[BUG] Nested agent-as-tool interrupts don't resume across rehydration (stateless / distributed execution)

[seanalbert]

Checks

• I have updated to the lastest minor and patch version of Strands
• I have checked the documentation and this is not expected behavior
• I have searched ./issues and there are no duplicates of my issue

SDK Language

Python

Strands Version

1.41.0

Language Runtime Version

python 12

Operating System

macOS 26.5.1

Installation Method

pip

Steps to Reproduce

1. Create a sub-agent with a tool guarded by a BeforeToolCallEvent hook that raises an interrupt (event.interrupt(...)) for human confirmation.
2. Expose it on an orchestrator via orchestrator = Agent(tools=[sub_agent.as_tool(preserve_context=True)]).
3. Turn 1: invoke the orchestrator so the model calls the sub-agent tool, which triggers the interrupt. Confirm result.stop_reason == "interrupt".
4. Simulate a restart: discard the orchestrator and sub-agent objects and rebuild both fresh from the session store (new process / new instances), exactly as a stateless handler would on the next request.
5. Turn 2: resume by invoking the orchestrator with the interrupt response:
   orchestrator([{"interruptResponse": {"interruptId": <id>, "response": "APPROVE"}}]).
   Minimal illustration of the "restart":

# Turn 1 (process A)
orchestrator = build_orchestrator(session_id="s1")   # sub-agent wrapped via .as_tool()
r1 = orchestrator("do the thing that needs confirmation")
assert r1.stop_reason == "interrupt"
interrupt_id = next(iter(orchestrator._interrupt_state.interrupts))
# ---- process A dies ----
# Turn 2 (process B): everything rebuilt from storage
orchestrator = build_orchestrator(session_id="s1")   # fresh objects, restored from session
r2 = orchestrator([{"interruptResponse": {"interruptId": interrupt_id, "response": "APPROVE"}}])

Expected Behavior

On Turn 2, the sub-agent resumes the original pending tool call (same toolUseId), applies the human's response, executes the confirmed tool once, and the orchestrator completes (r2.stop_reason == "end_turn").

Actual Behavior

The sub-agent does not receive the response. It restarts its turn from scratch, the model emits a new toolUseId, the BeforeToolCallEvent hook recomputes a new interrupt id, and the confirmation is requested again. r2.stop_reason is "interrupt" again — an infinite re-prompt loop; the confirmed tool never runs.

Additional Context

Nested resume relied on shared object identity:

The tool executor registers the sub-agent's live Interrupt object into the orchestrator's _interrupt_state by reference (setdefault).
_InterruptState.resume() sets .response on the orchestrator's copy, while _AgentAsTool._build_interrupt_responses() reads .response off the sub-agent's copy.
In one process these are the same object, so it "just works." After rehydration they are two independent objects with the same id, so the response written to the orchestrator's copy is invisible to the sub-agent's copy → _build_interrupt_responses() returns an empty list → the sub-agent re-interrupts.
This is compounded by BeforeToolCallEvent._interrupt_id being derived from the random toolUseId, so a restarted sub-agent can't even produce a matching id once it regenerates the tool call.

Possible Solution

#3008

Related Issues

No response

[JackYPCOnline]

/strands bug-verify

[github-actions]

🔎 Automated Bug Verification

I couldn't run this from the report as written (the snippet uses a placeholder build_orchestrator with no model/session store), but I built a minimal reproduction that does trigger the described behavior, and it confirms the bug.

Environment: Strands @ workspace HEAD (main, commit 531d526) · Python 3.13.14 · Linux CI sandbox

The key finding: an identical single-process run (no restart) resumes correctly (end_turn, tool runs once), while the rehydrated run re-interrupts and never runs the confirmed tool — isolating the defect to object identity across rehydration, exactly as you described. The response is written to the orchestrator's Interrupt copy but read off the sub-agent's now-independent copy (_build_interrupt_responses() returns []).

import sys, tempfile
sys.path.insert(0, "src"); sys.path.append("tests")

from strands import Agent, tool
from strands.hooks import BeforeToolCallEvent, HookProvider, HookRegistry
from strands.session.file_session_manager import FileSessionManager
from fixtures.mocked_model_provider import MockedModelProvider  # test fixture

STORAGE = tempfile.mkdtemp(); SESSION_ID = "s1"
executed = {"count": 0}


@tool
def dangerous_action(target: str) -> str:
    """Perform a dangerous action that requires confirmation."""
    executed["count"] += 1
    return f"done: {target}"


class ConfirmHook(HookProvider):
    def register_hooks(self, registry: HookRegistry, **kwargs) -> None:
        registry.add_callback(BeforeToolCallEvent, self._confirm)

    def _confirm(self, event: BeforeToolCallEvent) -> None:
        if event.tool_use["name"] != "dangerous_action":
            return
        if event.interrupt("confirm_dangerous", reason="confirm?") != "APPROVE":
            event.cancel_tool = "not approved"


def build_sub(model):
    return Agent(name="worker", agent_id="worker", model=model, tools=[dangerous_action],
                 hooks=[ConfirmHook()], callback_handler=None,
                 session_manager=FileSessionManager(SESSION_ID, storage_dir=STORAGE))


def build_orch(model, sub):
    return Agent(name="orchestrator", agent_id="orchestrator", model=model,
                 tools=[sub.as_tool(preserve_context=True)], callback_handler=None,
                 session_manager=FileSessionManager(SESSION_ID, storage_dir=STORAGE))


def tu(tid, name, inp):
    return {"role": "assistant", "content": [{"toolUse": {"toolUseId": tid, "name": name, "input": inp}}]}


def txt(t):
    return {"role": "assistant", "content": [{"text": t}]}


# Turn 1 (process A)
sub_a = build_sub(MockedModelProvider([tu("sub-tu-1", "dangerous_action", {"target": "prod-db"}), txt("done")]))
orch_a = build_orch(MockedModelProvider([tu("orch-tu-1", "worker", {"input": "go"}), txt("all done")]), sub_a)
r1 = orch_a("do the thing that needs confirmation")
assert r1.stop_reason == "interrupt"
interrupt_id = next(iter(orch_a._interrupt_state.interrupts))
del sub_a, orch_a  # process A dies

# Turn 2 (process B): rebuilt fresh from the session store
sub_b = build_sub(MockedModelProvider([tu("sub-tu-2", "dangerous_action", {"target": "prod-db"}), txt("done")]))
orch_b = build_orch(MockedModelProvider([txt("all done")]), sub_b)
r2 = orch_b([{"interruptResponse": {"interruptId": interrupt_id, "response": "APPROVE"}}])

print("r2.stop_reason =", r2.stop_reason, "| dangerous_action runs =", executed["count"])
# Expected: end_turn / 1    Actual: interrupt / 0

Output

=== Turn 1 (process A) ===
r1.stop_reason = interrupt
sub-agent activated: True
captured interrupt_id = v1:before_tool_call:sub-tu-1:5c36caf8-...
dangerous_action executed so far: 0

=== Turn 2 (process B) — rebuilt fresh from session store ===
rehydrated sub-agent activated: True
rehydrated orchestrator activated: True
r2.stop_reason = interrupt
dangerous_action executed count: 0

FAIL: bug reproduced — expected end_turn + 1 execution, got stop_reason=interrupt, executions=0

# Control (same setup, NO restart, single process):
r1.stop_reason = interrupt
r2.stop_reason = end_turn
dangerous_action executed count: 1   → in-process resume works

_{Automated triage. This reproduction is a starting point, not a final determination.}