Agents.AI/ChatClient/ChatClientAgentOptions.cs — DisableApprovalNotRequiredFunctionBypassing (post-rename in the cited commit 76f2c1a0c9), default false, opt-out semantics matching this PR.
• dotnet/src/Microsoft.Agents.AI/ChatClient/ChatClientExtensions.cs (WithDefaultAgentMiddleware) — decorator now injected by default unless the option is true, i.e. bypass-by-default with an opt-out, matching the Go default.
• dotnet/src/Microsoft.Agents.AI.Harness/HarnessAgentOptions.cs — DisableApprovalNotRequiredFunctionBypassing, same opt-out shape surfaced at the harness level, analogous to toolapproval.Config.
• dotnet/tests/Microsoft.Agents.AI.Harness.UnitTests/HarnessAgentTests.cs — ApprovalNotRequiredFunctionBypassing_SurfacesAllApprovalsWhenDisabledAsync covers the same "opt-out surfaces all approvals" scenario as the new Go test TestToolApproval_DisableNonApprovalRequiredToolBypassing_SurfacesQueuedNonApprovalRequest.

Result: aligned. The default (bypass enabled) matches upstream's default, and the new opt-out field mirrors the upstream contract shape (an exported boolean disabling the default bypass), adapted idiomatically to Go's options-struct/middleware pattern rather than .NET's chat-client decorator. The cited upstream commit's unrelated changes (no-session no-op/logging behavior for the .NET decorator, and removal of [Experimental] from RequirePerServiceCallChatHistoryPersistence) are correctly and explicitly excluded from this PR's scope per its description, and neither affects the parity of the ported opt-out. No naming, default, or behavioral divergence found; the Go/.NET feature-comparison doc update accurately reflects the new surface.

Ran locally: go test ./agent/harness/toolapproval/... passes, including the new test.

Generated by Go API Consistency Review Agent for #1044 · copilot · auto · 57.5 AIC · ⌖ 7.18 AIC · ⊞ 9.6K · ◷