Workflows should automatically map AIAgent HIL to and from ExternalRequest

[alliscode]

AIAgent supports HIL patterns using content types like FunctionApprovalRequestContent. Workflows support HIL patterns with ports and ExternalRequest. These patterns need to be wired together to allow AIAgent HIL requests to automatically come out of the workflow in an ExternalRequest. Similarly, when the workflow consumer responds with an ExternalResponse the workflow should automatically map this to an FunctionApprovalResponseContent and send it back to the agent.

[stephentoub]

AIAgent supports HIL patterns using content types like FunctionApprovalRequestContent

More generally any UserInputRequestContent

Similarly, when the workflow consumer responds with an ExternalResponse the workflow should automatically map this to an FunctionApprovalResponseContent and send it back to the agent.

I wouldn't expect an ExternalResponse to manufacture a FunctionApprovalResponseContent. I'd expect the consumer to receive the request and create the new ChatMessage containing the response content, and that ChatMessage would then need to be routed back to the relevant agent in the workflow. Presumably that means the ExternalResponse the user creates would wrap the ChatMessage (or IEnumerable<ChatMessage>) or something like that.

[stephentoub]

Related: #938

[stephentoub]

Also #858

[DennesTorres]

I spent some days on this, with an agent with MCP requiring approval was always hanging the workflow.

I manage to make a small workaround while this problem is not solved: If we create the agent by code, we can set the tools to never require approval and in this way they will work in the workflow.

Not a real solution, but it will work until the problem is fixed.

The API's are challenging with bad documentation, but I managed to make it work with the code below. It only works if the tool is already registered in the foundry project. I couldn't find a way to register the tool in foundry project and with the agent - nothing in the documentation.

The code below has a hidden example: The MCP requires authentication. The authentication is registered in the tool in foundry. The code doesn't need to specify the authentication and it will be used.

    mcp_tool = MCPTool(
        server_label=MCP_NAME,
        server_url=MCP_URL,
        require_approval="never"   # <<< NO APPROVAL
        ,project_connection_id=MCP_NAME  
    )

    # ✅ EXISTING WORKING AGENT DEFINITION + MCP ADDED
    definition = PromptAgentDefinition(
        model=MODEL_DEPLOYMENT,
        instructions="You may use sqlmcp freely without asking for approval.",
        tools=[mcp_tool]
    )

    agent = await project_client.agents.create(
        name=AGENT_NAME,
        definition=definition,
    )