fix: Dev to main merge

src/App/pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
     "python-dotenv==1.1.1",
     "python-multipart==0.0.30",
     "httpx==0.28.1",
-    "urllib3==2.7.0",
+    "urllib3==2.8.0",
     "cryptography==50.0.0",
 ]
 

src/backend/common/utils/team_utils.py

@@ -87,9 +87,14 @@ async def create_RAI_agent(
     )
 
     model_deployment_name = config.AZURE_OPENAI_RAI_DEPLOYMENT_NAME
-    team.team_id = "rai_team"  # Use a fixed team ID for RAI agent
-    team.name = "RAI Team"
-    team.description = "Team responsible for Responsible AI checks"
+    # Copy so the caller's team (later used for orchestration/scope-gate) is not mutated.
+    rai_team = team.model_copy(
+        update={
+            "team_id": "rai_team",
+            "name": "RAI Team",
+            "description": "Team responsible for Responsible AI checks",
+        }
+    )
     agent = AgentTemplate(
         agent_name=agent_name,
         agent_description=agent_description,
@@ -98,7 +103,7 @@ async def create_RAI_agent(
         enable_code_interpreter=False,
         project_endpoint=config.AZURE_AI_PROJECT_ENDPOINT,
         mcp_config=None,
-        team_config=team,
+        team_config=rai_team,
         memory_store=memory_store,
     )
 

src/backend/pyproject.toml

@@ -61,7 +61,7 @@ dependencies = [
     # NOTE: agent-framework-azure-ai==1.0.0rc6 requires azure-ai-agents>=1.2.0b5,<1.2.0b6
     #       which conflicts with the GA azure-ai-agents==1.1.0. Kept as comment for rollback only.
     # "agent-framework-azure-ai==1.0.0rc6",  # Legacy bridge — required by v4/ code only
-    "urllib3==2.7.0",
+    "urllib3==2.8.0",
     "protobuf==6.33.6",
     "cryptography==50.0.0",
     "aiohttp==3.14.3",

src/mcp_server/pyproject.toml

@@ -25,7 +25,7 @@ dependencies = [
   "python-multipart==0.0.30",
   "httpx==0.28.1",
   "werkzeug==3.1.6",
-  "urllib3==2.7.0",
+  "urllib3==2.8.0",
   "azure-core==1.38.0",
   "cryptography==50.0.0",
   "authlib==1.6.12",

src/tests/backend/common/utils/test_team_utils.py

@@ -211,13 +211,17 @@ async def test_create_rai_agent_success(self, mock_registry, mock_agent_class, m
         assert call_args[1]['enable_code_interpreter'] is False
         assert call_args[1]['project_endpoint'] == "https://test.project.azure.com/"
         assert call_args[1]['mcp_config'] is None
-        assert call_args[1]['team_config'] is self.mock_team
+        assert call_args[1]['team_config'] is self.mock_rai_team
         assert call_args[1]['memory_store'] is self.mock_memory_store
 
-        # Verify the team configuration was updated in place (source mutates team directly)
-        assert self.mock_team.team_id == "rai_team"
-        assert self.mock_team.name == "RAI Team"
-        assert self.mock_team.description == "Team responsible for Responsible AI checks"
+        # Verify a copy is used so the caller's team is not mutated
+        self.mock_team.model_copy.assert_called_once_with(
+            update={
+                "team_id": "rai_team",
+                "name": "RAI Team",
+                "description": "Team responsible for Responsible AI checks",
+            }
+        )
 
         # Verify agent initialization
         mock_agent.open.assert_called_once()
@@ -255,6 +259,41 @@ async def test_create_rai_agent_registry_error(self, mock_logging, mock_registry
         # Should still return agent even if registry fails
         assert result is mock_agent
 
+    @pytest.mark.asyncio
+    @patch('backend.common.utils.team_utils.config')
+    @patch('backend.common.utils.team_utils.AgentTemplate')
+    @patch('backend.common.utils.team_utils.agent_registry')
+    async def test_create_rai_agent_does_not_mutate_caller_team(self, mock_registry, mock_agent_class, mock_config):
+        """Regression: the selected team must keep its identity for the scope gate."""
+        mock_agent = Mock()
+        mock_agent.open = AsyncMock()
+        mock_agent_class.return_value = mock_agent
+        team = TeamConfiguration(
+            id="id-1",
+            session_id="s-1",
+            team_id="00000000-0000-0000-0000-000000000001",
+            name="Human Resources Team",
+            status="visible",
+            created="",
+            created_by="",
+            deployment_name="",
+            agents=[],
+            description="HR onboarding team",
+            logo="",
+            plan="",
+            starting_tasks=[],
+            user_id="u-1",
+        )
+
+        await create_RAI_agent(team, self.mock_memory_store)
+
+        assert team.team_id == "00000000-0000-0000-0000-000000000001"
+        assert team.name == "Human Resources Team"
+        assert team.description == "HR onboarding team"
+        passed_team = mock_agent_class.call_args[1]['team_config']
+        assert passed_team.team_id == "rai_team"
+        assert passed_team.description == "Team responsible for Responsible AI checks"
+
 
 class TestGetAgentResponse:
     """Test _get_agent_response function."""