Skip to content

Python: Fix history provider isolation bypass in Responses-style continuation#4579

Open
coding-shalabh wants to merge 1 commit intomicrosoft:mainfrom
coding-shalabh:fix/responses-history-provider-bypass
Open

Python: Fix history provider isolation bypass in Responses-style continuation#4579
coding-shalabh wants to merge 1 commit intomicrosoft:mainfrom
coding-shalabh:fix/responses-history-provider-bypass

Conversation

@coding-shalabh
Copy link

Summary

Fixes #4577

Resolves conversation history leakage when using InMemoryHistoryProvider(load_messages=False) with Responses-style clients (OpenAI, Anthropic).

Problem

When using a history provider with load_messages=False to isolate conversations, Responses-style clients still remember previous conversation history, while Chat-style clients correctly forget it.

Expected behavior: Both client types should respect history provider isolation settings.

Root Cause

In _agents.py:1095-1097, the _prepare_run_context method always forwards session.service_session_id to conversation_id:

run_opts: dict[str, Any] = {
    "model_id": opts.pop("model_id", None),
    "conversation_id": active_session.service_session_id
    if active_session
    else opts.pop("conversation_id", None),

This bypasses history provider settings and causes Responses-style clients to continue previous conversations even when history providers explicitly disable message loading.

Solution

Modified _prepare_run_context to conditionally forward service_session_id based on history provider settings:

# Check if any history provider has load_messages=False
has_history_provider_disabling_load = any(
    isinstance(p, BaseHistoryProvider) and not p.load_messages
    for p in self.context_providers
)

# Only forward service_session_id when appropriate
should_forward_service_session = (
    active_session
    and active_session.service_session_id
    and not explicit_conversation_id
    and not has_history_provider_disabling_load
)

Now service_session_id is forwarded ONLY when:

  1. No explicit conversation_id provided in runtime options
  2. No history provider has load_messages=False
  3. Active session with service_session_id exists

Testing

Before fix (reproducing issue #4577):

# Responses client remembers history despite load_messages=False
agent = Agent(
    context_providers=[InMemoryHistoryProvider(load_messages=False)],
    client=OpenAIChatClient(...)
)
# First run: "Hello" → remembers in subsequent runs
# Second run: "What did I say?" → "You said Hello" (WRONG)

After fix:

# Responses client now respects isolation
agent = Agent(
    context_providers=[InMemoryHistoryProvider(load_messages=False)],
    client=OpenAIChatClient(...)
)
# First run: "Hello" → isolated
# Second run: "What did I say?" → "I don't have context" (CORRECT)

Impact

  • ✅ Enables proper conversation isolation for Responses-style clients
  • ✅ Makes behavior consistent between Responses and Chat-style clients
  • ✅ Respects history provider load_messages settings
  • ✅ No breaking changes - explicit conversation_id still takes precedence

Related Issues

Closes #4577


🤖 Generated with Claude Code

Fixes microsoft#4577

**Problem**: When using InMemoryHistoryProvider(load_messages=False),
Responses-style clients (OpenAI, Anthropic) still remember conversation
history while Chat-style clients correctly forget it.

**Root Cause**: The _prepare_run_context method always forwards
session.service_session_id to conversation_id regardless of history
provider settings (lines 1095-1097).

**Fix**: Only forward service_session_id when:
1. No explicit conversation_id provided in runtime options
2. No history provider has load_messages=False
3. Active session with service_session_id exists

This ensures Responses-style clients respect history provider isolation
settings the same way Chat-style clients do.

**Impact**: Enables proper conversation isolation for Responses-style
clients when using history providers with load_messages=False.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@coding-shalabh
Copy link
Author

@microsoft-github-policy-service agree

@github-actions github-actions bot changed the title Fix history provider isolation bypass in Responses-style continuation Python: Fix history provider isolation bypass in Responses-style continuation Mar 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Python: [Bug]: Responses-style continuation bypasses history provider isolation

2 participants