Microsoft Agent Framework

inis-agent-framework is a native inis.run CodeAct provider for Microsoft Agent Framework (agent_framework.ContextProvider) — gives an Agent a real, isolated execute_code tool backed by inis.run's persistent Python interpreter.

Install

pip install inis-agent-framework

Quickstart: attached (recommended)

One inis.run session for the whole conversation, owned by your app:

from inis import AsyncClient
from agent_framework import Agent
from inis_agent_framework import InisCodeActProvider

client = AsyncClient()
session = await client.sessions.create(egress_default="deny")
codeact = InisCodeActProvider.wrap(session)

agent = Agent(client=chat_client, name="assistant", context_providers=[codeact])
await agent.run("Use execute_code to compute 6 * 7.")
await session.destroy()  # this app owns the session; the provider never will

Reconnect a later process to the same persistent interpreter context by session ID alone — no snapshot, no workspace round-trip:

codeact = InisCodeActProvider.attach("9hmquuxiz7qyqdqiwfvep")
agent = Agent(client=chat_client, context_providers=[codeact])
await agent.run("What was x again?")  # sees state from the earlier process

Owned: the provider creates and destroys the session for you

from inis_agent_framework import InisCodeActProvider

codeact = await InisCodeActProvider.create(egress_default="deny")
try:
    agent = Agent(client=chat_client, context_providers=[codeact])
    await agent.run("...")
finally:
    await codeact.aclose()  # destroys the session

Either way, only execute_code is model-visible.

Persistent interpreter state, not a fresh one per call

execute_code runs through a real persistent Python process inside the session: a variable set in one call is still there in the next one, across separate tool calls and separate agent.run() invocations against the same session, until restart_context() is called or the session is torn down.

What it does

• execute_code (persistent Python interpreter) — text/image/table/json/error results mapped to agent_framework.Content
• Interpreter state across calls and agent.run() invocations — .attach() resumes the same context
• restart_context() — discards the interpreter context without touching the session's filesystem or lifecycle
• Owned/attached lifecycle split — .create() owns and destroys; .wrap()/.attach() never do

Notes

call_tool bridging to host-registered tools is not implemented, deliberately: inis.run's execute_code runs in a real remote VM with no channel for the guest to call an arbitrary host function mid-cell — that would let sandboxed code call any tool the agent has, unbounded. Host-directory binding (workspace_root/file_mounts) is not implemented either — an inis.run session runs on separate hardware; use session.read_file()/write_file() directly instead. True remote cancellation of an in-flight execute_code call is not implemented — timeout-only; a timeout still ends the call and the interpreter context stays usable afterward.