fix(flows): require agent authorship before resume-dispatching a function call (#7076)

[dmcnelis]

What

Fixes the resumable tool-dispatch bypass reported in #7076.

When an app is resumable (ResumabilityConfig(is_resumable=True)), the flow replays a trailing function-call event without checking who authored it and without a model turn. Because session init accepts caller-supplied events, a client can:

1. POST /apps/{app}/users/{u}/sessions with an event authored "user" carrying a function_call, and
2. POST /run_sse with newMessage: null against that event's invocationId,

and the named tool executes with caller-chosen arguments — bypassing the model, the system prompt, and any model-mediated safety reasoning. Confirmed by execution on 2.7.1 and 2.8.0; the same gap is present on main at the refactored location addressed here.

Fix

Guard both event-selection paths in flows/llm_flows/_resume_utils.py by the current agent's name (require_agent_name):

• decide_step_resume — the trailing-call replay (the path the PoC exercises).
• decide_resume → _find_target_call_event — the multi-event target search (adds an optional agent_name filter; default None preserves the pure matching behavior its unit tests cover).

A legitimate resume is unaffected: an agent authors its own paused call, so it still dispatches. A caller-forged call no longer dispatches and the flow falls through to a normal model turn.

Tests

• Added regression tests that fail without the guard (a forged "user"-authored call is dispatched / selected) and pass with it, plus a positive test that the agent's own paused call still replays.
• tests/unittests/flows/llm_flows/test_resume_utils.py: 35 passing.
• tests/unittests/runners/test_resume_invocation.py: sub-agent resume still passes (the author check resolves to the current sub-agent's name).
• Wider tests/unittests/flows/llm_flows/: 681 passing (2 unrelated collection errors from optional deps openai / google.cloud not installed locally).
• pyink and isort clean on both files.

Scope / honest limitations

This closes the demonstrated path (a "user"-authored forged call). For full defense-in-depth, the session-init validator (_validate_session_initialization_events) could also reject caller-supplied events that carry function_call parts or are authored as anything the framework reserves, so a caller cannot forge an agent-authored pending call either. That touches the session-restore design, so I've left it as a maintainer call and kept this PR to the resume-path provenance guard. Happy to extend if you'd prefer the ingress hardening in the same change.

Note: I'll need to complete the Google CLA — the bot should indicate the exact email.

Refs: #7076

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbhX6pH5CZCtymrBneXQVJ

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.