Python: fix streaming transcript duplication with message injection and per-service-call persistence

[westey (westey-m)]

Motivation & Context

When a harness/agent run combines message injection (e.g. MessageInjectionMiddleware, used by the harness agent to inject todo-list context) with per-service-call history persistence (PerServiceCallHistoryPersistingMiddleware), the streaming path duplicates the conversation transcript after a tool call.

PerServiceCallHistoryPersistingMiddleware signals "the provider already holds this history" by setting response.conversation_id = LOCAL_HISTORY_CONVERSATION_ID and calling response.mark_internal_conversation_id(). In the streaming path this is applied to the inner final response via ResponseStream.with_result_hook. MessageInjectionMiddleware then wrapped that stream in an outer ResponseStream finalized by ChatResponse.from_updates(...) — and because neither the sentinel conversation id nor the internal marker is ever emitted on an individual update, both were silently dropped.

The function-invocation loop reads that outer response. Seeing conversation_id is None, _prepare_messages_for_next_iteration re-sends the whole turn instead of just response.messages[-1:], on top of the history the persistence middleware had already injected. The result is a duplicated transcript in which an assistant message carrying tool_calls is followed by another copy of the user/assistant messages rather than by its tool results.

Strict chat-completion endpoints reject this outright. Against OpenAI it fails with HTTP 400:

An assistant message with 'tool_calls' must be followed by tool messages responding to each 'tool_call_id'. The following tool_call_ids did not have response messages: call_…

The non-streaming path is unaffected, since _process_non_streaming passes context.result through unchanged.

Description & Review Guide

• What are the major changes?

  • MessageInjectionMiddleware now propagates the inner response's stream-control state onto the outer rebuilt response. A new module-private helper _carry_over_stream_control_state(response, inner_response) copies conversation_id when set, and sets or clears the internal-conversation-id marker to mirror the inner response.
  • _stream_injected_messages takes an inner_responses: list[ChatResponse] accumulator and records each iteration's await stream.get_final_response().
  • A new _finalize_injected_stream(...) static method builds the outer response via ChatResponse.from_updates and then carries state over from the last inner response — matching what the non-streaming path returns.
  • Regression tests at two levels: middleware-level tests in test_middleware_with_chat.py covering both propagation of the sentinel and the "don't clobber a real service conversation id" case, and an end-to-end harness test in test_harness_agent.py asserting the streaming transcript is not duplicated.
  • python/uv.lock is refreshed. It was stale relative to python/pyproject.toml (pyrefly 1.1.1 → 1.2.0, zuban 0.9.0 → 0.9.1) on main, which made uv run re-lock mid-hook and fail the poe-check pre-commit hook with "files were modified by this hook".

• What is the impact of these changes?

  • Streaming runs that combine message injection with per-service-call persistence now send the same request sequence as their non-streaming equivalents, so provider-side tool-call ordering validation passes.
  • No public API change and no behaviour change for runs that do not use both middlewares together.
  • Carrying the marker over — not just the id — is deliberate: _update_continuation_state writes response.conversation_id into session.service_session_id unless has_internal_conversation_id() is true, so propagating the sentinel without its marker would leak it into the session. The sentinel does not reach callers, because the function loop's own outer stream rebuilds from updates and the non-streaming path clears it via _clear_internal_conversation_id.

• What do you want reviewers to focus on?
  Whether taking the last inner response is the right choice when message injection spans multiple service calls, and whether _carry_over_stream_control_state belongs on ResponseStream as shared behaviour rather than living privately in _sessions.py.

The .NET implementation appears unaffected: PerServiceCallChatHistoryPersistingChatClient stamps update.ConversationId on each streaming update, so the state survives a rebuild from updates there.

Related Issue

Fixes #7591

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework
_sessions.py	958	57	94%	163, 175–176, 213, 224, 238, 262, 307, 312, 314, 324, 356, 368, 378, 487, 556–557, 1292–1296, 1311, 1341, 1378–1379, 1393, 1395, 1415, 1417, 1516, 1556, 1633, 1637, 1647, 1864, 1897–1898, 1903, 1918, 1996–1997, 1999, 2083, 2100, 2179, 2252, 2281, 2300, 2303, 2311–2312, 2324–2325, 2337, 2347, 2377
TOTAL	45736	4245	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9283	36 💤	0 ❌	0 🔥	2m 26s ⏱️

[Copilot]

Pull request overview

Fixes duplicated streaming transcripts when message injection and per-service-call history persistence interact.

Changes:

• Preserves inner streaming continuation state during response rebuilding.
• Adds middleware and harness regression tests.
• Refreshes Python lockfile tooling versions.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
python/uv.lock	Refreshes pyrefly and zuban locks.
python/packages/core/agent_framework/_sessions.py	Carries streaming conversation control state.
python/packages/core/tests/core/test_middleware_with_chat.py	Tests continuation-state propagation.
python/packages/core/tests/core/test_harness_agent.py	Tests transcript deduplication end to end.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Agent Framework Review — Iteration 1

Completed passes: 5 | Result: No high-severity findings

Scope: full PR (1 commit(s)): d21f3d2a7390

Review passes

• Correctness (gpt-5.6-sol) — No issues found in this pass.
• Security Reliability (claude-opus-4.8) — No issues found in this pass.
• Test Coverage (gpt-5.6-sol) — No issues found in this pass.
• Failure Modes (claude-opus-4.8) — No issues found in this pass.
• Design Approach (claude-opus-4.8) — No issues found in this pass.