- Fixes multi-user session in ADK demo agent
- Uses `conversation_id` from NAT context instead of hardcoded user ID for session management
- Implements per-conversation session caching to prevent context mixing across different chat sessions
- Ensures each "New Chat" in NAT UI gets its own isolated ADK session
- Maintains backward compatibility by falling back to `config.user_id` when `conversation_id` is unavailable

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

* **Refactor**
  * Optimized session management with improved caching and lifecycle handling.
  * Enhanced user identification through context-based resolution.

* **Style**
  * Updated string formatting in utility functions.

Authors:
  - Antonio Martinez (https://github.com/antoniomtz)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1120

…cp serve" (#1133)

Parameters with default values were incorrectly marked as required in MCP tool schemas. Now checking for PydanticUndefined and properly extracting default values from Pydantic fields to correctly identify optional parameters.

This PR also adds comprehensive unit tests for the tool schema conversion

- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.

* **New Features**
  * Improved detection and handling of optional parameters and default/default-factory values in tool wrapper generation, with unified validation and consistent invocation behavior for workflows and regular functions.
  * Ensures parameter descriptions, order, and type annotations are preserved in generated wrappers.

* **Tests**
  * Added comprehensive tests covering optional/default combinations, wrapper signatures, execution paths, and observability propagation.


## Summary by CodeRabbit

## Release Notes

* **New Features**
  * Added improved support for optional parameters in MCP tools with enhanced default value handling.

* **Bug Fixes**
  * Fixed inconsistent behavior with nested schema validation and default factory application in tool parameters.

* **Tests**
  * Added comprehensive test coverage for optional field handling and parameter validation scenarios.

Authors:
  - Will Killian (https://github.com/willkill07)
  - Anuradha Karuppiah (https://github.com/AnuradhaKaruppiah)

Approvers:
  - Anuradha Karuppiah (https://github.com/AnuradhaKaruppiah)

URL: #1133

* Override the `ChatRequestOrMessage` validator in `AsyncGenerateRequest` and exclude added fields from model_dump as this is intended to be used to instantiate a `ChatRequestOrMessage` instance
* Optionally use Dask threads if the `--dask_workers=threads` CLI flag is provided
* Fix an issue where `--max_running_async_jobs=1` prevented jobs from running as the background cleanup task is submitted first preventing other jobs from running.

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

* **New Features**
  * Added a config option to choose threaded or process-based local workers.

* **Chores**
  * Allocates an extra local worker slot for cleanup tasks.
  * Skips certain worker setup steps when using threaded workers for faster startup.
  * Streamlined async job submission by excluding internal timing/ID fields and added a validator override to better support async flows.
  * Improved scheduler/worker startup logging to include worker mode and counts.

* **Documentation**
  * Updated async endpoint docs with CLI flags and notes on stdout/stderr behavior.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1131

Adds support for claude-sonnet-4.5

https://docs.claude.com/en/docs/about-claude/models/migrating-to-claude-4

By default, Anthropic only permits either `temperature` or `top_p` -- only surface temperature as an opinionated decision.

Closes

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **New Features**
  * Added validation support for Claude Sonnet 4.5 models regarding the top_p parameter.

* **Documentation**
  * Updated model validation examples to reference Claude Sonnet 4.5 alongside existing models.

* **Tests**
  * Added test coverage for Claude Sonnet 4.5 model validation behavior.

Authors:
  - Will Killian (https://github.com/willkill07)

Approvers:
  - Yuchen Zhang (https://github.com/yczhang-nv)

URL: #1134

* Remove unused `use_knowledge_base` parameter from curl POST payloads, this wasn't being used in the back-end and was causing validation errors.
* Fix the following issues with `examples/front_ends/simple_auth/README.md`:
  - Remove duplicate sentence
  - Update link name for creating a client
  - Sort the form table so that fields occur in the same order as the demo UI
  - Indicate that the workflow requires an `NVIDIA_API_KEY`

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

## Documentation
* Simplified HTTP examples in API docs and quick-start (removed obsolete payload field)
* Clarified quick-start curl example for launching the UI
* Updated authentication demo: adjusted UI navigation, reordered client setup fields, and added guidance about validating client details
* Added NVIDIA_API_KEY to environment variable setup and expanded env var configuration notes

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Eli Fajardo (https://github.com/efajardo-nv)
  - Will Killian (https://github.com/willkill07)
  - Eric Evans II (https://github.com/ericevans-nv)

URL: #1136

…stRunner` (#1150)

* Define an extra dependency group `test` for `nvidia-nat-test`

Closes #1142


## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **Documentation**
  * Updated installation instructions for test tools with two setup approaches: editable install within the repository and standalone installation.
  * Added explicit requirement clarification that the `nvidia-nat-test` package must be installed to use the test runner.

* **Chores**
  * Added optional test dependency group to project configuration for easier test environment setup.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - https://github.com/Salonijain27
  - Will Killian (https://github.com/willkill07)

URL: #1150

* Update the reasoning diagrams replacing the old project name.
* Wrap the images in a link to the full-sized image allowing the user to click on the image and view it at full resolution. 
* Add custom CSS overrides, allowing the center content pane to resize relative to the window size, this also allows the diagrams to display at a larger resolution.
* Update `copyright.py` CI script to check CSS files

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

* **Documentation**
  * Documentation layout now displays with full-width content for improved readability.
  * Images in the reasoning-agent docs are now interactive, linking to their source materials.
  * Minor formatting refinements across documentation pages.

* **Chores**
  * Documentation stylesheet is now included in builds and CSS files are covered by repository checks.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1153

…Piston server (#1154)

* As detailed in #1139 the string `strip` was causing the user submitted code to not begin on a new line.

Closes #1139

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **Bug Fixes**
  * Improved code execution reliability by enhancing string handling and escape sequence processing to ensure safer execution of generated code.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1154

Updates the `docs/source/quick-start/launching-ui.md` documentation to accurately reflect the latest changes from the NeMo-Agent-Toolkit-UI, including enhancing the WebSocket important note with step-by-step instructions, fixing Sphinx directive syntax for proper rendering, and improving overall formatting with proper blank lines for markdown linting compliance. Screenshot updates include renaming `ui_generate_example_settings.png` to `ui_settings_example.png`, renaming `ui_generate_example.png` to `ui_simple_calculator_example.png`, updating `ui_home_page.png` to the latest version, and removing unused screenshots (`ui_generate_example.png`, `ui_generate_example_settings.png`, and `ui_generate_websocket_example.png`) that are no longer referenced in the documentation. All changes ensure the documentation accurately reflects the current state of the NeMo Agent Toolkit UI and matches the official UI repository.

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

* **Documentation**
  * Quick-start launching UI guide updated with a step-by-step WebSocket enablement guide and clearer connection/status guidance
  * Clarified that WebSocket path defaults to "websocket" and broadened streaming guidance for intermediate results
  * Added a standalone note that responses may vary with time of day
  * Replaced/updated UI example images and improved Settings section wording and formatting

Authors:
  - Eric Evans II (https://github.com/ericevans-nv)

Approvers:
  - Anuradha Karuppiah (https://github.com/AnuradhaKaruppiah)
  - Will Killian (https://github.com/willkill07)

URL: #1156

* Includes unrelated documentation fix where back-ticks were not being rendered properly in the Sphinx TOC

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

## Release Notes

* **Documentation**
  * Added a comprehensive Security Considerations guide with practical risk mitigation and best practices.
  * Added navigation links to the new Security Considerations resource.
  * Minor tutorial formatting fix.

* **Security / Policy**
  * Removed the previous standalone security reporting guidance and contact instructions.

* **Chores**
  * Expanded accepted security-related vocabulary and minor path-filtering allowance.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1164

Closes

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **Documentation**
  * Updated local documentation preview instructions to use a static server for improved accessibility.
  * Added clarification on version switcher behavior when accessing documentation locally.
  * Updated documentation version URLs to absolute NVIDIA documentation links.

Authors:
  - Will Killian (https://github.com/willkill07)
  - Patrick Chin (https://github.com/thepatrickchin)

Approvers:
  - David Gardner (https://github.com/dagardner-nv)

URL: #1167

This PR enables functions associated with custom routes to accept arbitrary JSON payloads of any type (objects, arrays, strings, numbers, booleans).

## Motivation

Previously, custom route function parameters defined a fixed request body schema, making them incompatible with arbitrary JSON structures. This enhancement allows custom routes to accept any valid JSON request body, regardless of its schema.

## Examples

### JSON Array
```bash
curl -X POST http://localhost:8000/get_request_metadata \
  -H 'Content-Type: application/json' \
  -d '[1, 2, 3, 4, 5]'
```

### JSON Primitives
```bash
# String
curl -X POST http://localhost:8000/get_request_metadata -d '"hello world"'

# Number
curl -X POST http://localhost:8000/get_request_metadata -d '42'

# Boolean
curl -X POST http://localhost:8000/get_request_metadata -d 'true'
```

## Breaking Changes

None. This is a backward-compatible enhancement. Existing custom routes continue to work, and new routes can opt into arbitrary JSON support by using `RootModel[typing.Any]`.

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

* **Documentation**
  * Expanded "Simple Calculator - Custom Routes and Metadata Access" with reorganized TOC, new sections on defining custom routes and metadata access, updated curl examples, renamed response heading, and added request-body examples (JSON array/string/number/boolean). Notes on accepting arbitrary JSON payloads and limitations for certain custom routes.

* **Chores**
  * Route registration adjusted to skip async-generation routes for custom endpoints; request handling and examples updated to include request-body data alongside other metadata in responses.

Authors:
  - Eric Evans II (https://github.com/ericevans-nv)
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1163

Closes

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.



## Summary by CodeRabbit

- Documentation
  - Added release notes for v1.3.1 with an Overview, categorized changes, and changelog reference; updated Quick Start UI docs, installation reminders, reasoning diagrams, and SECURITY notes.
- New Features
  - Added support for the Claude Sonnet 4.5 model and support for arbitrary JSON body types in custom routes.
- Bug Fixes
  - Fixed issues including config serialization, multi-user demo sessions, tool parameter handling, Async Chat reliability, and code-execution tool behavior.
- Chores
  - Updated changelog and acknowledged a new contributor.

Authors:
  - Will Killian (https://github.com/willkill07)
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - David Gardner (https://github.com/dagardner-nv)

URL: #1166

* Reverts PR #1164
* Existing `SECURITY.md` file is retained
* New document `docs/source/resources/security-considerations.md` is retained

## By Submitting this PR I confirm:
- I am familiar with the [Contributing Guidelines](https://github.com/NVIDIA/NeMo-Agent-Toolkit/blob/develop/docs/source/resources/contributing.md).
- We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
  - Any contribution which contains commits that are not Signed-Off will not be accepted.
- When the PR is ready for review, new or existing tests cover these changes.
- When the PR is ready for review, the documentation is up to date with these changes.




## Summary by CodeRabbit

* **Documentation**
  * Added security documentation with vulnerability reporting procedures, contact information, and security disclosure guidance.
  * Updated documentation references.

Authors:
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - Will Killian (https://github.com/willkill07)

URL: #1168