.NET: Reject duplicate tool approval request IDs

[westey (westey-m)]

Motivation & Context

ToolApprovalAgent stores active approval requests by request ID so later approval responses can be matched to the request shown to the caller. If a downstream response contains the same ID more than once, one request can replace another in that stored state and make the response ambiguous.

This change rejects duplicate active approval request IDs before approval rules or request recording process them.

Description & Review Guide

• What are the major changes?
  • Check each downstream approval-request batch for duplicate request IDs.
  • Reject repeated IDs even when the requests have identical tool-call contents.
  • Apply the check to regular, streaming, and capped auto-approval response paths.
  • Add focused tests for duplicate IDs in each affected path.
• What is the impact of these changes?
  • Downstream components must provide a unique ID for every active approval request. A duplicate now produces a clear InvalidOperationException instead of replacing an earlier request.
• What do you want reviewers to focus on?
  • Whether each downstream response path checks uniqueness before automatic approval or surfaced-request recording occurs.

Related Issue

N/A - trivial change. This is a direct input-validation correction with one clear expected result: active approval request IDs must be unique.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the implementation, tests, design discussion, and this pull request description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Cleanup stops at the first collision, leaving other duplicate IDs eligible to authorize standing approvals.

1 open issue

• Invalidate all duplicate IDs before throwing on capped update · New

What changed in this PR

This PR adds duplicate-ID validation to .NET tool approval handling to prevent ambiguous request matching.

Changes:

• Validate approval IDs before classification or recording across regular, streaming, and capped responses.
• Add regression tests for duplicate IDs, including identical requests.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.UnitTests/​Harness/​ToolApproval/​ToolApprovalAgentTests.cs	Tests duplicate-ID rejection across response paths.
dotnet/​src/​Microsoft.Agents.AI/​Harness/​ToolApproval/​ToolApprovalAgent.cs	Adds uniqueness checks and conflicting approval-state cleanup.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 1d80e731f27d
Model: gpt-5.6-sol

Overview

The change validates duplicate request IDs before classification or recording in regular, streaming, and capped response paths, and fails closed by clearing state associated with an ambiguous ID. The focused tests cover different and equivalent collisions, whole-turn streaming validation, and both capped paths; the lower approval-binding layer independently poisons conflicting streamed IDs. No PR-introduced Critical, High, or Medium defect remained after reconciling the reported candidates against the pre-change behavior and lifecycle contracts.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.