Python: Defer provider-injected approvals to in-run execution

[eavanvalkenburg]

Motivation & Context

AG-UI resolves approval responses before context providers run. A tool injected during before_run is therefore
missing from the transport's static tool map and an approved call can be rejected or fail before the tool exists.

Description & Review Guide

• What are the major changes?
  • Execute only approved tools already present in the static tool map.
  • Leave provider-injected approvals for the in-run ToolApprovalMiddleware.
  • Preserve the complete grouped result contract from the core function loop.
  • Cover pause, approve, resume, side-effect execution, and exactly one result event.
• What is the impact of these changes?
  • Provider-injected approved tools execute after before_run registers them.
  • Approved calls are not converted to rejection/failure results by the transport.
  • The side effect and AG-UI result are emitted exactly once.
• What do you want reviewers to focus on?
  • Static-versus-provider tool ownership.
  • Exactly-once execution and result emission on resume.

Related Issue

Fixes #7043

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/ag-ui/agent_framework_ag_ui
_agent_run.py	1115	118	89%	184–191, 238–239, 246, 355, 359, 361, 378, 405–406, 519, 533, 537, 541, 544, 549, 554, 563, 566, 573–579, 612, 624, 635, 638, 673, 727–731, 796, 811, 814, 816, 842, 868–870, 928, 930, 932, 935–939, 953, 961–966, 975–976, 1025–1028, 1039, 1047, 1079, 1094, 1108, 1120, 1150, 1154, 1157, 1159, 1199–1201, 1265, 1271–1272, 1277, 1281–1282, 1450, 1458, 1475, 1479, 1524, 1583, 1613–1614, 1736, 1882, 1942, 1959, 1979–1980, 1987, 2095, 2123, 2131, 2133, 2136, 2142, 2197, 2200, 2210–2211, 2218, 2264
TOTAL	45857	4476	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9466	34 💤	0 ❌	0 🔥	2m 39s ⏱️

[Copilot]

Pull request overview

This PR fixes an AG-UI transport ordering bug where approval responses were being resolved (and approved tool calls executed) before agent.run() starts, meaning tools injected by ContextProvider.before_run were missing from the static tool map and could be incorrectly turned into transport-level failures. The change defers provider-injected approvals to in-run ToolApprovalMiddleware execution while still executing approvals for statically-known tools.

Changes:

• Update AG-UI approval resolution to execute only approved tool calls that exist in the static tool map, leaving provider-injected approvals in the message stream for in-run middleware handling.
• Add a full pause → approve → resume regression test to ensure a provider-injected, approval-gated tool executes exactly once and emits exactly one TOOL_CALL_RESULT.
• Update AG-UI package notes and the function-calling-loop spec to document the provider-injected approval deferral behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py	Partitions approved responses into statically-executable vs deferred; only executes the former during transport approval resolution.
python/packages/ag-ui/tests/ag_ui/test_endpoint.py	Adds regression coverage for provider-injected approval deferral and in-run execution on resume.
python/packages/ag-ui/AGENTS.md	Documents that approvals for tools injected during before_run are deferred to in-run approval middleware.
docs/specs/004-python-function-calling-loop.md	Updates the spec’s coverage matrix and checklist to include provider-injected approval deferral/execution semantics.