Framework Watch: ADK Parsed the Same Reply Differently on Resume Than Live

Three changes this week share a pattern: a second code path that did the same job as the first, but with different rules.

ADK Python: live and resume parsed JSON differently

Issue #7971, filed on November 3, describes a workflow paused on ADK 2.10 or earlier that fails to resume on 2.11.0 through 2.13.0 "when an LlmAgent node with an output_schema had replied with JSON in a Markdown code fence". The live run accepted the reply because validate_schema strips the fence first. Sessions stored by 2.10 and earlier kept only the raw fenced text, and on resume _process_rehydrated_output parsed that text without stripping the fence, so the run raised WorkflowDataError with "Invalid JSON: expected value at line 1 column 1". The fix, merged as PR #7972, calls the same _strip_json_code_fence helper on the replay path, so "the live path and the replay path then share one fence helper". Before the fix, three of the nine new test cases failed on main. The issue sums up the effect: any app with a persistent session store that upgraded from 2.10 or earlier "cannot resume the sessions that were paused after such a reply". The fix is on main and not yet in a tagged release. It is the second ADK resume bug in two days; yesterday's Framework Watch covered a 15-second replay barrier.

Codex: skill discovery ignored the turn sandbox

Codex PR #59291, merged on November 4, says: "Direct executor skill discovery used unrestricted filesystem access, bypassing the turn's permission context." The change passes accessors built from the turn's granted permissions into skill discovery and adds filesystem access keys to the discovery cache, "so permission changes trigger rediscovery". The tests check that "restricted discovery returns no skills when sandbox access is unavailable". In practice, a turn that could not read a directory could still have loaded skills from it.

Claude Code: fewer automatic installs

Claude Code 2.1.318, released on November 4, changes Claude Code "to no longer install or update the IDE extension when started in an IDE terminal"; users now install it with /ide or from the editor's extension view. The previous release, 2.1.317, added "a check that asks before a web or shell tool call sends your account email address to the network". 2.1.318 also fixes /logout and claude mcp remove reporting success while "changes to trust, consent or MCP settings" were silently dropped on shared network home directories.

What remains uncertain. Neither the ADK nor the Codex change says how many users were affected, and the Codex PR does not name a release. We have not run any of these versions.

Analysis: When a framework has two ways to reach the same result, live and replayed, sandboxed and cached, the second one tends to drift. At Belgavi's Book Store, Dinky could add one test per agent workflow that pauses, stores the session, upgrades the framework in the test environment and resumes, with a model reply in a code fence among the inputs. A second test can run skill loading inside the same sandbox as the agent's tools and check that a skill outside the allowed folder is not found.

Sources and evidence

ADK Python PR #7972 (merged November 4, not yet released) makes resume strip a Markdown code fence from stored schema replies, as the live path did, fixing WorkflowDataError for sessions paused on ADK 2.10 or earlier. Codex PR #59291 makes executor skill discovery use the turn's filesystem permissions instead of unrestricted access. Claude Code 2.1.318 stops installing its IDE extension automatically and fixes silently dropped trust and MCP setting changes on network home directories.