Python: fix(python): prevent local tool approvals from serializing as MCP responses

[pratik wayase (PratikWayase)]

Motivation & Context

Approved local (non-MCP) tool calls fail with a hard 400 error from the OpenAI Responses API

This blocks any agent that uses approval_mode="always_require" on a local FunctionTool when running against the Responses API with service-side storage. The bug requires two independent defects to manifest, and either fix alone prevents the 400.

Fixes #7452

Description & Review Guide

• What are the major changes?

  1. OpenAI serializer (_chat_client.py): Added _is_hosted_tool_approval guard to both function_approval_request and function_approval_response arms in _prepare_content_for_openai. Local approvals now return {} and are filtered out by the upstream if prepared: check. Also restored the request_uses_service_side_storage guard on the response arm that was accidentally dropped in PR Python: Preserve approval decisions under OpenAI continuation #7407, preventing orphaned responses under storage.
  2. Approval control filtering (_sessions.py, _tools.py): Replaced order-dependent single-pass queue-popping logic with a two-pass set-based approach in four functions: _approval_controls_to_keep, _collect_approval_responses, _collect_unanswered_approval_requests, and _remove_unanswered_approval_batches_from_model_input. Pass 1 collects all resolved call_ids regardless of position; Pass 2 filters using the pre-built set. This eliminates the ordering bug where a terminal result appearing before an approval response (the "approval-resume" layout) caused the resolved response to leak into model input.
  3. Tests: Updated 5 existing tests that asserted the old broken behavior. Added 8 new regression tests covering order-independent resolution, local vs. hosted serialization boundaries, follow-up request semantics, and service-side storage symmetry.

• What is the impact of these changes?

  • Local gated tools now work correctly on the Responses API path — the primary user-facing fix.
  • Approval resume flows no longer produce 400 errors regardless of message ordering.
  • Hosted/MCP tool approvals are unaffected; they continue to serialize and flow through the API as before.
  • No breaking changes to public APIs; all modifications are internal filtering/serialization logic.

• What do you want reviewers to focus on?

  • The two-pass pattern in _approval_controls_to_keep — verify the semantic boundary between what session history filtering resolves (terminal results + matching responses) vs. what current-turn collectors resolve (also includes follow-up requests).
  • The _is_hosted_tool_approval guard placement in _chat_client.py — confirm returning {} for local approvals is safe given all upstream callers use if prepared:.
  • The updated existing tests — these previously encoded buggy contracts; verify the new assertions match the intended correct behavior.

Related Issue

Fixes #7452

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue.
• This is not a breaking change.

[Copilot]

Pull request overview

This PR fixes a Python bug in the OpenAI Responses API integration where local (non-hosted) tool approvals could be serialized as MCP approval items, leading to 400 errors due to orphaned approval responses. It also refactors approval-control filtering/collection to be order-independent so resolved approvals don’t leak into model input based on message/content ordering.

Changes:

• Guard OpenAI serialization of approval requests/responses so only hosted/MCP approvals are emitted as mcp_approval_* items; local approvals serialize to {} and are dropped upstream.
• Replace order-dependent approval filtering/collection logic with a two-pass, set-based approach across session/history filtering and tool-loop collectors.
• Update existing tests and add new regression tests covering local-vs-hosted serialization boundaries and ordering scenarios.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
python/packages/openai/agent_framework_openai/_chat_client.py	Adds hosted-approval guards in _prepare_content_for_openai and adjusts message preparation behavior for approval items.
python/packages/openai/tests/openai/test_openai_chat_client.py	Updates existing assertions and adds approval serialization regression tests (local vs hosted; storage vs non-storage).
python/packages/core/agent_framework/_tools.py	Refactors approval response/request collection and model-input filtering to be order-independent.
python/packages/core/agent_framework/_sessions.py	Refactors history-provider approval control filtering to be order-independent.
python/packages/core/tests/core/test_tools.py	Adds regression tests for approval collection and model-input filtering behavior.
python/packages/core/tests/core/test_sessions.py	Adds regression tests for approval-control history filtering behavior under different orderings.

[Evan Mattson (moonbox3)]

pratik wayase (@PratikWayase) please have a look at the failing unit tests

[Evan Mattson (moonbox3)]

Please re-open when CI/CD checks (unit tests, code quality, etc) are all passing locally.