From 06b6c01f1ed7dcb2e427e8368d4c212575cf6fce Mon Sep 17 00:00:00 2001 From: khanhphamj Date: Mon, 9 Nov 2026 09:03:49 +0700 Subject: [PATCH 1/2] HITL template test: do not assert that a re-asked card keeps its interrupt id langgraph 1.2.20 issues a new id there; the contract is that the client echoes the id it was given. Fixes the red upgrade CI job (it re-locks an old project and picked up 1.2.20). Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 5 +++++ .../agentbase-build-hitl/assets/backend/tests/test_hitl.py | 5 ++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c3dac91..bdfe60d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,11 @@ review can tell which standard a project was built from. ## Unreleased +- **Template test:** `test_approval_node_reasks_instead_of_applying_unknown_ids` no longer asserts that a re-asked HITL card + keeps its id. langgraph 1.2.20 issues a new interrupt id there (1.2.18 kept it); the documented contract (every card has its + own id, the client echoes the one it was given) is unchanged and the test still resumes with the id it receives. This turned the + CI `upgrade` job red on 2026-11-09: it re-locks an old project, which picked up langgraph 1.2.20, while the shipped + `uv.lock` still pins 1.2.18. - **Docs re-read (2026-11): skills corrected where the AgentBase docs say otherwise** (docs-only; no template code changed). Runtime Inbound Auth `IAM Permissions` / `JWT` **strips `Authorization` before the container** (only *No authorization* forwards it) and the Console now defaults a new Runtime to IAM: `agentbase-build-deploy`, `-auth`, `-web`, `-frontend` and diff --git a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py index d934ff2..8ce35be 100644 --- a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py +++ b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py @@ -256,7 +256,10 @@ async def test_approval_node_reasks_instead_of_applying_unknown_ids(fake_llm, mo check = service.stale_decision_ids monkeypatch.setattr(service, "stale_decision_ids", lambda *a: set()) again = await service.handle(_approve("c1"), ctx("hitl-r3")) - assert again["status"] == "interrupted" and again["interrupt"]["id"] == card2["id"] + assert again["status"] == "interrupted" + # the re-asked card keeps its id (langgraph <= 1.2.18) or gets a new one (>= 1.2.20): the contract is only that the + # client echoes the id it was given, which the last resume below does + assert isinstance(again["interrupt"]["id"], str) and again["interrupt"]["id"] assert [tc["id"] for tc in again["interrupt"]["tool_calls"]] == ["c2"] monkeypatch.setattr(service, "stale_decision_ids", check) done = await service.handle(_approve("c2", again["interrupt"]["id"]), ctx("hitl-r3")) From e09deb572f9a8f36da7c36fe182356822bb036e1 Mon Sep 17 00:00:00 2001 From: khanhphamj Date: Mon, 9 Nov 2026 09:05:39 +0700 Subject: [PATCH 2/2] HITL test: keep the second card's tool-call check (ruff F841) Co-Authored-By: Claude Sonnet 5.5 --- skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py | 1 + 1 file changed, 1 insertion(+) diff --git a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py index 8ce35be..0c8761c 100644 --- a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py +++ b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py @@ -253,6 +253,7 @@ async def test_approval_node_reasks_instead_of_applying_unknown_ids(fake_llm, mo _two_cards(fake_llm) await service.handle({"message": "remember x then y"}, ctx("hitl-r3")) card2 = (await service.handle(_approve("c1"), ctx("hitl-r3")))["interrupt"] + assert [tc["id"] for tc in card2["tool_calls"]] == ["c2"] check = service.stale_decision_ids monkeypatch.setattr(service, "stale_decision_ids", lambda *a: set()) again = await service.handle(_approve("c1"), ctx("hitl-r3"))