* Add sample for per-run refreshable MCP authentication headers
Adds a Foundry RAPI sample that attaches per-run, refreshable authentication headers to MCP requests using existing primitives: a DelegatingHandler on the MCP transport's HttpClient plus an AsyncLocal run scope. The same agent runs under two contexts, each minting a fresh token, proving the header is per run rather than bound at agent or connection creation time.
The handler attaches the bearer only over HTTPS to the MCP server's own origin, logs the non-secret label only, disables cookies, and checks certificate revocation. The README covers security considerations and production notes.
Fixes#1631
* Address PR review: harden redirect handling, nest-safe scope, README env vars
Disable AllowAutoRedirect on the shared handler so a redirect cannot carry the bearer past the origin check. Save and restore the prior run scope instead of clearing to null so the helper is safe under nesting. Note the Foundry env vars in the samples folder README row and update the sample README security notes.
* .NET: Explicitly emit available_resources and available_scripts in skill content
AgentInlineSkillContentBuilder now always emits <available_resources> and
<available_scripts> elements, using self-closing tags when a skill has no
resources or scripts. This signals to the model exactly what is callable so it
does not hallucinate non-existent resource or script names. Script parameter
schemas are wrapped in a nested <parameters_schema> element.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Emit available_resources block for file-backed skills
Align AgentFileSkill with inline/class skills by surfacing discovered
resources in the loaded skill content. AgentFileSkill.GetContentAsync now
appends an <available_resources> block (before <available_scripts>) listing
resource names so the model has an authoritative list and does not
hallucinate resource names. Extracted a reusable BuildAvailableResourcesBlock
helper in AgentInlineSkillContentBuilder.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: SergeyMenshykh <SergeMenshikh@outlook.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Change A2A default session store to NoopAgentSessionStore
Align the A2A hosting layer default session store with the AG-UI
sibling by using NoopAgentSessionStore, making persistence an explicit
opt-in choice.
Update samples to document how to register a persistent session store
for multi-turn conversations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Clarify test name to specify session store default
Rename test to FallsBackToNoopSessionStoreDefaultAsync to avoid
implying all stores default to noop (task store still uses InMemory).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OpenTelemetryAgent auto-wired OpenTelemetryChatClient above FICC, producing
OTel(FICC(leaf)). FICC resolved its ActivitySource at construction time as null,
so execute_tool spans were never emitted for tool-calling agents.
This repositions OTel below FICC, producing FICC(OTel(leaf)), via a deferred
NoOp slot pre-placed as the innermost decorator in WithDefaultAgentMiddleware
and activated once at the agent level.
- Add internal DeferredOpenTelemetryChatClient: inert DelegatingChatClient whose
Activate(sourceName) swaps its target to inner.AsBuilder().UseOpenTelemetry().Build().
- WithDefaultAgentMiddleware always registers the slot innermost so it lands below FICC.
- OpenTelemetryAgent activates the slot once in its constructor and forwards run
options straight through, removing the per-run ChatClientFactory outer wrap.
- Add and update unit tests, including a proof that execute_tool spans are emitted
on the agent source and parented under invoke_agent.
* Add samples for harness blog post part 1
* Add readme for python samples
* Update python instructions to match dotnet instructions
* Address PR comments
* Add link to blog posts
* Fix blog post naming.
* Add more blog post links
* Project ToolExecution events as FunctionCallContent/FunctionResultContent
GitHubCopilotAgent's event-dispatch switch previously had no case for
ToolExecutionStartEvent or ToolExecutionCompleteEvent. Both fell through
to the default case and were wrapped as opaque AIContent with
RawRepresentation, preventing downstream consumers and models from
recognizing tool call results.
Add explicit cases that project:
- ToolExecutionStartEvent → FunctionCallContent (role: Assistant)
- ToolExecutionCompleteEvent → FunctionResultContent (role: Tool)
This mirrors the Python fix already shipped in #4734/#4814/#4828.
Fixes#5897
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(#5897): Address review feedback for ParseArguments robustness
- Handle non-generic IDictionary variants (Hashtable, etc.) that don't
match IDictionary<string, object?> due to generic invariance
- Return null for empty/whitespace string arguments instead of wrapping
them in a spurious { value = "" } dictionary, aligning with
ParseFunctionArgumentsObject convention elsewhere in the repo
- Add test coverage for Dictionary, Hashtable, and JsonElement argument
types
- Add edge-case test for Success=true with null Result
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix non-generic IDictionary key handling in ParseArguments (#5897)
Use direct (string) cast for dictionary keys instead of ToString()
coercion, matching the established pattern in ObjectExtensions and
PortableValueExtensions. This validates keys are actually strings
rather than silently accepting and coercing non-string keys.
Add test verifying non-string dictionary keys throw InvalidCastException.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix missing 'using System' in ToolExecutionEventProjectionTests
Add the missing 'using System' directive needed for InvalidCastException
reference at line 375 of ToolExecutionEventProjectionTests.cs.
Fixes#5897
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Use source-generated JsonTypeInfo for AOT-safe argument deserialization
Replace reflection-based JsonSerializer.Deserialize<T>() calls with the
JsonTypeInfo overload that uses source-generated metadata, eliminating
IL2026/IL3050 trimming and AOT warnings without suppressions.
Changes:
- Register Dictionary<string, object?> in GitHubCopilotJsonUtilities JsonContext
- Add JsonSerializerOptions constructor parameter (defaults to
GitHubCopilotJsonUtilities.DefaultOptions)
- Use GetTypeInfo()-based Deserialize overload in ParseArguments
- Remove [UnconditionalSuppressMessage] attributes
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix dotnet format: add 'this.' qualification to instance method call
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Adapt to GitHub.Copilot.SDK 1.0.0 API after merge with main
- Update ToolExecutionEventProjectionTests: Arguments is now JsonElement?
(not object?), remove tests for string/Dictionary/Hashtable arguments
- Remove AutoStart option (removed in 1.0.0)
- Simplify ParseArguments to handle JsonElement primarily
- Add tests for empty object and nested JSON arguments
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(hosting): emit url_citation annotation events from streamed AI Search responses
OutputConverter.ConvertUpdatesToEventsAsync accumulated text content deltas but
silently dropped CitationAnnotation metadata from TextContent.Annotations. As a
result, hosted agents that use CreateAzureAISearchTool emitted citation markers in
text (e.g. 【5:0†source】) but produced empty annotations arrays and no
response.output_text.annotation.added SSE events.
The fix accumulates UrlCitationBody SDK annotations across all TextContent updates
for a message and emits them via TextContentBuilder.EmitAnnotationAdded after
EmitTextDone (as required by the SDK lifecycle) and before EmitDone. Non-citation
and region-less annotations are silently skipped, matching the existing OpenAI
ChatCompletions path in AgentResponseExtensions.
Adds 7 unit tests (N-01–N-07) covering: basic emission, ordering constraints,
multiple annotations, multi-update accumulation, and skip conditions.
Fixes#6641
* test: convert annotation test comments to XmlDoc and group in region
* fix: remove redundant long casts on annotation region indices
* test: assert done events carry url_citation annotation metadata
---------
Co-authored-by: Roger Barreto <19890735+RogerBarreto@users.noreply.github.com>
* Bring Hosted-Toolbox sample to parity with sibling hosting samples
Adds the standard scaffolding files (.env.example, agent.yaml, agent.manifest.yaml,
Dockerfile, Dockerfile.contributor) that every other 04-hosting Foundry sample ships
but Hosted-Toolbox lacked.
Fixes the toolbox name environment variable: reads TOOLBOX_NAME instead of the
platform reserved FOUNDRY_TOOLBOX_NAME so it survives agent create, and aligns the
default to my-toolset.
Rewrites the README to the standard section layout with PowerShell fenced commands,
and adds Using-Samples READMEs documenting why the client REPLs exist.
Renames Azure AI Foundry to Foundry across the 04-hosting sample READMEs and comments
for consistent product naming.
* Address PR review: accurate docs and TOOLBOX_NAME in ToolboxMcpSkills
- SimpleAgent README: correct the demo banner to the real per-agent URL the
client prints (https scheme and the /api/projects/<project> segment).
- Hosted-Toolbox Program.cs: move FOUNDRY_MODEL out of the Required block into
Optional since it has a gpt-4o default and an AZURE_AI_MODEL_DEPLOYMENT_NAME
fallback.
- Hosted-ToolboxMcpSkills: switch the toolbox name from the reserved
FOUNDRY_TOOLBOX_NAME to TOOLBOX_NAME across Program.cs, .env.example,
agent.yaml, agent.manifest.yaml and README so it is deployable via the
manifest, matching the other toolbox samples.
* Migrate 01-get-started samples to Foundry as canonical default
Change canonical provider from Azure OpenAI to Microsoft Foundry Responses API:
Code changes:
- Updated all 01-get-started samples (01_hello_agent, 02_add_tools, 03_multi_turn,
04_memory, 06_host_your_agent) to use FoundryAgent or AIProjectClient.AsAIAgent()
- Updated environment variables: AZURE_OPENAI_* → FOUNDRY_PROJECT_ENDPOINT/FOUNDRY_MODEL
- Updated .csproj files to reference Microsoft.Agents.AI.Foundry instead of Azure.AI.OpenAI
- Added warning comments about DefaultAzureCredential production usage
- 05_first_workflow unchanged (workflow pattern only, no AI model)
Documentation changes:
- Updated AGENTS.md Default provider section to reflect Foundry as canonical
- Updated code example to use FoundryAgent constructor pattern
- Updated env var documentation
Note: 04_memory (AIContextProvider sample) extracts IChatClient from FoundryAgent
to maintain the memory pattern while using Foundry backend.
All samples verified to build successfully.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR 6555 review feedback and format failures
- Add Microsoft.Agents.AI.Foundry using to AGENTS.md Foundry snippet
- Update verify-samples GetStarted env vars to FOUNDRY_PROJECT_ENDPOINT/FOUNDRY_MODEL
- Remove unnecessary usings flagged by dotnet format in 01_get_started samples
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Switch 01-get-started samples from FoundryAgent to AIProjectClient.AsAIAgent()
Use AIProjectClient.AsAIAgent() as the canonical pattern for all 01-get-started
samples. Reserve FoundryAgent only for samples that specifically demonstrate the
Foundry-managed (prompt) agent — i.e. 02-agents/AgentsWithFoundry/.
Changes:
- 01_hello_agent, 02_add_tools, 03_multi_turn, 06_host_your_agent: swap
FoundryAgent constructor for AIProjectClient.AsAIAgent(model, instructions)
- 04_memory: get IChatClient via AIProjectClient.AsAIAgent(options).GetService()
instead of extracting from a throwaway FoundryAgent
- AGENTS.md: update default-provider snippet and note on when to use FoundryAgent
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Scope workflow status/respond endpoints to route workflow.
Validate that the orchestration instance belongs to the workflow
named in the route. Prevents cross-workflow access via runId.
* Add changelog.
* Address Copilot review feedback: fix duplicate XML doc, make IsOrchestrationOwnedByWorkflow non-throwing, drop misleading Async suffix in test name
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(evals): RubricScore type + EvalScoreResult.Dimensions
Adds the core rubric-evaluator surface that mirrors the Python work in
PR #6101 (commit e45b934cc). Provider-agnostic types only — no Foundry
coupling. Subsequent commits will wire these into FoundryEvals.
- RubricScore: per-dimension score record (Id, Score?, Applicable, Weight, Reason).
- EvalScoreResult.Dimensions: optional init-only list of RubricScore.
Null for non-rubric (built-in) evaluators.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(evals): GeneratedEvaluatorRef + assertion helpers
Adds the provider-agnostic surface for referencing a pre-existing rubric
evaluator and gating CI on per-item / per-dimension thresholds. Mirrors
Python PR #6101 commits e5830dd7f (ref type) and 4bc60462d (asserts).
- GeneratedEvaluatorRef: name + optional version/display-name, plus a
Latest(name) factory for versionless refs (discouraged for CI; consumers
should warn at run time).
- AgentEvaluationResults.AssertScoreAtLeast: walks DetailedItems[].Scores,
optionally filtered by evaluator name, recurses into SubResults.
- AgentEvaluationResults.AssertDimensionScoreAtLeast: walks each score's
Dimensions list, skips non-applicable dimensions by default, supports
requireApplicable to flip that, recurses into SubResults.
- AgentEvaluationResults.AssertNoFailedItems: walks DetailedItems for
fail/error statuses, recurses into SubResults.
All helpers throw InvalidOperationException (matches existing AssertAllPassed).
Truncates offender lists to the first 5 with a '+N more' suffix to keep
CI output readable, mirroring the Python helpers.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(foundry-evals): accept GeneratedEvaluatorRef in evaluators=
Adds FoundryEvaluatorSpec, a readonly-struct union with implicit conversions
from both string and GeneratedEvaluatorRef so call sites can mix built-in
evaluator names with rubric evaluator references:
var evals = new FoundryEvals(
projectClient, model,
new GeneratedEvaluatorRef("policy-rubric", "3"),
FoundryEvals.Relevance,
FoundryEvals.Coherence);
FoundryEvals constructors (3 overloads), EvaluateTracesAsync, and
EvaluateFoundryTargetAsync now take FoundryEvaluatorSpec[]/params instead of
string[]/params. Existing call sites using string literals or string[] keep
working unchanged via implicit conversion.
FoundryEvalConverter.BuildTestingCriteria emits the documented Foundry wire
format for rubric refs:
{
"type": "azure_ai_evaluator",
"name": <DisplayName ?? Name>,
"evaluator_name": <Name>,
"evaluator_version": <Version>, // omitted when null
"initialization_parameters": { "deployment_name": <model> },
"data_mapping": { conversation arrays, optional tool_definitions }
}
WireTestingCriterion gains an optional EvaluatorVersion field. Rubric refs
are preserved through FilterToolEvaluators (tool-aware but not tool-required)
and ignored by FindMissingGroundTruthEvaluators. A versionless ref emits a
Trace.TraceWarning at criterion-build time so CI authors notice the floating
version (mirrors the Python warning).
Adds 6 new Foundry unit tests (3 BuildTestingCriteria rubric paths, 1
FindMissingGroundTruthEvaluators, 1 FilterToolEvaluators preservation, 1
mixed-order). 369/369 Foundry tests pass.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(foundry-evals): parse rubric dimension_scores into RubricScore
Adds FoundryEvals.ParseRubricScores, called per result inside ParseDetailedItem.
Each EvalScoreResult now populates Dimensions when the evaluator's sample carries
a rubric breakdown.
Accepts three shapes for forward compatibility with provider SDK iterations:
1. sample.properties.dimension_scores (canonical Foundry runtime shape)
2. sample.properties.rubric_scores (preview/legacy key)
3. top-level sample.dimension_scores / sample.rubric_scores (defensive fallback)
Entries missing 'id', 'weight', or 'applicable' are skipped without invalidating
well-formed siblings. Non-applicable dimensions may omit 'score' (parsed as null).
Adds 6 unit tests covering canonical and legacy keys, top-level fallback, no-match
returns null, malformed-entry skipping, and the non-applicable null-score path.
375/375 Foundry tests pass.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: feat(samples): Evaluation_FoundryRubric end-to-end sample
Adds dotnet/samples/05-end-to-end/Evaluation/Evaluation_FoundryRubric mirroring
the Python evaluate_with_rubric_sample.py:
- Fetches a pre-existing Foundry agent via AgentAdministrationClient
(GetAgentAsync for latest, GetAgentVersionAsync when FOUNDRY_AGENT_VERSION
is pinned).
- References a rubric evaluator by GeneratedEvaluatorRef(name, version);
falls back to GeneratedEvaluatorRef.Latest(name) with the documented
floating-version warning.
- Mixes the rubric with FoundryEvals.Relevance and FoundryEvals.Coherence
in a single FoundryEvals run (implicit string-and-ref conversion).
- Prints per-dimension breakdowns from EvalScoreResult.Dimensions for each
item.
- Demonstrates a CI quality gate with AssertDimensionScoreAtLeast("general_quality", 3.0).
Documents the FOUNDRY_PROJECT_ENDPOINT footgun (must be project-scoped URL
.../api/projects/<project>, not the bare Azure OpenAI endpoint) and the
Eval-Definition-vs-Rubric-Evaluator distinction in the README. Ships a
.env.example with the FOUNDRY_* variables.
Registers the project in agent-framework-dotnet.slnx and cross-links from
the sibling Evaluation_Multimodal / Evaluation_ExpectedOutputs READMEs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(foundry-evals): harden FoundryEvals public surface for review
Address PR #6267 review comments on the .NET FoundryEvals integration:
- Add source-compat overloads accepting `string[] evaluators` for `FoundryEvals` ctor, `EvaluateTracesAsync`, and `EvaluateFoundryTargetAsync` so existing callers passing string arrays keep compiling unchanged. New overloads forward via a private `ToSpecs` helper that wraps each name through the implicit `string -> FoundryEvaluatorSpec` conversion.
- Guard against `default(FoundryEvaluatorSpec)` entries (both `BuiltinName` and `GeneratedRef` null) that would NRE the downstream converter. Adds `FoundryEvaluatorSpec.IsValid` / `EnsureValid` plus an internal `EnsureAllSpecsValid` helper, wired into the main ctor and both static evaluation entry points.
- Add 6 unit tests covering the new validation surface.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(sample): set ExitCode=1 when rubric dimension gate trips
PR #6267 review comment: the FoundryRubric sample swallowed the AssertDimensionScoreAtLeast failure, so a CI run that included it as a quality gate would still exit 0 even when the rubric regressed. Set `System.Environment.ExitCode = 1` in the catch so CI fails while still letting the rest of the sample's logging complete cleanly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(foundry-evals): search typed Sample directly for rubric scores
PR #6267 review comment: `_extract_rubric_scores` only searched the `properties` dict when the sample exposed one. When the Azure AI Projects typed SDK returns a Sample object that puts `dimension_scores` / `rubric_scores` directly on the instance (no `properties` wrapper), we missed them and surfaced no per-dimension scores.
Add an `else: containers.append(sample)` branch so non-dict typed samples are also inspected for the score keys. Covered by two new tests: one with `dimension_scores` directly on a typed Sample without a `properties` wrapper, and one with the legacy `rubric_scores` key in the same shape.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test(evals): cover assert_score_at_least and assert_no_failed_items
PR #6267 review comments: both assertion helpers shipped without unit tests. Add `TestAssertScoreAtLeast` (above threshold, below w/ offenders, evaluator filter, sub_results recursion) and `TestAssertNoFailedItems` (all passing, failed/errored statuses, sub_results recursion) with a shared `_score_results` fixture builder.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(samples): remove dead rubric-evaluator doc link from FoundryRubric sample
The Azure AI Foundry rubric evaluator concept doc page has not yet been published, so the link in the sample README and Program.cs comment 404s. Drop the references until the upstream doc is live.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address PR 6267 review nits
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Ben Thomas <25218250+alliscode@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Bump Azure.AI.Projects to 2.1.0-beta.3
Updates Azure.AI.Projects from 2.1.0-beta.2 to 2.1.0-beta.3, together with the transitive Azure.Core (1.56.0 to 1.57.0) and System.ClientModel (1.12.0 to 1.13.0) pins that beta.3 requires (beta.3 forces System.ClientModel 1.13.0.0 via Azure.Core 1.57.0).
Migrates the affected samples and integration test to the beta.3 surface:
* MemorySearch sample: MemorySearchToolCallResponseItem renamed to MemorySearchToolCall, Results renamed to Memories, MemoryItem indirection removed.
* AgentSkills sample: skill provisioning/download API redesigned to a version based model (CreateSkillVersionFromFiles, GetSkillContent which now downloads and unzips), removing manual ZIP handling.
* Session files integration test: GetSessionFilesAsync now returns an async collection of SessionDirectoryEntry and renames the sessionId parameter to agentSessionId.
* Stream session file listing and short-circuit in integration test
Avoids materializing the entire session directory listing into a List. The test now streams GetSessionFilesAsync and breaks as soon as the expected entry is found, then asserts it was located.
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ensure an argument-scoped standing approval (the "always approve with exact
arguments" path) records an empty argument set rather than null when the
approved call has no arguments, so it matches only future no-argument calls.
null remains reserved exclusively for tool-level approvals, keeping the two
scopes distinct. This aligns the .NET behavior with the existing Python harness.
Adds regression tests covering the no-argument standing-approval flow, the
MatchesRule argument-scoping semantics, and empty-arguments rule serialization.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The Hosted-AgentSkills sample and its mirrored unit-test helper gated ZIP
extraction on `StartsWith(destinationRoot)` OR `Equals(destinationRoot)`. The
second branch left an acceptance path not covered by the containment check, so
static analysis could not prove the extraction sink stays within the
destination. Make the single resolved-path StartsWith check the only gate to
extraction in both files and add a nested-entry regression test.
Closes#6564
* scope MCP threadId to the current agent
* Fix Async suffix on test methods and add CHANGELOG entries
- Rename three test methods to include Async suffix (IDE1006 fix)
- Add CHANGELOG entries for DurableTask and Hosting.AzureFunctions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(dotnet): Add LocalCodeAct package scaffold
Create Microsoft.Agents.AI.LocalCodeAct package with:
- Project file with embedded Python resources
- ExecutionMode enum (Subprocess only)
- ProcessExecutionLimits record
- FileMount record and FileMountMode enum
- README.md documentation
- Embedded Python runner and validator scripts
This is the .NET equivalent of the Python agent-framework-local-codeact
package. Next: Implement process bridge and tool integration.
* feat(dotnet): Add embedded Python runner and validator
Copy Python runner and validator scripts from the Python implementation
as embedded resources for the .NET package.
* feat(dotnet): Add CodeValidator wrapper
Implement CodeValidator.cs that:
- Extracts embedded Python validator script to temp file
- Invokes Python validator with JSON request
- Passes custom allow/block lists
- Throws CodeValidationException on failures
- Cleans up temp files
Uses the embedded Resources/validator.py for AST validation.
* feat(dotnet): Add LocalExecuteCodeFunction
Implement LocalExecuteCodeFunction as AIFunction:
- Accepts Python executable path (required)
- Registers host tools for code to call
- Validates code via CodeValidator if custom lists provided
- Executes via ProcessBridge
- Converts result dict to ChatMessage list
- Builds dynamic description including available tools
Matches Python LocalExecuteCodeTool functionality.
* feat(dotnet): Add LocalCodeActProvider
Implement AIContextProvider that:
- Injects execute_code tool into context
- Adds CodeAct instructions
- Enforces single-provider-per-agent via StateKeys
- Wraps LocalExecuteCodeFunction lifecycle
Minimal provider implementation matching Python LocalCodeActProvider.
* feat(dotnet): Add tests and sample for LocalCodeAct
Add unit tests:
- LocalExecuteCodeFunctionTests (4 tests)
- ProcessExecutionLimitsTests (2 tests)
- FileMountTests (2 tests)
Add sample:
- LocalCodeAct/Program.cs - Demonstrates provider and function usage
- LocalCodeAct/README.md - Documentation and safety warnings
Tests verify basic construction, metadata, and disposal.
Sample shows provider creation, function setup, and configuration.
Note: Build requires .NET 10 SDK per global.json.
* feat(dotnet): Add LocalCodeAct sample project
Add sample demonstrating:
- LocalCodeActProvider creation and configuration
- LocalExecuteCodeFunction direct usage
- Execution modes and file mount configuration
- Safety warnings and prerequisites
Includes project file and README with security guidance.
* feat(dotnet): Add file mount support and integration tests
- Added FileMountHelper.cs for file mount normalization, snapshot, and capture
- Updated LocalExecuteCodeFunction to support file mounts parameter
- Added file snapshot before/after execution with capture logic
- Updated LocalCodeActProvider to pass file mounts through
- Created comprehensive IntegrationTests.cs with 10 test cases:
- Simple code execution
- Timeout handling
- Syntax error handling
- Blocked import validation
- Blocked builtin validation
- Custom allowed imports
- File mount read/write with capture
- Stdout capture
- Provider tool injection
All features from Python implementation now ported to .NET.
* Rewrite .NET LocalCodeAct to address all PR review comments
Complete rewrite that follows the Hyperlight package conventions
(see Microsoft.Agents.AI.Hyperlight) and addresses all 24 review
comments on PR #6105:
Architectural fixes:
* LocalCodeActProvider now uses options-class constructor pattern
matching HyperlightCodeActProvider.
* Override of ProvideAIContextAsync uses the correct
(InvokingContext, CancellationToken) signature returning
ValueTask<AIContext>.
* ExecuteCodeFunction follows the AIFunction Name/Description/JsonSchema
property pattern with InvokeCoreAsync override.
* Provider exposes AddTools/GetTools/RemoveTools/ClearTools and
AddFileMounts/GetFileMounts/RemoveFileMounts/ClearFileMounts CRUD
methods, with snapshot-at-invocation semantics under a lock.
Runtime/security fixes:
* Subprocess IPC uses JsonObject/JsonNode end-to-end (no
Dictionary<string, object?> casts that broke under JsonElement
deserialization).
* Validator runs in its own subprocess with a dedicated timeout
(ProcessExecutionLimits.ValidationTimeoutSeconds), never reuses
the runner script.
* Validation enabled by default; can be opt-ed out via
ValidationEnabled = false.
* validator.py has a __main__ entrypoint that reads JSON from
stdin and exits with structured errors.
* validator.py is now compatible with Python 3.9+ (Match nodes
added conditionally).
* call_id parsed as long to match Python id(kwargs) range.
Other:
* README rewritten with valid C# syntax (options-class, FileMount
constructor) and accurate descriptions of validator and file
capture behavior.
* Added integration tests that exercise the real subprocess and
validator (skipped gracefully when python3 is not on PATH).
* All 18 tests pass (15 unit + 3 integration) across net8/net9/net10.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Sync embedded validator.py with Python package allow-list enforcement
The embedded Python validator script used by the .NET LocalCodeAct
package now enforces the builtin allow-list, matching the latest
behavior of agent_framework_local_codeact._validator. Names that are
real Python builtins must appear in the allow-list, while unknown names
(user-defined functions, registered tools) remain allowed.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add Hosted-LocalCodeAct foundry hosted-agent sample
Mirrors the Python foundry_hosted_agent.py sample for the local-codeact
package: registers compute and fetch_data as sandbox-only host tools on
LocalCodeActProvider so the model only sees execute_code and reaches them
via await call_tool(...). Includes the standard hosted-agent supporting
files (agent.yaml, agent.manifest.yaml, Dockerfile, Dockerfile.contributor,
.env.example, README.md) and installs python3 in the container images so
the embedded runner and validator can execute.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(local-codeact-dotnet): sync validator os.* allow-list with Python
Mirror the Python package change: the embedded validator.py invoked by the
.NET ProcessBridge replaces the os.* deny-list with an allow-list of
{environ, path}. Add allowed_os_attrs parameter to validate_code and
_CodeValidator, and surface it via the stdin JSON request schema so the
.NET host can opt in to a broader allow-list when needed.
Default behavior tightens to match the documented contract: any os.*
attribute outside {environ, path} (for example os.listdir, os.open,
os.getcwd) is rejected.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(local-codeact-dotnet): address review + tighten validator
- validator.py: enforce os.* allow-list on `from os import X` so names like
`system`, `getcwd` cannot bypass the visit_Attribute restriction.
- ProcessBridge.ConfigureEnvironment: document that null Environment inherits
the parent env (matching real behavior) and update the public
LocalCodeActProviderOptions.Environment doc to describe the explicit
empty-dictionary opt-in for a scrubbed environment.
- Tests:
* FileMountHelperTests covers per-file, per-mount, and total
capture-limit branches that return TextContent omissions.
* Integration tests cover unknown-tool dispatch error, tool throwing
exception, and CodeValidator timeout that kills the process and
raises CodeValidationException.
- Sample: drop unused `Microsoft.Agents.AI.Foundry` using in
Hosted-LocalCodeAct/Program.cs to satisfy IDE0005 check-format.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore(local-codeact-dotnet): remove stale orphan sample
The dotnet/samples/LocalCodeAct/ scaffolding sample referenced APIs
that don't exist in the current package (`ExecutionMode`, FileMount
object-initializer syntax, the old LocalExecuteCodeFunction
constructor signature, function.Metadata.*), produced a long list of
check-format violations (CHARSET, IMPORTS, IDE0073 header, IDE0005
unused using, IDE1006 Async suffix, RCS1037 trailing whitespace), and
did not match any of the documented sample layouts.
The hosted-agent example at
dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-LocalCodeAct
is the supported entry-point sample for this package.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* style(local-codeact-dotnet): satisfy check-format rules
- Add UTF-8 BOM to source files (CHARSET)
- Remove unused using directives (IDE0005)
- Simplify type names (IDE0001/IDE0002/IDE0090)
- Rename static field JsonOptions -> s_jsonOptions (IDE1006)
- Rename static field SyncRoot -> s_syncRoot (IDE1006)
- Add missing this. qualifications in ProcessBridge (IDE0009)
- Remove unused _options field from LocalCodeActProvider (IDE0052)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(local-codeact-dotnet): wire hosted sample into solution
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(local-codeact-dotnet): sync embedded Python scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(local-codeact-dotnet): exercise Python integration on Windows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Address LocalCodeAct API review feedback
Move the required Python executable path to LocalCodeAct constructors, invert the validation flag default, and apply small project/file mount cleanup suggestions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Address LocalCodeAct concurrency review
Surface unauthorized mount traversal errors and use concurrent provider registries for LocalCodeAct tool and file mount CRUD operations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Simplify LocalCodeAct function wrappers
Use AIFunctionFactory-created inner functions for LocalCodeAct execute_code wrappers and remove redundant script cache and JsonNode cloning logic.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Update LocalCodeAct factory result tests
Handle JsonElement result values produced by AIFunctionFactory delegation in LocalCodeAct execute_code integration tests.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Rebuild Hyperlight sandbox after tool registry updates
Track provider tool registry updates in Hyperlight run snapshots so subsequent executions rebuild the sandbox after AddTools replaces registered tools.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Strengthen Hyperlight registry replacement test
Add provider-level coverage that same-name AddTools replacement changes the captured execute_code snapshot fingerprint.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Use Guid for Hyperlight registry version
Use a Guid token for Hyperlight tool registry generations to avoid overflow concerns in long-lived providers.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Fix Hyperlight Guid test import
Add the missing System import required by the Guid-based Hyperlight fingerprint test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add an optional Func<JsonElement?, AIFunctionArguments> argument marshaler to inline and class-based skills so callers can customize how raw JSON tool-call arguments are converted into AIFunctionArguments before delegate invocation. This enables handling backends (e.g. vLLM) that send tool-call arguments as a JSON string instead of a JSON object. The marshaler can be supplied at the script, inline-skill, or class-skill level; when omitted, the existing strict JSON-object behavior is preserved unchanged.
Co-authored-by: SergeyMenshykh <SergeMenshikh@outlook.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Improve PR template and breaking-change label automation
- Add a structured "Related Issue" section using GitHub closing keywords
- Add a Review Guide prompt (major changes, impact, reviewer focus) with a
note that the focus item is for human reviewers only
- Add checklist items for issue linkage / no duplicate PRs and invert the
breaking-change item (checked = not breaking)
- Extend label-title-prefix to prepend [BREAKING] when the "breaking change"
label is added
- Add label-breaking-change workflow to apply the "breaking change" label
when a PR title contains [BREAKING]
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add pull-requests agent skill with dotnet/python links
- Add root .github/skills/pull-requests/SKILL.md covering PR description
authoring (following the PR template) and the review-comment workflow
(review -> plan -> user review -> implement -> reply to all -> resolve)
- Symlink the skill from python/.github/skills and dotnet/.github/skills
- Reference the skill from python/AGENTS.md and dotnet/AGENTS.md
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fold breaking-change labeling into label-pr workflow
Move the title -> 'breaking change' label logic into the existing label-pr
workflow (which already applies the python/.NET labels) and drop the separate
label-breaking-change workflow.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address PR title prefix review feedback
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Pin patched MessagePack for .NET restore
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Revert MessagePack central pin
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Move title prefix tests out of tracked GitHub tests
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Exclude skill docs from CI path filters
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Match skill symlinks in CI path exclusions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Exclude AGENTS docs from CI path filters
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Scope title-prefix normalization to a real prefix
The normalization branch in addTitlePrefix matched ^Python (no colon), so
titles like "Python samples improvements" or "Pythonic refactor" were treated
as already-prefixed and only re-cased, never receiving the "Python: " prefix.
Scope the match to ^<prefix>:\s* so only an actual existing prefix is
normalized; otherwise the prefix is prepended. Same fix applies to the .NET
prefix (e.g. ".NETStandard bump").
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added CosmosOptionsHelper (in Microsoft.Agents.AI.CosmosNoSql namespace)
that sets CosmosClientOptions.ApplicationName per component, producing
wire-visible UserAgent suffixes:
- CosmosChatHistoryProvider: Microsoft.Agents.CosmosNoSql.ChatHistory/{version}
- CosmosCheckpointStore: Microsoft.Agents.CosmosNoSql.Checkpoint/{version}
This ensures Cosmos DB requests from the Agent Framework are identifiable
in telemetry, enabling usage tracking and diagnostics queries that can
distinguish between chat history and checkpoint workloads.
Addressed review feedback:
- Truncates ApplicationName to 64 chars (Cosmos SDK max length)
- Moved helper to Microsoft.Agents.AI.CosmosNoSql namespace (scoped ownership)
- Uses StringComparison.Ordinal for IndexOf call
When users provide their own CosmosClient instance, the ApplicationName
is not overridden - users retain full control.
Co-authored-by: TheovanKraay <TheovanKraay@users.noreply.github.com>
* Fix CopySessionConfig and CopyResumeSessionConfig ignoring Streaming value (#4732)
CopySessionConfig() and CopyResumeSessionConfig() hardcoded Streaming = true,
ignoring the caller's explicitly set SessionConfig.Streaming value. This made it
impossible to disable streaming when using AsAIAgent() with the GitHub Copilot SDK.
Changed both methods to use source.Streaming ?? true (and source?.Streaming ?? true
for the nullable overload), preserving the caller's value when set while maintaining
backward compatibility by defaulting to true when unset.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix non-streaming response path for SessionConfig.Streaming=false (#4732)
The config-copy fix (preserving Streaming=false via null-coalescing) was
already in place, but ConvertToAgentResponseUpdate(AssistantMessageEvent)
always emitted raw AIContent without text—assuming delta events had already
delivered it. When streaming is disabled there are no delta events, so the
assistant's final text was silently dropped.
Changes:
- Add isStreaming parameter to ConvertToAgentResponseUpdate for
AssistantMessageEvent so it emits TextContent in non-streaming mode.
- Capture the resolved streaming flag in RunCoreStreamingAsync and pass
it through the event subscription closure.
- Add/update unit tests for both streaming and non-streaming paths.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add test for null Data path in ConvertToAgentResponseUpdate (#4732)
Add a regression test covering the null-propagation path where
AssistantMessageEvent.Data is null. The production code already handles
this via ?. operators, but no test previously verified the behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add LoopAgent capability for Harnesses
* Address PR comments.
* Add support for returning user messages and response aggregation
* Support fresh context per iteration with input sessions via cloning
* Add ability to receive newly created sessions via callback
* Address PR comments
* Add judge criteria
* Address PR comments
* Adds Valkey to chat message history
* Address review: switch to Valkey.Glide, add options class, remove context provider
- Switch from StackExchange.Redis to Valkey.Glide 1.1.0 (official Valkey .NET client)
- Extract optional params into ValkeyChatHistoryProviderOptions
- Add JsonSerializerOptions support, remove [RequiresUnreferencedCode]
- Make MaxMessages/MaxMessagesToRetrieve readonly via options
- Remove ValkeyContextProvider (overlaps with ChatHistoryMemoryProvider + MEVD)
- Remove ValkeyProviderScope (only used by context provider)
- Remove connection string constructors (caller manages IConnectionMultiplexer)
- Update samples to use new API and gpt-5.4-mini
* Use type-safe JsonSerializer overloads, remove suppress attributes
Use JsonSerializerOptions.GetTypeInfo() for Serialize/Deserialize calls
to enable NativeAOT/trimming compatibility without suppress attributes.
Default to AgentAbstractionsJsonUtilities.DefaultOptions when no options provided.
Signed-off-by: Matthias Howell <matthias.howell@improving.com>
* Update READMEs: remove context provider references
Remove ValkeyContextProvider and long-term memory references from sample
READMEs since the context provider was removed from this PR. Simplify
Valkey server requirements (no search module needed for chat history).
Signed-off-by: Matthias Howell <matthias.howell@improving.com>
* Apply suggestion from @westey-m
* Fix formatting (dotnet format)
Signed-off-by: Matthias Howell <matthias.howell@improving.com>
* Update dotnet/src/Microsoft.Agents.AI.Valkey/Microsoft.Agents.AI.Valkey.csproj
Co-authored-by: Roger Barreto <19890735+rogerbarreto@users.noreply.github.com>
---------
Signed-off-by: Matthias Howell <matthias.howell@improving.com>
Co-authored-by: Matthias Howell <matthias.howell@yoppworks.com>
Co-authored-by: westey <164392973+westey-m@users.noreply.github.com>
Co-authored-by: Roger Barreto <19890735+rogerbarreto@users.noreply.github.com>
* .NET: Make GitHub.Copilot.SDK build targets reach transitive consumers (#6455)
Microsoft.Agents.AI.GitHub.Copilot now ships a buildTransitive/ bridge so
consumers who only reference this package (the normal use case) get the
GitHub.Copilot.SDK's CLI binary-download MSBuild targets executed at build
time. Without this, the SDK shipped its targets under build/ which NuGet
only auto-imports for projects with a direct PackageReference to the SDK,
so consumers of the adapter package got only the managed .dll, no
copilot.exe in their output, and a runtime InvalidOperationException on
the first RunAsync.
The bridge consists of two files under buildTransitive/:
* Microsoft.Agents.AI.GitHub.Copilot.props is generated at this package's
pack time and pins the SDK version (from PackageVersion items in
Directory.Packages.props) into _MicrosoftAgentsAICopilotSdkVersion.
* Microsoft.Agents.AI.GitHub.Copilot.targets is static and imports the
SDK's own build/GitHub.Copilot.SDK.targets from the NuGet cache using
the pinned version. The version-pin condition no-ops gracefully if the
resolved SDK differs from what was baked in (e.g. consumer overrides
the SDK version directly), so this is purely additive.
Verified by packing locally, restoring from a flat local feed, and
building a transitive-only consumer (PackageReference to MAF only, no
direct SDK ref). copilot.exe lands at bin/{cfg}/{tfm}/runtimes/{rid}/
native/copilot.exe as expected, matching the path the SDK's runtime
CopilotClient looks at.
Fixes#6455
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address Copilot review feedback (#6457)
- buildTransitive/.targets: compute the full SDK targets path with a single
Path.Combine call into one property (_MicrosoftAgentsAICopilotSdkTargetsPath),
used in both Project= and Exists() — no more split between Path.Combine for
the directory and inline / separator for the file name.
- Split the version-defaulting Condition between the two files: the generated
.props now just bakes the packaged SDK version into a dedicated property
(_MicrosoftAgentsAICopilotSdkPackagedVersion), and the static .targets file
is the single place that defaults _MicrosoftAgentsAICopilotSdkVersion to it.
Removes the need for any MSBuild escape gymnastics in the pack-time string
construction, and keeps the consumer override path the same.
- _GenerateBuildTransitiveProps now hangs off public BeforeTargets (Build, Pack)
in addition to _GetPackageFiles, so the file is generated even without a
full pack, and we're not solely dependent on an underscore-prefixed internal
target. The <None Pack=true /> items live in a top-level ItemGroup so they
are collected at evaluation time instead of being added from inside the
Target.
End-to-end retested with a transitive-only consumer (PackageReference to MAF
only, no direct GitHub.Copilot.SDK ref): copilot.exe lands at
bin/Debug/net10.0/runtimes/win-x64/native/copilot.exe (141.8 MB) as before.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Add Hosted-Toolbox-AuthPaths sample and auto-map /readiness with toolbox health gating (#5777)
Add a new hosted agent sample demonstrating five MCP tool authentication paths
(API key, agent MI, project MI, custom OAuth, literal token) via a Foundry Toolbox.
Package changes (Microsoft.Agents.AI.Foundry.Hosting):
- MapFoundryResponses now auto-maps GET /readiness via MapHealthChecks, idempotent
across Tier 1/2 (AgentHost, already mapped) and Tier 3 (WebApplication, gap filled).
- AddFoundryResponses registers AddHealthChecks() so the pipeline is available.
- AddFoundryToolboxes registers FoundryToolboxHealthCheck on the /readiness aggregate,
gating readiness on pre-registered toolbox startup outcome (per spec section 3.1).
- FoundryToolboxService now exposes StartupStatus and FailedToolboxNames properties.
New types:
- FoundryToolboxStartupStatus (public enum): Pending, Healthy, Failed, NoEndpoint.
- FoundryToolboxHealthCheck (internal IHealthCheck): adapts startup status to the
AspNetCore HealthChecks pipeline with failed toolbox names in result data.
Tests:
- 3 new tests for /readiness auto-mapping (Tier 3 default, pre-mapped skip, idempotent).
- 4 new tests for FoundryToolboxHealthCheck (Pending, NoEndpoint, Failed, Healthy).
- 3 enhanced FoundryToolboxServiceTests with StartupStatus assertions.
* .NET: Align FoundryToolboxService with tools-integration-spec (#5777 Part A)
Bring Microsoft.Agents.AI.Foundry.Hosting's toolbox path into compliance with
tools-integration-spec.md sections 2-4, 6.3, and 9. Empirically validated
against tao-foundry-prj: the previous code (reading FOUNDRY_AGENT_TOOLSET_ENDPOINT,
which the platform never injects) silently registered zero tools in production.
Package changes (Microsoft.Agents.AI.Foundry.Hosting):
- FoundryToolboxService.StartAsync now derives the toolbox proxy base URL from
the platform-injected FOUNDRY_PROJECT_ENDPOINT and constructs the per-toolbox
URL as {FOUNDRY_PROJECT_ENDPOINT}/toolboxes/{name}/mcp?api-version={ApiVersion}
per spec sections 2-3. The legacy FOUNDRY_AGENT_TOOLSET_ENDPOINT env var is
removed outright (preview package, no production consumers).
- FoundryToolboxOptions.ApiVersion default flipped to 'v1' to match spec example.
- FoundryToolboxBearerTokenHandler always sends the mandatory
Foundry-Features: Toolboxes=V1Preview header per spec section 2, merging any
additional flags supplied via the FOUNDRY_AGENT_TOOLSET_FEATURES env var.
- FoundryToolboxBearerTokenHandler token scope changed from
https://cognitiveservices.azure.com/.default to https://ai.azure.com/.default
per spec section 4.
- FoundryToolboxBearerTokenHandler propagates W3C trace context (traceparent,
tracestate, baggage) from Activity.Current per spec section 6.3.
Sample changes:
- Hosted-Toolbox-AuthPaths and Hosted-Toolbox Program.cs, README.md, and
.env.example corrected to describe the actual env-var contract
(FOUNDRY_PROJECT_ENDPOINT auto-injected; AZURE_AI_PROJECT_ENDPOINT as the
local-dev fallback). Removes the misleading 'auto-injected by Foundry runtime'
claims for FOUNDRY_AGENT_TOOLSET_ENDPOINT.
- Hosted-Toolbox-AuthPaths/agent.manifest.yaml declares the toolbox and model
dependencies under resources[] per the AgentManifest schema so azd ai agent
init users get them provisioned automatically.
Tests:
- 4 new FoundryToolboxServiceTests covering env-var derivation, EndpointOverride
precedence, trailing-slash normalization, and the existing NoEndpoint behavior
under the new env var name.
- 4 new FoundryToolboxBearerTokenHandlerTests covering token scope, mandatory
feature header always present, header merging with override, no duplicate
mandatory flag, trace context propagation from Activity.Current, and no
override of caller-set traceparent.
- New FoundryProjectEndpointEnvFixture xUnit collection definition serializes
env-var-mutating tests across FoundryToolboxServiceTests and
FoundryToolboxHealthCheckTests, preventing parallel-execution races.
- FoundryToolboxHealthCheckTests adjusted for the new env var name.
* .NET: Drop ACA prereq from Hosted-Toolbox-AuthPaths README (#5777 Part B)
Empirically verified that any Azure Cognitive Services MCP endpoint already in
the Foundry project (e.g., a Language service MCP) accepts Entra tokens and can
serve Paths 2 and 3 without deploying a separate Azure MCP Server to ACA.
README updates:
- Step 0 rewritten: 'Identify an Entra-authenticated MCP target in your project'
instead of 'Deploy Azure MCP Server to Azure Container Apps' (the original
azmcp-foundry-aca-mi setup is now optional, not required).
- Auth-paths matrix updated to describe AAD-based connections targeting a
Cognitive Services MCP URL (e.g., Language service) instead of an ACA URL.
- Step 2 connections table updated: the Entra ID category is now a single 'AAD'
authType. The original 'Agent Identity' vs 'Project Managed Identity' as
selectable connection sub-types is NOT exposed via the ARM control plane
today; the platform selects the calling principal contextually. Both
connections in the walkthrough share the same shape and target.
- Added an explicit RBAC note: the agent identity AND project MI must hold the
required role (typically Cognitive Services User) on the target resource;
without it the MCP server returns HTTP 401 even though the connection wiring
is correct.
- Toolbox tool entries renamed lang_entra_agent / lang_entra_project to
match the new connection names.
Empirical validation supporting these changes is captured in the session
plan.md (Part B addendum).
* .NET: Document correct connection shape for Hosted-Toolbox-AuthPaths Paths 2/3 (#5777)
Updates the sample README with the verified connection shape and RBAC procedure
for Microsoft Entra agent-identity and project-managed-identity MCP authentication:
- Connection authType values: AgenticIdentityToken (agent identity) and
ProjectManagedIdentity (project MI), both with category=RemoteTool.
- Top-level audience property required; for Cognitive Services targets the value
is https://cognitiveservices.azure.com.
- Connections created via ARM REST (the Foundry portal wizard does not yet
expose these authTypes).
- RBAC grants target the project's shared agent identity blueprint principal
(project.properties.agentIdentity.agentIdentityId) for Path 2 and the
project's system-assigned MI (project.identity.principalId) for Path 3.
- Troubleshooting table updated with the audience-mismatch symptom and the
startup-cache behavior of FoundryToolboxService.
* .NET: Drop Path 3 (project MI) and align with new agent model in Hosted-Toolbox-AuthPaths (#5777)
Updates the sample to use only the new Foundry agent object model and removes
the project managed identity path:
- Auth-path matrix reduced to four paths: key, Entra agent identity, custom
OAuth, inline authorization. Project managed identity is moved into a note
describing when it applies (multiple agents sharing access) rather than as
a documented sample path.
- RBAC instructions reference the agent's own instance_identity.principal_id
from the agent ARM resource (new agent object model) instead of the
project's shared agent identity blueprint (legacy model).
- Step 2 (connections) creates only the AgenticIdentityToken connection.
- Step 3 (toolbox tools) lists four tool entries instead of five.
- Sample prompts and troubleshooting table updated to match.
* .NET: Restore Path 3 (project MI) to Hosted-Toolbox-AuthPaths matrix (#5777)
The sample's purpose is to enumerate every authentication path a Foundry toolbox
can drive, not to pick one. Path 3 belongs alongside the other four with
explicit guidance for when each path is the right choice.
- Path 3 (project managed identity, authType=ProjectManagedIdentity) restored
to the matrix with a 'When to pick this' column.
- Step 2 (connections) provisions both lang-mcp-agent-id and lang-mcp-project-mi
via ARM REST.
- Step 3 (toolbox) lists five tool entries (one per path).
- RBAC instructions cover both the agent's instance identity (Path 2) and the
project's system-assigned MI (Path 3).
- Sample prompts include all five paths.
- Troubleshooting table updated accordingly.
* .NET: Fix duplicate line in Hosted-Toolbox-AuthPaths README (#5777)
* .NET: Fix broken markdown link to ToolCallingApprovalHostedAgentFixture (#5777)
* .NET: Fix relative path depth in markdown link (#5777)
* .NET: Address Copilot review feedback for #5777
- FoundryToolboxHealthCheck description: rename FOUNDRY_AGENT_TOOLSET_ENDPOINT
→ FOUNDRY_PROJECT_ENDPOINT (stale reference; operator-facing in /readiness body).
- FoundryToolboxStartupStatus.NoEndpoint XML doc: same rename.
- ServiceCollectionExtensions XML docs: same rename + URL shape update.
- Foundry.Hosting.IntegrationTests.TestContainer: remove explicit
app.MapGet('/readiness') — now redundant + would conflict with the
auto-mapped readiness route from MapFoundryResponses.
- Hosted-Toolbox-AuthPaths agent.manifest.yaml: parameterize TOOLBOX_NAME via
{{TOOLBOX_NAME}} template substitution and declare it under parameters with a
default of 'auth-paths-toolbox' so the README's 'use any name' guidance
actually works for hosted deployments.
* .NET: Address Copilot review round 2 — fallback env + dedup + naming (#5777)
- FoundryToolboxService.StartAsync: fall back to AZURE_AI_PROJECT_ENDPOINT when
FOUNDRY_PROJECT_ENDPOINT is absent. Matches the local-dev convention used by
the samples and resolves the doc/code mismatch flagged in review.
- FoundryToolboxHealthCheck description updated for the fallback.
- AddFoundryToolboxes: guard against duplicate health-check registration via an
explicit name-uniqueness check on HealthCheckServiceOptions.Registrations.
AddCheck<T>(name, ...) does not dedupe by name, so repeated AddFoundryToolboxes
calls would have registered multiple instances.
- FoundryToolboxOptions.EndpointOverride doc: clarify URL becomes
{EndpointOverride}/toolboxes/{name}/mcp (was missing /toolboxes/ segment).
- Hosted-Toolbox sample (Program.cs + README): switch FOUNDRY_TOOLBOX_NAME to
TOOLBOX_NAME (the FOUNDRY_* prefix is reserved by the platform), default
changed from 'my-toolset' to 'my-toolbox', terminology updated from 'Toolset'
to 'Toolbox'.
- FoundryToolboxServiceTests: 2 test renames to reflect what they actually
assert (StartupStatus + FailedToolboxNames, not URL shape directly).
- Tests adjusted to clear both env vars in NoEndpoint scenarios.
* .NET: Fix stale NoEndpoint XML doc and misleading test comment (#5777)
Update FoundryToolboxStartupStatus.NoEndpoint XML doc to mention both
FOUNDRY_PROJECT_ENDPOINT and AZURE_AI_PROJECT_ENDPOINT (the service
checks both since the fallback was added).
Fix test comment that claimed URL derivation validation when the test
only asserts on StartupStatus and FailedToolboxNames.
* Remove OAuth consent path from AuthPaths sample, keep four working auth paths
The interactive OAuth identity passthrough path needs a protocol gap closed in the
hosting package (the proprietary oauth_consent_request item is not representable
through the OpenAI/MEAI abstractions), so it is deferred to a separate spike branch.
This strips the OAuth path from the AuthPaths sample, the companion REPL client, the
agent manifest, and the docs, then renumbers the inline Authorization path so the
sample teaches four contiguous paths: API key via connection, Entra agent identity,
Entra project managed identity, and inline Authorization (anti-pattern).
Package code is unchanged; the consent infrastructure already present in main stays
as baseline. Both samples build with --warnaserror and all 246 hosting unit tests pass.
* .NET: Drop project MI auth path and dedicated client from Hosted-Toolbox-AuthPaths (#5777)
Live validation against tao-foundry-prj showed the ProjectManagedIdentity
path failing with an unresolved token audience 401, so the sample now ships
three working auth paths instead of four: connection key, agent managed
identity, and inline Authorization.
Changes:
- Remove the project managed identity path from the AuthPaths sample matrix,
prerequisites, connections, toolbox table, prompts, Program.cs instructions
and agent.manifest.yaml.
- Delete the near duplicate Hosted-Toolbox-AuthPaths-Client project and remove
it from the solution. The README now drives the agent with the shared
SimpleAgent REPL via AsAIAgent(agentEndpoint).
- Correct the troubleshooting note: the Foundry toolbox tools/list is all or
nothing, so one bad source returns -32007, fails startup, and returns 424
for every path. Add the allowed_tools caveat that names must match the
upstream server.
- Mark the toolbox startup status and health check experimental under
AgentsAIExperiments (MAAI001) instead of AIOpenAIResponses, and update the
package NoWarn set accordingly.
* .NET: Address PR review nits for Hosted-Toolbox-AuthPaths (#5777)
- Remove duplicated NU1903 comment in Foundry.Hosting csproj.
- Fix stale 'four-tool' cross-links in Hosted-Toolbox and Hosted-McpTools READMEs to describe the three-path toolbox driven by the shared SimpleAgent REPL.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Address toolbox startup-status review feedback (#5777)
- Rename FoundryToolboxStartupStatus.Failed to Unhealthy so it is the proper opposite of Healthy, and clarify the doc comment covers the partial-failure case.
- Raise the missing-endpoint toolbox log from Information to Warning, since enabling toolboxes is an explicit opt-in and a silently disabled toolbox warrants a higher-severity signal.
- Update unit tests and the AuthPaths README troubleshooting row accordingly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* .NET: Reword toolbox-wiring comment to avoid hosting-layer internals (#5777)
Address PR review feedback: explain how a Foundry Toolbox is attached using the public API (AddFoundryToolboxes vs the CreateHostedMcpToolbox marker) and observable behavior, instead of naming the internal AgentFrameworkResponseHandler type and FoundryToolboxService.Tools property.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix .NET Copilot integration tests for SDK v1.0.0
- Remove hard-skip in favor of runtime Assert.Skip when COPILOT_GITHUB_TOKEN is not set
- Add [Trait("Category", "Integration")] for CI filtering
- Fix FunctionTool test: use explicit SessionConfig with Tools, OnPermissionRequest, and SystemMessage
- Mark RemoteMcp test as IntegrationDisabled (requires OAuth flow)
- Create explicit sessions in all tests and delete after each (cleanup)
- Remove unused System.Diagnostics import
- Simplify SkipIfCopilotNotConfigured to only check env var
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Address review: use try/finally for session cleanup, IsNullOrWhiteSpace
- Wrap act/assert in try/finally so sessions are always deleted even on failure
- Use IsNullOrWhiteSpace instead of IsNullOrEmpty for token check
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add COPILOT_GITHUB_TOKEN to .NET integration test workflow
The Copilot SDK runtime reads this env var directly for authentication.
No Node.js/npm install needed - the SDK downloads the CLI binary at build time.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Peter Ibekwe