Skip to content

fix: propagate authorization header to subagents#1757

Open
towsif-rahman wants to merge 3 commits intokagent-dev:mainfrom
towsif-rahman:fix/subagent-authorization-forwarding
Open

fix: propagate authorization header to subagents#1757
towsif-rahman wants to merge 3 commits intokagent-dev:mainfrom
towsif-rahman:fix/subagent-authorization-forwarding

Conversation

@towsif-rahman
Copy link
Copy Markdown

@towsif-rahman towsif-rahman commented Apr 26, 2026

Summary

  • Pass parent session headers into sub-agent A2A call contexts for both initial calls and HITL resume calls.
  • Forward the parent Authorization header from _SubagentInterceptor while preserving existing x-user-id and x-kagent-source headers.
  • Add focused unit coverage for context header propagation and interceptor filtering behavior.

Test plan

  • UV_NATIVE_TLS=true UV_PROJECT_ENVIRONMENT=/home/ubuntu/oneai_devops/kagent/.venv ../.venv/bin/uv run --python /home/ubuntu/oneai_devops/kagent/.venv/bin/python pytest ./packages/kagent-adk/tests/unittests/test_remote_a2a_tool.py

Closes #1745

Copilot AI review requested due to automatic review settings April 26, 2026 16:18
@github-actions github-actions Bot added the bug Something isn't working label Apr 26, 2026
@github-actions github-actions Bot added bug Something isn't working and removed bug Something isn't working labels Apr 26, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Propagates the parent agent session’s request headers (notably Authorization) into sub-agent A2A calls so JWT/auth context is preserved across supervisor → sub-agent delegation, including HITL resume flows.

Changes:

  • Add _build_subagent_call_context() to include session.state["headers"] in ClientCallContext for both first-call and resume paths.
  • Update _SubagentInterceptor to forward the parent Authorization header (case-insensitive) while preserving existing x-user-id and x-kagent-source behavior.
  • Add unit tests covering call context header propagation and interceptor filtering/override behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
python/packages/kagent-adk/src/kagent/adk/_remote_a2a_tool.py Build A2A call contexts with session headers and forward Authorization via the subagent interceptor.
python/packages/kagent-adk/tests/unittests/test_remote_a2a_tool.py Add focused unit tests for header propagation into call contexts and for interceptor behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread python/packages/kagent-adk/src/kagent/adk/_remote_a2a_tool.py
@towsif-rahman towsif-rahman force-pushed the fix/subagent-authorization-forwarding branch from 8678a21 to d8551b4 Compare April 26, 2026 16:34
Signed-off-by: Towsif Rahman <towsif.rahman@sanofi.com>
@towsif-rahman towsif-rahman force-pushed the fix/subagent-authorization-forwarding branch from d8551b4 to 97adb51 Compare April 26, 2026 16:59
Copy link
Copy Markdown
Contributor

@supreme-gg-gg supreme-gg-gg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @towsif-rahman, the changes look good here. Can you also do it for the go runtime: https://github.com/kagent-dev/kagent/blob/main/go/adk/pkg/tools/remote_a2a_tool.go

@supreme-gg-gg supreme-gg-gg self-assigned this Apr 27, 2026
Signed-off-by: Towsif Rahman <towsif.rahman@sanofi.com>
@towsif-rahman towsif-rahman force-pushed the fix/subagent-authorization-forwarding branch from 33e76c2 to d381ee9 Compare April 28, 2026 12:58
@towsif-rahman
Copy link
Copy Markdown
Author

@supreme-gg-gg Added same implementation to Go runtime

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE] _SubagentInterceptor should forward Authorization header from parent session to sub-agent A2A calls

4 participants