fix: filter TOOL_CALL and TOOL_RESPONSE messages from managed-agent summary

[rkfshakti]

Problem

When a MultiStepAgent is used as a managed sub-agent with provide_run_summary=True, the parent's tool observation contains the sub-agent's entire internal message history — including TOOL_CALL and TOOL_RESPONSE messages that leak raw tool arguments, observations, and potentially PII/secrets into the parent agent's context.

Root cause

summary_mode=True in ActionStep.to_messages() only suppresses the assistant's model_output text. TOOL_CALL and TOOL_RESPONSE messages are still emitted, so the summary still contains "Calling tools:" and "Observation:" entries with full tool I/O.

Fix

Filter out TOOL_CALL and TOOL_RESPONSE messages at the ManagedAgent.__call__ boundary before appending to the summary. Only ASSISTANT, USER, and SYSTEM messages are included, which contain the final answer and high-level task information without raw tool internals.

Testing

• All 95 existing tests pass (2 skipped, pre-existing)
• The fix is minimal — 5 lines added, no new dependencies

Fixes #2424

[gnanirahulnutakki]

One scope-blocking finding. AI-assisted review; I verified it against the PR's current two-commit diff and the separate #2564 branch.

[gnanirahulnutakki]

Could you remove this file/commit from this PR? The branch currently includes commit 874a6f7 and 67 lines of big-integer executor changes from #2564 / #2473, while this PR is scoped to #2424 and the managed-agent summary. As-is, merging would couple unrelated runtime behavior, duplicate #2564, and make the stated five-line/test scope inaccurate. Rebasing and cherry-picking 2deb0a6 onto current main should isolate the intended fix.

[rkfshakti]

please review ; i have made the changes

[rkfshakti]

@gnanirahulnutakki — thanks for catching that. The branch was based on #2564's commit by mistake. I've rebased to drop the unrelated big-integer changes — the PR now contains only the managed-agent summary fix (single commit on current main). Ready for re-review. Thanks!

[gnanirahulnutakki]

The unrelated commit is gone; exact head ebd418003d14 is now one commit and one source file. The existing managed-agent summary test cases and Ruff pass locally. One remaining regression-coverage gap is noted inline. Full extras are not installable on this macOS host because optional Linux-only bashkit/NVIDIA wheels are unavailable, so I validated with the repository's minimal editable test setup.

[gnanirahulnutakki]

[P2] Add regression coverage for the filtered roles

The existing test_call_with_provide_run_summary only supplies an ASSISTANT message, so it passes even if this condition is removed or later regresses. Because the fix is specifically meant to prevent raw tool arguments/outputs (and potentially secrets) from entering the parent context, please extend that test to return ASSISTANT, TOOL_CALL, and TOOL_RESPONSE messages, then assert the assistant summary remains while the raw tool-call and tool-response payloads are absent.

[rkfshakti]

Thanks for the regression-coverage note — agreed the old test only carried an ASSISTANT message and would have stayed green if the filter regressed.

I added test_call_with_provide_run_summary_filters_tool_messages (commit e5685e0). It feeds the summary loop an ASSISTANT message, a TOOL_CALL carrying a fake secret (SUPER_SECRET_API_KEY=sk-leak), a TOOL_RESPONSE carrying password=hunter2, and a second ASSISTANT message, then asserts both assistant summaries are present while the raw tool arguments/observations are absent. I confirmed it fails on the pre-fix code (the secret leaks into the parent context) and passes with the filter in place. Ruff is clean on the changed files.

[gnanirahulnutakki]

Re-reviewed on e5685e0. The new regression feeds the managed-agent summary both assistant messages and secret-like TOOL_CALL/TOOL_RESPONSE payloads, then verifies the assistant summaries remain while the raw tool data is absent. Locally, all three focused provide_run_summary tests passed, and Ruff check plus format verification passed on both changed files. This addresses the regression-coverage finding.