Add Microsoft Defender for AI real-time protection on agent-hooks

[Krishnadheeraj (DheerajPannala)]

Summary

Adds opt-in real-time protection from Microsoft Defender for AI ("Defender RTP") to the Agent 365 Node.js SDK, on the Responsible AI agent-hooks control contract (AGENT-HOOKS-0.1). The host emits an agent-hooks context at each interception point, an interceptor posts it to Defender's prevention endpoint, and Defender's verdict decides allow or deny. This is the Node.js part of a three-SDK change, with .NET (microsoft/Agent365-dotnet#266) and Python (microsoft/Agent365-python#278); the API shape, defaults and environment variables match.

• @microsoft/agents-a365-tooling (no new dependency):
  • DefenderRtpClient: evaluateHookContext sends an agent-hooks/0.1 context to POST .../v1/protection/evaluate and returns a DefenderRtpEvaluationResult. prefetchAccessToken warms the token cache, isEvaluatedInterceptionPoint reports the four points Defender evaluates, and unavailable builds a not-evaluated result.
  • DefenderRtpTokenResolver and DefenderRtpTokenResolvers.fromAgenticConnection, which return the agent identity's app-only token.
  • DefenderRtpAgentContext, plus six Defender settings on ToolingConfiguration, read from the environment or from override functions.
• @microsoft/agents-a365-tooling-extensions-agenthooks (new package, preview), the only package that uses @responsibleai/agent-hooks. It is a peer dependency (>=0.1.0-alpha.5 <0.2.0), so the application installs it alongside and both share one copy:
  • A365DefenderInterceptor, an agent-hooks Interceptor registered as defender, with an evaluation callback for logging; A365DefenderCall carries the identity and token resolver for each context.
  • createProtectionEmitter (enforce mode, parallel/strictest) and addA365Defender.
• Tests, docs (package README and design docs, the tooling design doc, docs/design.md, CLAUDE.md), CHANGELOG, the package lists (jest mapper, dependency graph, build and release docs), and a named pnpm catalog (peers) for the peer range.

Scope: Defender RTP and the agent-hooks interceptor only. No Purview and no samples.

Supersedes #277, which targeted an older Defender endpoint and API. That PR is left open for its owner to close.

How it works

Interception points. Defender evaluates four points. Any other point (agent_startup, model calls, agent_shutdown) is allowed locally with no call, as is every point while Defender RTP is disabled.

Point	When	On deny
input	the user's message, before the agent runs	the agent does not run
pre_tool_call	a tool call, before it runs	the tool does not run
post_tool_call	a tool result, before the agent uses it	the result is withheld
output	the reply, before it is sent	the reply is replaced

Request. The body is a copy of the host's AgentContext, built field by field while reading it (the context is never serialized whole) and fitted to Defender's request validation; the host's context is never modified. The copy keeps the session, sequence and tool-call ids, and is fitted as follows:

• spec is agent-hooks/0.1, timestamp is UTC, and sequence is ≥ 0.
• agent.id is the Entra agent identity, agent.framework is sanitized to ^[a-z0-9_-]+$, and session.id is required.
• target equals the point's field, tool_call/tool_result carry only spec members, and loosely filled optional fields are repaired or dropped. Only the active point's field is sent: an input, output, tool_call or tool_result left over from another point is left out, as in the .NET SDK.
• Every optional node is shape-checked before it is read. One of another shape (for example a string model or actor, or an a365 extension that isn't an object) is left out rather than indexed, so it can't fail an evaluation. session and trace carry only their spec members of the right shape: id, a UTC started_at and a non-negative integer turn; string trace_id and span_id.
• tenant carries only id, always the agent's tenant since it must equal the token's tid, and the host's name when the host's tenant id matches.
• Every string and object key is well formed: a lone UTF-16 surrogate becomes U+FFFD (String.prototype.toWellFormed, with a fallback on Node.js 18). Otherwise JSON.stringify would write a \uD8xx escape that Defender's JSON parser rejects, and the request would fail, by default open. When two keys of one object become equal that way, only the first is sent; in the content under decision that makes the copy incomplete (see Long content).
• Each content string is cut to at most A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS characters, truncation marker included, and nesting deeper than 32 levels is cut. Identifiers and protocol fields are sent unchanged.
• Total budget. The copy carries at most 4 × A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS of content. Every copied element counts at least one character: strings, keys and other values count their length (so empty strings and nulls count too), each array, object, tool declaration and message counts one more, and tool declarations and messages count their keys. Only the called tool's name is copied whole without cost. A million name-only tools or empty messages are therefore trimmed like any other content. It's filled in this order:
  1. the content under decision, up to half of the total, since target sends it twice;
  2. at a tool call, the called tool's declaration (see Called tool);
  3. the tool-call arguments at post_tool_call;
  4. the other tool declarations, in host order;
  5. the newest messages;
  6. extensions, then any other fields.
• Called tool. At pre_tool_call and post_tool_call, Defender decides with the called tool's declaration, so it comes first and is always present.
  • It is searched for by name only among the first 10,000 tools entries and copied first: its name whole, its description and schema within the budget. Otherwise it is declared by name, with the a365 extension's description.
  • The copy is incomplete (see Long content) when the called tool's description or schema had to be cut (by the string limit, the budget, the depth limit, or a key that doesn't fit), or when the list has more than 10,000 entries and the tool isn't among the first 10,000. A tool absent from a list of at most 10,000 isn't truncation. The two cases have their own errors: "the called tool's declaration exceeded A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS (N); Defender evaluated a truncated copy" and "the called tool was not among the first 10000 tool declarations; Defender evaluated without its declaration".
  • The other declarations follow in host order, skipping the called tool's entry, bounded by the budget.
• Bounded reading. Lists and objects are read only as far as the budget reaches, so a huge context is never scanned whole:
  • the called tool is searched for among at most 10,000 declarations, and the others are read only as far as they could fit;
  • the history is read newest first and stops before a message without a role or content, which Defender would reject;
  • keys that cost nothing (extension namespaces Defender doesn't accept, values JSON leaves out) count toward what is read.
• Sequence. When the host omits sequence, the client numbers each session's contexts itself, for the last 1000 sessions. A session seen again after that resumes above every number given to a dropped session, so sequence keeps increasing within session.id.
• A request_id that isn't a string falls back to the agent's request id, like a missing one.

Correlation. Every call sends a unique x-ms-correlation-id (GUID), returned as DefenderRtpEvaluationResult.correlationId. Defender logs each evaluation under it.

Verdict.

• allow proceeds, and Defender's warnings and result_labels carry through to the agent-hooks verdict. A warning reason in the host_error: namespace, which agent-hooks reserves for the host, becomes defender:warning, so it can't turn an allow into a host error.
• deny blocks with Defender's message, and the agent-hooks verdict (defender:block:<reason>) carries the correlation id as evidence.
• transform also blocks, because this version doesn't apply rewrites.
• Response members of another shape (a transform that isn't an object, warnings or labels that aren't arrays) are ignored, so they never cost Defender its decision.

Long content. The content under decision (the message, the tool call arguments, the tool result or the reply) may not fit: a string can be longer than A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS, or the content can exceed its share of the total. Then Defender sees only a truncated copy. A block (deny or transform) of the copy stands, but an allow doesn't cover the rest: the result is marked truncated and follows the fail mode, like a missing verdict. Otherwise content padded past the limit would be authorized unseen. The same applies, with its own error, when two keys of the content under decision become one once made well formed, or when the called tool's declaration is incomplete.

Authentication. Defender is always called app-only as the agent identity. That covers user turns, autonomous runs, A2A and startup prefetch, where there is no user token.

1. The Agents SDK connection returns the agent identity's assertion through getAgenticApplicationToken(tenantId, agentAppInstanceId). This is the same authority Observability S2S export uses.

2. fromAgenticConnection exchanges the assertion at https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token:

   • grant_type=client_credentials;
   • client_id = the agent identity, with a jwt-bearer client assertion;
   • scope api://86a21212-634e-4553-b3d6-e477e4c9d9ec/.default.

   The token carries the app role RealtimeProtection.Evaluate.All.

3. Tokens are cached per tenant, agent and scope until 5 minutes before they expire.

   • There is a single in-flight acquisition per key, dropped when it completes, and failures are never cached.
   • In the last 5 minutes, evaluations keep using the still-valid token while it refreshes in the background, so a slow or failed refresh doesn't fail them.

4. The endpoint and the token authority must be https URLs with a host. Each is parsed once, and requests go to the parsed URL. Neither request follows a redirect, so the context, token and client assertion are never resent elsewhere; a redirect fails like any transport error.

Fail mode. A timeout, token or transport failure, non-2xx response, or any other send or read error marks the result not evaluated (evaluated: false, with error and httpStatus).

• One deadline (A365_DEFENDER_RTP_TIMEOUT_MILLISECONDS) covers the token acquisition and the request.
• createProtectionEmitter gives the emitter a longer interceptor timeout and rejects one that isn't longer, so the client's fail mode applies before the emitter times out. The agent-hooks default of 5 s is below the client's 10 s, and the README tells hosts that build their own emitter to raise it. The timeout is fixed when the emitter is created, so with per-request Defender timeouts hosts create the emitter per turn or pass a larger timeout. Both timeouts must stay within Node's largest timer delay (2147483647 ms), since a longer timer fires after 1 ms: the Defender timeout is at most 2147481647, and the emitter rejects an interceptor timeout that isn't an integer in range.
• Fail open (the default) allows the action with a defender:unverified warning.
• A365_DEFENDER_RTP_FAIL_MODE=closed denies with runtime_error:defender_unverified, which is never reported as a detection.
• A 400 reports the failed rules from Defender's diagnostics.validationErrors in error; diagnostics of another shape fall back to the title. A token whose payload has no numeric exp is used but not cached.
• An invalid context or identity, or a call resolver that throws or resolves no agent identity, follows the fail mode too. The logging callback runs after the verdict is returned, off the interceptor's timed path, so a slow callback can't delay the action; errors it throws, and rejections of any thenable it returns (including a promise from another realm), are ignored.

Configuration

Variable	Meaning
ENABLE_A365_DEFENDER_RTP	true (or 1, yes, on) to call Defender; off by default (false, 0, no, off or unset); any other value fails at startup
A365_DEFENDER_RTP_ENDPOINT	the prevention endpoint, https://<host>/v1/protection/evaluate (required when enabled)
A365_DEFENDER_RTP_FAIL_MODE	closed blocks when no verdict is obtained; open (the default) allows; any other value is rejected, so a typo can't silently fail open
A365_DEFENDER_RTP_TIMEOUT_MILLISECONDS	deadline of each evaluation, token included: a whole number (default 10000, at most 2147481647); a value such as 10s fails at startup instead of becoming 10 ms
A365_DEFENDER_RTP_AUTHENTICATION_SCOPE	overrides the Defender API scope
A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS	clamps each content string sent, a whole number (default 20000, at most 2147483647, as in the .NET and Python SDKs); the request carries at most four times as much content

The same settings are available as ToolingConfiguration override functions, for per-tenant or per-request configuration.

Installation. npm install @microsoft/agents-a365-tooling-extensions-agenthooks @responsibleai/agent-hooks@0.1.0-alpha.5. The application installs the agent-hooks peer itself, so the emitter, AgentContextBuilder and proceeds it imports come from the same copy the extension uses.

Prerequisites.

• The agent identity has RealtimeProtection.Evaluate.All on the Defender API (86a21212-634e-4553-b3d6-e477e4c9d9ec).
  • a365 setup all will grant it once Add Defender permissions part of "a365 setup all" Agent365-devTools#485 ships.
  • Until then, a tenant administrator grants it once per agent blueprint (the app role on the blueprint's service principal, made inheritable), as the README describes. Every agent identity created from the blueprint inherits it.
• The agent's tenant is onboarded to Microsoft Defender for AI.

Otherwise Defender answers 403, which follows the fail mode.

import { DefenderRtpClient, DefenderRtpTokenResolvers } from '@microsoft/agents-a365-tooling';
import { A365DefenderInterceptor, addA365Defender, createProtectionEmitter } from '@microsoft/agents-a365-tooling-extensions-agenthooks';

const defender = new DefenderRtpClient();
const tokens = DefenderRtpTokenResolvers.fromAgenticConnection(adapter.connectionManager.getDefaultConnection());

const emitter = addA365Defender(
  createProtectionEmitter(),
  new A365DefenderInterceptor(
    defender,
    () => ({ agent: { agentId, tenantId, userId }, tokenResolver: tokens }),
    (result) => logger.info(`Defender ${result.interceptionPoint} allowed=${result.allowed} cid=${result.correlationId}`),
  ));

Testing

• npm run lint, npm run build and npm test pass locally (the tests workspace: 69 suites, 1569 tests, including the 252 new tests below).
• pnpm install --frozen-lockfile passes with pnpm 10.20.0, and pnpm pack publishes the peer range and no runtime dependency on agent-hooks.
• 138 DefenderRtpClient tests (tests/tooling/defender-rtp-client.test.ts). Each request body is checked against the endpoint's request validation rules (ported from the .NET tests). They cover:
  • the disabled client, and points Defender doesn't evaluate;
  • the correlation id, the agent identity, and no redirects;
  • tool-call and tool-result fitting, repair of loose optional fields, and clamping of each content string with identifiers left whole;
  • deny, allow with warnings and labels, and transform-as-block;
  • fail open and closed on HTTP errors, token failures and any other send or read error;
  • 400 validation rules, a 2xx with no decision, non-JSON, timeouts, and caller cancellation;
  • the scope, token caching, the shared acquisition, early refresh, prefetch, and the shared deadline;
  • https-only endpoints, an unknown fail mode rejected at construction, and linear-time trimming of the framework;
  • content longer than the limit at all four points: fail closed denies, fail open allows and says why, a Defender deny or transform of the copy stands, content at the limit is evaluated normally, and truncation outside the content under decision doesn't count;
  • the total budget:
    • the history is trimmed newest-first while the content under decision stays whole;
    • content under decision cut by the total is reported as truncated;
    • the fill order;
    • a 2 MB tool result is bounded to an ~80 KB request;
    • nesting is cut at 32 levels;
    • shared values are copied, and a circular reference is rejected;
    • a million empty messages, messages with null content, or nulls, empty strings or empty objects elsewhere keep the request under 400 KB without counting as truncation, while the same in the content under decision is reported as truncated;
    • only as many tools and messages as the budget can hold are read (counted through a proxy over a million-entry list), the history stops before an invalid message, and extension namespaces, other fields and keys that JSON leaves out are read only as far as the budget reaches;
  • the called tool: copied first from a list padded with 9,999 other declarations; charged before large post_tool_call arguments; unverified at both tool points when it lies beyond the first 10,000, or when its description or schema is cut; without it, a list of 10,000 declarations is not truncation and one of 10,001 is; and the other declarations following in host order;
  • session and trace reduced to their spec members of the right shape;
  • a session's sequence keeps increasing after the session is no longer tracked;
  • lone surrogates in values and keys, using both the native toWellFormed and the Node 18 fallback: the raw body has no \uD8xx escapes, and a payload behind a lone surrogate is still evaluated and denied. Keys that become one in the content under decision make the copy incomplete (fail closed denies, fail open allows and says why); elsewhere they don't count;
  • other shapes:
    • a string model, actor, tenant, tools or messages, a request_id that isn't a string (which falls back to the agent's), and an a365 extension that is a string, has a string tool, or is an array;
    • a string session, which is rejected;
    • deny and transform with a transform of another shape;
    • warnings and labels of another shape;
    • 400 diagnostics of another shape, and error bodies that aren't objects;
    • JWT payloads that aren't objects with a numeric exp (used, not cached);
  • the agent's tenant always sent, content strings never longer than the limit, and fields left over from another point (input, output, tool_call, tool_result) never sent at input, pre_tool_call or output.
• 21 DefenderRtpTokenResolvers.fromAgenticConnection tests: token URL and form fields, the assertion, Entra error codes without the body, non-2xx, malformed JSON, success responses of another shape (no or non-string access_token, an array, a string, null), error bodies of another shape, cancellation, an https-only authority, the token endpoint built from the parsed authority, and no redirects.
• 57 configuration tests covering defaults, the environment, overrides and validation, including ENABLE_A365_DEFENDER_RTP (true/false, 1/0, yes/no, on/off, and the rejection of anything else), open/closed in any case, the rejection of other fail modes, the upper bounds of the timeout and of the maximum content characters (2147483647: 308 nines, which would overflow the budget to Infinity, are rejected), and whole numbers for the timeout and the maximum content characters (10s, 1e4, 10.5, -5 and the like are rejected rather than read by parseInt; blank keeps the default).
• 36 A365DefenderInterceptor tests, run under the real agent-hooks native emitter. They cover:
  • forward and allow, a denied tool call, and warnings and labels on an allowed action;
  • verdict mapping with evidence;
  • fail open and fail closed when Defender is unavailable or slow;
  • an invalid identity, a throwing call resolver, a logging callback that throws or returns a rejecting thenable or a rejected promise from another realm, and a slow logging callback that runs only after the verdict is returned;
  • a Defender warning in the reserved host_error: namespace, remapped so the allow stands;
  • points Defender doesn't evaluate, the disabled client, and no resolved identity (which follows the fail mode);
  • 20,000 harmless characters followed by a blocked payload: denied as unverified when failing closed, allowed with the warning when failing open, and Defender's deny or transform of truncated content kept as a block, even failing open;
  • a deny with a transform of another shape still blocks as a detection; a context whose session isn't an object follows the fail mode without throwing; optional members of another shape are left out;
  • the emitter timeout rules, including interceptor timeouts outside Node's timer range.
• The new suites also pass on Node.js 18.20.8; the native module loads there despite the package's engines field (≥ 20).
• Verified live against the Microsoft Defender for AI prevention endpoint, with an agent-hooks emitter and A365DefenderInterceptor running fail-closed on Node.js 18 and 24.
  • It authenticated as an agent identity through fromAgenticConnection: an app-only token with RealtimeProtection.Evaluate.All.
  • Clean traffic was allowed at all four points.
  • A known-malicious URL in the tool arguments at pre_tool_call was denied (defender:block:prevention_blocked, with Defender's threat label on the verdict), and the tool did not run.
  • Padded input and a ~500 KB tool result were each accepted and evaluated on their truncated copies, then denied as unverified under fail-closed.
  • A body that had held a lone surrogate was accepted after normalization and evaluated.

Known limitations and follow-ups

• @responsibleai/agent-hooks is a peer dependency, tested with 0.1.0-alpha.5.
  • The range, >=0.1.0-alpha.5 <0.2.0, admits 0.1.0-beta.1. Development, tests and the lockfile pin 0.1.0-alpha.5.
  • It's a prerelease with a native core for linux-x64/arm64 (glibc), darwin-x64/arm64 and win32-x64 (no musl), and it needs Node.js 20+, so the new package declares engines.node >=20.
  • The .NET SDK uses 0.1.0-beta.1. Testing against beta.1 and moving the pin, with its lockfile update, is a follow-up.
• Long content follows the fail mode. This applies when the content under decision is longer than A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS, or more than its share of the 4× total, and Defender doesn't block the truncated copy.
  • Long base64 or multimodal content under decision is affected too, so agents that handle long content should raise the limit.
  • Evaluating long content in chunks is a follow-up.
• The budget counts more than string content. Keys and non-string values count toward the total. Nesting is cut at 32 levels, well under common JSON parser depth limits.
• transform is treated as a block. Rewrites aren't applied; transformPath is surfaced on the verdict.
• Not yet wired into the hosting pipeline. Hosts create the emitter and emit contexts themselves. Framework adapters (for example LangChain or OpenAI Agents SDK middleware) are follow-ups.
• The Defender permission needs the CLI change. a365 setup grants it only once Add Defender permissions part of "a365 setup all" Agent365-devTools#485 merges; until then a tenant administrator grants it once per agent blueprint, as the README describes.

Related work

• Add Microsoft Defender for AI real-time protection on agent-hooks Agent365-dotnet#266 and Add Microsoft Defender for AI real-time protection on agent-hooks Agent365-python#278: the .NET and Python parts of this change.
• Add Defender permissions part of "a365 setup all" Agent365-devTools#485: Defender permissions (RealtimeProtection.Evaluate.All) as part of a365 setup all.
• Supersedes Add opt-in Defender real-time protection client #277.

[Copilot]

🟡 Changes recommended

Fail-closed protection can be bypassed when identity resolution returns nothing, and dependency and truncation correctness issues remain.

3 open findings

• Missing identity bypasses Defender RTP fail-closed handling · New
• Declare agent-hooks dependency in the tests workspace · New
• Ensure truncation marker stays within maxCharacters · New

What changed in this PR

Adds opt-in Microsoft Defender for AI real-time protection, including a core client and an agent-hooks integration package.

Changes:

• Adds Defender request normalization, authentication, token caching, verdict handling, and configuration.
• Adds an agent-hooks interceptor and protection emitter.
• Adds tests, dependency metadata, and documentation.

File	Description
tests/​tooling/​fixtures/​defender.ts	Adds Defender test fixtures.
tests/​tooling/​defender-rtp-client.test.ts	Tests client behavior and authentication.
tests/​tooling/​configuration/​DefenderRtpConfiguration.test.ts	Tests Defender configuration.
tests/​tooling-extensions-agenthooks/​A365DefenderInterceptor.test.ts	Tests interceptor verdict handling.
tests/​package.json	Adds tooling test dependency.
tests/​jest.config.cjs	Maps the new package.
tests/​all-packages-coverage.test.ts	Excludes the native extension from coverage imports.
README.md	Lists the new package.
pnpm-workspace.yaml	Catalogs agent-hooks.
pnpm-lock.yaml	Locks new package dependencies.
packages/​agents-a365-tooling/​src/​index.ts	Exports Defender APIs.
packages/​agents-a365-tooling/​src/​defender/​index.ts	Defines Defender exports.
packages/​agents-a365-tooling/​src/​defender/​DefenderRtpTokenResolvers.ts	Implements app-only token exchange.
packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts	Implements Defender evaluation.
packages/​agents-a365-tooling/​src/​defender/​contracts.ts	Defines Defender contracts.
packages/​agents-a365-tooling/​src/​configuration/​ToolingConfigurationOptions.ts	Adds configuration overrides.
packages/​agents-a365-tooling/​src/​configuration/​ToolingConfiguration.ts	Reads and validates Defender settings.
packages/​agents-a365-tooling/​README.md	Introduces Defender support.
packages/​agents-a365-tooling/​docs/​design.md	Documents client architecture.
packages/​agents-a365-tooling-extensions-agenthooks/​tsconfig.json	Configures TypeScript compilation.
packages/​agents-a365-tooling-extensions-agenthooks/​tsconfig.esm.json	Configures ESM output.
packages/​agents-a365-tooling-extensions-agenthooks/​tsconfig.cjs.json	Configures CommonJS output.
packages/​agents-a365-tooling-extensions-agenthooks/​src/​index.ts	Exports extension APIs.
packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365DefenderInterceptor.ts	Maps Defender evaluations to verdicts.
packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365AgentHooks.ts	Creates and configures emitters.
packages/​agents-a365-tooling-extensions-agenthooks/​README.md	Documents installation and usage.
packages/​agents-a365-tooling-extensions-agenthooks/​package.json	Defines the new package.
packages/​agents-a365-tooling-extensions-agenthooks/​docs/​design.md	Documents extension architecture.
HOW_TO_RELEASE.md	Adds the package to releases.
HOW_TO_BUILD.md	Adds build and package instructions.
generate-package-dependencies.js	Classifies the extension package.
docs/​design.md	Updates repository architecture.
DEPENDENCIES.md	Updates the dependency graph.
CLAUDE.md	Updates development guidance.
CHANGELOG.md	Records Defender functionality.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Tenant validation, dynamic timeout handling, and the missing direct agent-hooks test dependency must be corrected.

4 open findings

• Overwrite tenant.id with agent.tenantId in A2A contexts · New
• Declare agent-hooks dependency in the tests workspace
• Missing identity bypasses Defender RTP fail-closed handling
• Ensure truncation marker stays within maxCharacters

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (1)

In code that hasn't changed since last review

Avoid snapshotting dynamic Defender timeouts at emitter creation

packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365AgentHooks.ts:43

This snapshots a potentially per-request timeout when the emitter is created. Configuration override functions are explicitly dynamic, and the README permits a shared emitter with per-request configuration; if a later request returns a larger Defender timeout, the emitter's fixed timeout fires first and denies instead of applying the configured fail mode. Require callers using dynamic providers to supply a timeout above the maximum possible value, or create the emitter from each effective configuration.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Tenant enforcement, hard truncation limits, dynamic timeout handling, and test dependency declaration need correction.

4 open findings

• Overwrite tenant.id with agent.tenantId in A2A contexts
• Declare agent-hooks dependency in the tests workspace
• Missing identity bypasses Defender RTP fail-closed handling
• Ensure truncation marker stays within maxCharacters

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (2)

In code that hasn't changed since last review

Support dynamic per-request timeout overrides safely

packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365AgentHooks.ts:43

This samples the Defender timeout only when the emitter is created, although configuration override functions are explicitly per-request (DefaultConfigurationProvider.ts:17-30). With a shared emitter, a tenant can later resolve a timeout larger than this static emitter timeout, causing agent-hooks to deny with host_error:interceptor_timeout before the client's configured fail mode runs. Require an explicit emitter timeout above the maximum dynamic value, or otherwise make the guarantee hold for per-request timeout overrides.

Declare agent-hooks as a tests workspace dependency

tests/​tooling-extensions-agenthooks/​A365DefenderInterceptor.test.ts:5

This test workspace imports @responsibleai/agent-hooks directly, but tests/package.json does not declare it; only the sibling extension package does. Under pnpm's isolated dependency linking, this relies on incidental hoisting and can fail module resolution in a clean install. Add the catalog dependency to the tests workspace and update the lockfile.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Normalized key collisions can bypass fail-closed validation, and invoked tools can be omitted from Defender declarations.

3 open findings

• Detect key collisions during normalization and mark the decision as cut · New
• Declare agent-hooks dependency in the tests workspace
• Include the invoked tool when context.tools omits it · New

3 resolved since last review

• Overwrite tenant.id with agent.tenantId in A2A contexts
• Missing identity bypasses Defender RTP fail-closed handling
• Ensure truncation marker stays within maxCharacters

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Invalid fail-mode values can silently downgrade protection, and asynchronous listener failures are not reliably contained.

0 open findings

3 resolved since last review

• Detect key collisions during normalization and mark the decision as cut
• Declare agent-hooks dependency in the tests workspace
• Include the invoked tool when context.tools omits it

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (2)

In code that hasn't changed since last review

Handle cross-realm promises and thenables safely

packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365DefenderInterceptor.ts:181

instanceof Promise misses PromiseLike values and promises created in another realm. A rejected logging callback of either kind can therefore become an unhandled rejection, despite this method's guarantee that listener failures do not affect execution. Normalize thenables with Promise.resolve before attaching the rejection handler.

Reject invalid fail-open configuration values

packages/​agents-a365-tooling/​src/​configuration/​ToolingConfiguration.ts:189

Any value other than the exact string closed silently selects fail-open. A typo such as clsoed therefore disables the intended protection precisely when Defender is unavailable. Treat only an absent value or open as open, accept closed, and reject every other value.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Malformed trace metadata can reach Defender unchanged and cause fail-open evaluation bypasses.

1 open finding

• Validate trace shape before forwarding to prevent fail-open bypass · New

1 resolved since last review

• Reject timeouts exceeding Node's timer limit

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

3 open findings

• This validation only checks the URL protocol, not that the URL is actually absolute with a… · New
• The helper claims to validate an absolute https URL, but it only checks protocol. Values like… · New
• The fail-closed message string is duplicated here and in DefenderRtpClient… · New

1 resolved since last review

• Validate trace shape before forwarding to prevent fail-open bypass

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Lite

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Redirect handling can expose sensitive contexts or assertions, and several payload/verdict validation gaps can bypass intended protection behavior.

1 open finding

• Reject token endpoint redirects to prevent assertion disclosure · New

3 resolved since last review

• The helper claims to validate an absolute https URL, but it only checks protocol. Values like…
• This validation only checks the URL protocol, not that the URL is actually absolute with a…
• The fail-closed message string is duplicated here and in DefenderRtpClient…

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (2)

In code that hasn't changed since last review

Remap reserved host_error warnings from Defender verdicts

packages/​agents-a365-tooling-extensions-agenthooks/​src/​A365DefenderInterceptor.ts:128

Agent-hooks reserves the host_error: warning namespace for host-generated failures. Passing a Defender warning such as host_error:spoofed through unchanged makes the emitter reject an otherwise valid allow and synthesize a fail-closed host error. Map empty or reserved reasons to defender:warning before returning the verdict.

Restrict tenant copying to accepted fields and size bounds

packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts:356

copyJson uses an infinite budget, and when the host tenant ID matches, every tenant property is spread into the request. A host-supplied tenant extension containing a very large array/object therefore bypasses the advertised 4× content bound (and is traversed in full). Rebuild this envelope from accepted spec fields such as id and name, as is already done for agent/session/actor/model/trace.

This issue also appears in the following locations of the same file:

• line 455
• line 542

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Generated sequences can regress, and context preparation can let the emitter timeout bypass the configured Defender fail mode.

0 open findings

1 resolved since last review

• Reject token endpoint redirects to prevent assertion disclosure

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (2)

In code that hasn't changed since last review

Start the Defender deadline before context preparation

packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts:209

The client deadline starts only after prepare has fitted the context, while the agent-hooks emitter timeout already covers the interceptor. Because defenderRtpMaxContentCharacters has no upper bound, fitting a correspondingly large context can consume the fixed 2-second margin and make the emitter return host_error:interceptor_timeout before the client applies its configured fail mode. Start the Defender deadline before preparation (and dispose it if preparation throws) so it is always scheduled ahead of the emitter timeout.

Track explicit sequences to preserve monotonic session ordering

packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts:353

A valid explicit sequence is forwarded without updating this session's generated-sequence high-water mark. If the host sends sequence 7 and the next context omits it, nextSequence emits 1, breaking the agent-hooks monotonic sequence contract and misordering Defender/audit records. Record explicit values in the per-session tracker (without lowering an existing high-water mark) before generating later missing values.

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Sequence tracking and cross-point field sanitization can produce invalid or non-conformant Defender contexts.

0 open findings

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (2)

In code that hasn't changed since last review

Explicit sequences do not advance generated sequence values

packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts:353

When a session mixes host-supplied and generated sequences, the generated value can move backwards. For example, an explicit sequence: 100 followed by an omitted sequence produces 1, because explicit values never update this.sequences. AGENT-HOOKS-0.1 requires sequence to be strictly increasing across all interception points in a session. Record valid explicit values (at least the per-session maximum) before generating later values, including the existing eviction behavior.

Generic copying bypasses sanitization for other point fields

packages/​agents-a365-tooling/​src/​defender/​DefenderRtpClient.ts:456

Only the current point's field is reserved here. Fields for other points fall through to the generic copier without their contract-specific sanitization; for example, an input context with a stale tool_call: { provider_meta: ... } sends that member unchanged, which the Defender validator rejects and turns into an unverified fail-mode result. Reserve all point fields from generic copying so only the field rebuilt for the active point is emitted.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The maximum-content setting can overflow the request budget and disable bounded context copying.

1 open finding

• Reject oversized numeric budgets before multiplication · New

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The large security-sensitive authentication, fail-mode, payload-truncation, and prerelease native dependency surface warrants final human review.

0 open findings

1 resolved since last review

• Reject oversized numeric budgets before multiplication

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced