3 Commits

• .NET: Add Hosted-AgentSkills sample with Foundry Skills integration (#6013)

  * .NET: Add Hosted-AgentSkills sample for Foundry Skills integration
  
  Add a new hosted agent sample that demonstrates how to load behavioral
  guidelines from Foundry Skills at startup using AgentSkillsProvider and
  the progressive disclosure pattern (advertise -> load on demand).
  
  The sample:
  - Downloads SKILL.md files from Foundry via ProjectAgentSkills SDK
  - Extracts ZIP archives with zip-slip protection
  - Wires skills into AgentSkillsProvider as an AIContextProvider
  - Hosts the agent via the Responses protocol
  
  Ships two Contoso Outdoors skills matching the Python sample (PR #5822):
  - support-style: tone, formatting, signature guidelines
  - escalation-policy: when and how to escalate tickets
  
  Includes convenience provisioning gated behind PROVISION_SAMPLE_SKILLS
  env var, clearly documented as NOT a production pattern.
  
  Closes #5776
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * .NET: Add unit tests and integration test for Hosted-AgentSkills
  
  Unit tests (14 tests, all passing):
  - ZIP extraction with zip-slip guard (valid archive, traversal attack,
    sibling-prefix attack, directory entries)
  - Skill name validation (rejects dots, separators, traversal patterns)
  - AgentSkillsProvider with downloaded skills (advertises both skills,
    load_skill returns canary tokens, unknown skill returns error)
  
  Container integration test:
  - New 'agent-skills' scenario in the test container that creates
    Contoso Outdoors skills on disk and wires AgentSkillsProvider
  - AgentSkillsHostedAgentFixture + 4 integration tests verifying:
    - Routine questions load support-style skill (STYLE-CANARY-3318)
    - Escalation triggers load escalation-policy (ESC-CANARY-7742)
    - Skills are advertised in system prompt
    - load_skill tool is invoked via FunctionCallContent
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * .NET: Add smoke test, bootstrap, and docs for agent-skills integration
  
  - Add scripts/smoke.ps1 for local Docker smoke testing: builds the
    contributor image, runs the container, verifies both skills are loaded
    via canary tokens (STYLE-CANARY-3318, ESC-CANARY-7742)
  - Add 'agent-skills' to the bootstrap script scenario list
  - Add agent-skills row to the integration test README scenarios table
  - Exclude HostedAgentSkillsPatternTests from net472 (uses net8.0+ APIs)
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * .NET: Update commented-out package versions to latest across all hosted samples
  
  Update the end-user PackageReference versions (in the commented-out
  sections) from 1.0.0 to the current latest NuGet versions:
  
  - Microsoft.Agents.AI: 1.6.1
  - Microsoft.Agents.AI.Foundry: 1.6.1-preview.260514.1
  - Microsoft.Agents.AI.Foundry.Hosting: 1.6.1-preview.260514.1
  - Microsoft.Agents.AI.Hosting: 1.6.1-preview.260514.1
  - Microsoft.Agents.AI.OpenAI: 1.6.1
  - Microsoft.Agents.AI.Workflows: 1.6.1
  
  Also adds explicit versions to Hosted-Workflow-Handoff which had bare
  PackageReference entries without Version attributes.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * .NET: Fix broken markdown links in Hosted-AgentSkills README
  
  Remove references to non-existent ../../README.md. Replace with
  inline instructions matching other hosted samples that don't have
  a parent README.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  * .NET: Use OS-appropriate string comparison in zip-slip guard
  
  Use Ordinal on Unix (case-sensitive FS) and OrdinalIgnoreCase on
  Windows to prevent case-based path bypass on Linux containers.
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  
  ---------
  
  Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

  Roger Barreto · 2026-05-25 09:32:04 +00:00
  dc4bafbc1e
• .NET: Bump Azure.AI.Projects to 2.1.0-beta.2 and add agent-endpoint AsAIAgent path (#5899)

  * .NET: Bump Azure.AI.Projects to 2.1.0-beta.2 and add agent-endpoint AsAIAgent path
  
  Bumps Azure.AI.Projects to 2.1.0-beta.2 with the matching transitive pins (Azure.Core 1.55.0, System.ClientModel 1.11.0).
  
  Foundry agent endpoint plumbing:
  * FoundryAgent now routes the agent-endpoint constructor through the new GetProjectResponsesClientForAgentEndpoint helper.
  * Adds an internal FoundryAgent ctor that takes an existing AIProjectClient plus a parsed agent endpoint so the public extension does not need to construct a second project client.
  * Adds public AIProjectClient.AsAIAgent(Uri agentEndpoint, ...) extension. This is the path consumer samples are expected to use for hosted agents because version selection happens server-side.
  * Trims the dangling "If you want to construct a FoundryAgent against a project endpoint..." sentence from ParseAgentEndpoint.
  
  Unit tests:
  * Four new tests in AzureAIProjectChatClientExtensionsTests cover the AIProjectClient.AsAIAgent(Uri agentEndpoint, ...) overload. 263/263 pass.
  
  Consumer samples (Using-Samples):
  * SimpleAgent and SessionFilesClient now read AZURE_AI_PROJECT_ENDPOINT and AZURE_AI_AGENT_NAME (both required, throw on missing), derive the agent endpoint with new Uri($"{projectEndpoint}/agents/{agentName}/endpoint/protocols/openai"), then call aiProjectClient.AsAIAgent(agentEndpoint, ...).
  * SessionFilesClient README updated.
  
  Contributor samples (responses/*):
  * New HostedContributorRouteExtensions.MapDevTemporaryLocalAgentEndpoint() wildcard route extension so localhost contributor servers accept the per-agent OpenAI endpoint shape the production Hosted runtime exposes.
  * All 11 contributor Program.cs files call MapDevTemporaryLocalAgentEndpoint() with a contributor-only warning comment.
  * Hosted-Files and Hosted-AzureSearchRag were importing Hosted_Shared_Contributor_Setup but never calling AddDevTemporaryLocalContributorSetup(). Both now call it so HostedSessionIsolationKeyProvider resolves correctly in dev.
  * Hosted-AzureSearchRag, Hosted-Files, Hosted-MemoryAgent csprojs drop stale VersionOverride="2.1.0-beta.1" pins.
  * Hosted-AzureSearchRag and Hosted-Files csprojs add ProjectReference to Hosted_Shared_Contributor_Setup.
  * Hosted-Observability/.dockerignore removed the out/ exclusion that was blocking COPY out/ . in Dockerfile.contributor.
  
  Verified:
  * Full solution-scoped build of changed projects: green.
  * Scoped CI-parity dotnet format via WSL2 + Docker (mcr.microsoft.com/dotnet/sdk:10.0) over every changed csproj: clean.
  * Foundry unit tests: 263/263.
  * Contributor docker smoke for 8 hosted samples (publish + docker build + docker run + curl POST to the wildcard route): HTTP 200 / 500 with route matched.
  * End-to-end smoke against the real Azure Foundry project with a fresh bearer token: Hosted-Files contributor container served HTTP 200, the agent invoked ListBundledFiles, and returned the expected file name.
  
  * Address PR review: forward pipeline settings; add UTs
  
  - CreateProjectClientOptions also carries RetryPolicy, NetworkTimeout, ClientLoggingOptions, MessageLoggingPolicy (was Transport+UserAgentApplicationId only).
  
  - Make CreateProjectClientOptions internal so tests can verify the copy directly.
  
  - Add AsAIAgent(Uri) UTs covering tools forwarding to inner ChatOptions and null tools handling.
  
  - Add CreateProjectClientOptions UTs covering null caller and full pipeline-settings copy.

  Roger Barreto · 2026-05-18 20:20:56 +00:00
  aad20c2b33
• .NET: Add Hosted-MemoryAgent sample with isolation key plumbing (#5692) (#5702)

  * .NET: Add Hosted-MemoryAgent sample with isolation key plumbing (#5692)
  
  Adds HostedSessionContext + HostedSessionIsolationKeyProvider in Microsoft.Agents.AI.Foundry.Hosting so AIContextProviders (notably FoundryMemoryProvider) can scope per user via the platform's x-agent-user-isolation-key / x-agent-chat-isolation-key headers.
  
  - New types: HostedSessionContext (sealed), HostedSessionContextExtensions (public Get, internal Set), abstract HostedSessionIsolationKeyProvider (async), internal PlatformHostedSessionIsolationKeyProvider mapping ResponseContext.Isolation.
  
  - AgentFrameworkResponseHandler now resolves the provider, tags fresh sessions, and validates resumed sessions against the live request (strict 403 'Hosted session identity context mismatch' on any mismatch; 500 on null keys).
  
  - New shared sample project Hosted_Shared_Contributor_Setup hosts DevTemporaryTokenCredential and DevTemporaryLocalSessionIsolationKeyProvider plus AddDevTemporaryLocalContributorSetup. All 9 existing responses samples migrated to consume it so local runs keep working under the strict isolation contract.
  
  - New Hosted-MemoryAgent sample: travel assistant wired through FoundryMemoryProvider with stateInitializer reading session.GetHostedContext().UserId. Includes Dockerfile, smoke.ps1, agent.yaml/manifest.
  
  - New IT scenario 'memory' in Foundry.Hosting.IntegrationTests + MemoryHostedAgentFixture + MemoryHostedAgentTests. Verified end to end against the tao Foundry project.
  
  - ADR 0026 captures the design tree.
  
  * Address PR review feedback
  
  - Dockerfile: add header noting it targets NuGet builds; contributors must use Dockerfile.contributor for ProjectReference source builds.
  
  - PlatformHostedSessionIsolationKeyProvider: doc said 'returns context with empty values'; corrected to 'returns null' which the handler treats as 500.
  
  - FakeHostedSessionIsolationKeyProvider: doc clarifies that null configurations are allowed for testing the handler error path.
  
  - HostedSessionContextExtensions.SetHostedContext: enforce write-once with InvalidOperationException; doc + xml exception updated.
  
  - AgentFrameworkResponseHandler: cache PlatformHostedSessionIsolationKeyProvider as static readonly to avoid per-request allocation.
  
  - MemoryHostedAgentTests: tighten waits from 20s to 5s (FoundryMemoryProvider defaults UpdateDelay=0; ingestion ~3s).
  
  - Sample Program.cs imports reordered to satisfy IDE0005.
  
  * Add HostedFoundryMemoryProviderScopes built-in helpers (#5692)
  
  Addresses review feedback from @lokitoth on Hosted-MemoryAgent/Program.cs:54.
  
  - New HostedFoundryMemoryProviderScopes static class with PerUser, PerChat, PerUserAndChat factories returning Func<AgentSession?, FoundryMemoryProvider.State>.
  
  - All helpers throw InvalidOperationException when GetHostedContext() is null, with a message pointing at writing a custom stateInitializer for non-hosted scenarios.
  
  - New HostedFoundryMemoryScope enum and AddHostedFoundryMemoryProvider DI extension (two overloads: explicit AIProjectClient and DI-resolved). Singleton lifetime. Default scope = PerUser.
  
  - Hosted-MemoryAgent sample and the memory IT scenario container both swap their inline lambdas for HostedFoundryMemoryProviderScopes.PerUser().
  
  - 14 new unit tests (241/241 hosting unit tests pass).
  
  * Replace HostedFoundryMemoryScope enum with Func<...> parameter (#5692)
  
  Address PR review feedback from @westey-m: enums are a breaking-change hazard when extended, and the enum was redundant with the existing HostedFoundryMemoryProviderScopes static class.
  
  - Delete HostedFoundryMemoryScope.cs.
  
  - AddHostedFoundryMemoryProvider DI extensions now take Func<AgentSession?, FoundryMemoryProvider.State>? stateInitializer = null. When null, default to HostedFoundryMemoryProviderScopes.PerUser().
  
  - Callers pick a built-in helper (PerUser/PerChat/PerUserAndChat) or pass a custom delegate. New built-ins are a single static method addition with zero impact on existing callers.
  
  - Tests updated; 244/244 hosting unit tests pass.
  
  * Fix isolation context resume for externally-created conversations (#5692)
  
  Branch on the session's existing hosted-context (not on conversation_id presence) so a conversation provisioned externally (e.g. via conversations.CreateProjectConversationAsync) is treated as fresh on first hosted-agent request and stamped, rather than rejected with 403 hosted_session_identity_mismatch. Strict equality is preserved on real resume of an already-stamped session.
  
  Also tighten dotnet/global.json to version 10.0.204 + rollForward latestPatch so local builds match the CI Docker image SDK and avoid 10.0.300 dotnet format stripping required usings.
  
  * Revert global.json SDK pin to upstream (#5692)
  
  The 10.0.204 + latestPatch pin from the previous commit broke the dotnet-format CI job (hostfxr_resolve_sdk2 could not find a compatible SDK in the mcr.microsoft.com/dotnet/sdk:10.0 image). Restore upstream 10.0.200 + minor; local Release builds with SDK 10.0.300 should set GITHUB_ACTIONS=true to bypass the auto-format-on-build target.

  Roger Barreto · 2026-05-15 05:42:12 +00:00
  ad95f2f2fa