skip_summarization text-append in __build_response_event is not scoped to AgentTool

[lwangverizon]

Description

The skip_summarization text-append in __build_response_event
(src/google/adk/flows/llm_flows/functions.py) is not scoped to AgentTool,
so it fires for every tool that sets skip_summarization. For non-AgentTool
tools whose function response is an internal acknowledgement, this surfaces the
raw response payload to the user as visible text.

Background

PR #5974 (closing #3881) added this block so an AgentTool's output is not lost
in UIs that don't render function responses:

# src/google/adk/flows/llm_flows/functions.py  (current main)
has_displayable_result = display_result is not None and display_result != {
    'result': None
}
if (
    tool_context.actions.skip_summarization
    and 'error' not in function_result
    and has_displayable_result
):
    if isinstance(display_result, str):
        result_text = display_result
    else:
        result_text = json.dumps(display_result, ensure_ascii=False, default=str)
    content.parts.append(types.Part.from_text(text=result_text))

Issue #3881 is specifically about AgentTool (its title: "The agent doesn't
work as expected when skip_summarization is set to True in AgentTool"), and the
PR title is "ensure AgentTool text output when skip_summarization is True". But
the condition only checks tool_context.actions.skip_summarization — there is no
isinstance(tool, AgentTool) guard, so the behavior applies to all tools.

Why this is a problem

skip_summarization is also set by tools for the opposite reason: their
function response is an internal acknowledgement that should not be summarized
or shown. UI / widget-rendering tools are the common case — they return
something like {"status": "ok"} and set skip_summarization=True because the
user-facing result is a rendered widget, not text.

With the unguarded append, that ack is force-converted into a text Part. A
text part then bypasses the typical UI/SSE filters that strip
functionResponse / functionCall / thought parts, so the raw payload
({"status": "ok", ...}) is surfaced to the user as visible text. We observed
this as a consistent, user-visible regression after upgrading to a build that
contains #5974: render-style tools began leaking their ack JSON into the chat
transcript.

Steps to reproduce

1. Define a non-AgentTool (e.g. a FunctionTool) that sets
   tool_context.actions.skip_summarization = True and returns a dict such as
   {"status": "ok"}.
2. Invoke it through the normal function-calling flow.
3. The resulting function-response event contains an extra Part.from_text(...)
   with the serialized dict, in addition to the functionResponse part.

Expected: only the functionResponse part is present (the ack is not shown as
text). Actual: a text part carrying the serialized response is appended.

Proposed fix

Guard the append with isinstance(tool, AgentTool) so it matches the original
intent — AgentTool keeps its text output; other tools that opt out of
summarization do not have their function response duplicated as text.

A PR implementing this (with a regression test) is attached.

Environment

• ADK: current main
• Affected since: PR feat(skills): Allow opt-in session state injection in skill instructions #5974 / commit "fix: ensure AgentTool text output when
  skip_summarization is True"

[sanketpatil06]

Hi @lwangverizon , Thank you for providing these details. To help us fully understand the issue, could you please share a minimal reproducible example? This will allow us to recreate the problem exactly as you are experiencing it.

[jb-delafosse]

I hit this same regression and put together a minimal reproduction through the public Runner API (no private functions), plus a version bisection that pins exactly where the behavior changed.

Setup: a plain FunctionTool (not an AgentTool) sets skip_summarization=True because its result is an internal acknowledgement — a control signal (e.g. a widget-render or hand-off ack), not user-facing text. The user should never see this JSON.

"""Minimal repro for #6230 — skip_summarization text-append not scoped to AgentTool.

    pip install google-adk==<version>
    python repro.py
"""
import asyncio
from typing import AsyncGenerator

import google.adk
from google.adk.agents.llm_agent import LlmAgent
from google.adk.models.base_llm import BaseLlm
from google.adk.models.llm_request import LlmRequest
from google.adk.models.llm_response import LlmResponse
from google.adk.runners import InMemoryRunner
from google.adk.tools.tool_context import ToolContext
from google.genai import types

_calls = {"n": 0}


def ack_tool(tool_context: ToolContext) -> dict:
    """A non-AgentTool returning an internal ack that must NOT be shown.

    It sets skip_summarization because the result is a control signal
    (e.g. a widget-render or hand-off ack), not user-facing text.
    """
    tool_context.actions.skip_summarization = True
    return {"status": "ok", "detail": "internal ack - should not be shown"}


class FakeLlm(BaseLlm):
    """Turn 1: call ack_tool. Turn 2: end with empty text (no summary)."""

    async def generate_content_async(
        self, llm_request: LlmRequest, stream: bool = False
    ) -> AsyncGenerator[LlmResponse, None]:
        _calls["n"] += 1
        if _calls["n"] == 1:
            yield LlmResponse(content=types.Content(role="model", parts=[
                types.Part(function_call=types.FunctionCall(
                    id="fc-1", name="ack_tool", args={}))]))
        else:
            yield LlmResponse(content=types.Content(
                role="model", parts=[types.Part(text="")]))


async def main():
    print(f"google-adk {google.adk.version.__version__}")
    agent = LlmAgent(
        name="router", model=FakeLlm(model="fake"), tools=[ack_tool],
        instruction="Call ack_tool.")
    runner = InMemoryRunner(agent=agent, app_name="repro")
    session = await runner.session_service.create_session(
        app_name="repro", user_id="u1")

    parts_seen = []
    async for event in runner.run_async(
        user_id="u1", session_id=session.id,
        new_message=types.Content(role="user", parts=[types.Part(text="hi")]),
    ):
        for part in (event.content.parts if event.content else None) or []:
            if part.function_response is not None:
                parts_seen.append("function_response")
                print("  function_response Part:", part.function_response.response)
            if part.text:
                parts_seen.append("text")
                print("  text Part (LEAKED):", repr(part.text))

    leaked = "text" in parts_seen
    print(f"\nfunction-response event parts: {parts_seen}")
    print("RESULT:", "LEAK (bug present)" if leaked
          else "clean (only function_response, no text)")


asyncio.run(main())

Results (same script, three versions):

google-adk 2.3.0
  function_response Part: {'status': 'ok', 'detail': 'internal ack - should not be shown'}
function-response event parts: ['function_response']
RESULT: clean (only function_response, no text)

google-adk 2.4.0
  function_response Part: {'status': 'ok', 'detail': 'internal ack - should not be shown'}
  text Part (LEAKED): '{"status": "ok", "detail": "internal ack - should not be shown"}'
function-response event parts: ['function_response', 'text']
RESULT: LEAK (bug present)

google-adk 2.5.0
  function_response Part: {'status': 'ok', 'detail': 'internal ack - should not be shown'}
  text Part (LEAKED): '{"status": "ok", "detail": "internal ack - should not be shown"}'
function-response event parts: ['function_response', 'text']
RESULT: LEAK (bug present)

Bisection: clean on 2.3.0, regressed in 2.4.0, still present on 2.5.0. That matches PR #5974 (commit b983fcf) landing in 2.4.0 — 2.3.0's __build_response_event has no skip_summarization text-append, while 2.4.0+ appends the serialized response as a text Part.

Expected: only the function_response Part is emitted (2.3.0 behavior); the ack is not surfaced as text.
Actual (2.4.0+): an extra text Part carrying the serialized response is appended. It then bypasses UI/SSE filters that only strip functionResponse/functionCall/thought parts, so the raw payload shows up as visible chat text.

The isinstance(tool, AgentTool) guard in #6231 fixes this — ack_tool above is a FunctionTool, so it would no longer get the text-append.