Fix Foreach body exit wiring in declarative workflows

.NET: Add MCP long-running task support for MCP client tools (#5994 )
* Add MCP long-running task support for MCP client tools * Fixed project file formatting issue. * Removed experimentation tag from MCP alpha project. * Addressed PR comments
2026-06-16 21:04:09 +08:00 · 2026-05-22 15:19:36 -07:00 · 2026-05-22 19:09:54 +00:00 · 2026-05-22 19:09:18 +00:00 · 2026-05-22 18:15:06 +00:00 · 2026-05-22 15:31:18 +00:00
364 changed files with 25374 additions and 3851 deletions
@@ -17,7 +17,7 @@ runs:
    using: "composite"
    steps:
      - name: Set up uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
        with:
            version-file: "python/pyproject.toml"
            enable-cache: true
@@ -32,7 +32,13 @@ runs:
              if grep -q "name = \"$pkg\"" "$f"; then
                pkg_dir=$(dirname "$f" | sed 's|python/||')
                echo "Excluding workspace package: $pkg ($pkg_dir)"
-                sed -i.bak '/\[tool\.uv\.workspace\]/a\exclude = ["'"$pkg_dir"'"]' python/pyproject.toml
+                if awk '/^\[tool\.uv\.workspace\]/{f=1;next} /^\[/{f=0} f && /^exclude = \[/{found=1} END{exit !found}' python/pyproject.toml; then
+                  if ! awk '/^\[tool\.uv\.workspace\]/{f=1;next} /^\[/{f=0} f && /^exclude = \[/ && index($0, "\"'"$pkg_dir"'\"")' python/pyproject.toml | grep -q .; then
+                    sed -i.bak '/\[tool\.uv\.workspace\]/,/^\[/ { /^exclude = \[/ s|\]|, "'"$pkg_dir"'"]| }' python/pyproject.toml
+                  fi
+                else
+                  sed -i.bak '/\[tool\.uv\.workspace\]/a\exclude = ["'"$pkg_dir"'"]' python/pyproject.toml
+                fi
                sed -i.bak '/'"$pkg"' = { workspace = true }/d' python/pyproject.toml
              fi
            done
@@ -40,4 +46,4 @@ runs:
      - name: Install the project
        shell: bash
        run: |
-          cd python && uv sync --all-packages --all-extras --dev -U --prerelease=if-necessary-or-explicit
+          cd python && uv sync --all-packages --all-extras --dev --prerelease=if-necessary-or-explicit
@@ -24,7 +24,7 @@ runs:
  using: "composite"
  steps:
    - name: Set up Node.js environment
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
      with:
        node-version: 22

@@ -37,7 +37,7 @@ runs:
      run: copilot --version && copilot -p "What can you do in one sentence?"

    - name: Azure CLI Login
-      uses: azure/login@v2
+      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
      with:
        client-id: ${{ inputs.azure-client-id }}
        tenant-id: ${{ inputs.azure-tenant-id }}
@@ -44,9 +44,15 @@ updates:

  # Maintain dependencies for github-actions
  - package-ecosystem: "github-actions"
-    # Workflow files stored in the
-    # default location of `.github/workflows`
-    directory: "/"
+    # Cover both the standard workflow location and our composite actions.
+    # With `directory: "/"` Dependabot only scans `.github/workflows/*.{yml,yaml}`
+    # plus a root-level `action.yml/action.yaml`. It does NOT recurse into
+    # `.github/actions/*/action.yml`, so the glob below is required to keep the
+    # composite actions in `.github/actions/<name>/` up to date as well.
+    # Ref: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#directories-or-directory--
+    directories:
+      - "/"
+      - "/.github/actions/*"
    schedule:
      interval: "weekly"
      day: "sunday"
@@ -32,13 +32,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,7 +51,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -64,6 +64,6 @@ jobs:
      #     ./location_of_script_within_repo/buildscript.sh

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
        with:
          category: "/language:${{matrix.language}}"
@@ -66,7 +66,7 @@ jobs:

      - name: Check PR author team membership
        id: check
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        env:
          TEAM_NAME: ${{ secrets.DEVELOPER_TEAM }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
@@ -116,7 +116,7 @@ jobs:
    steps:
      # Safe checkout: base repo only, not the untrusted PR head.
      - name: Checkout target repo base
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
          fetch-depth: 0
@@ -125,7 +125,7 @@ jobs:

      # Private DevFlow checkout: the PAT/token grants access to this repo's code.
      - name: Checkout DevFlow
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: ${{ env.DEVFLOW_REPOSITORY }}
          ref: ${{ env.DEVFLOW_REF }}
@@ -135,12 +135,12 @@ jobs:
          path: devflow

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.13"

      - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          version: "0.11.x"
          enable-cache: true
@@ -41,8 +41,8 @@ jobs:
      functionsChanged: ${{ steps.filter.outputs.functions }}
      coreChanged: ${{ steps.filter.outputs.core }}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        id: filter
        with:
          filters: |
@@ -111,7 +111,7 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            persist-credentials: false
            sparse-checkout: |
@@ -122,7 +122,7 @@ jobs:
              declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json
      - name: Build dotnet solutions
@@ -181,7 +181,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    environment: ${{ matrix.environment }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
            persist-credentials: false
            sparse-checkout: |
@@ -202,7 +202,7 @@ jobs:
          echo "COSMOSDB_EMULATOR_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -271,7 +271,7 @@ jobs:

      - name: Azure CLI Login
        if: github.event_name != 'pull_request' && matrix.integration-tests
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -318,7 +318,7 @@ jobs:
      # Generate test reports and check coverage
      - name: Generate test reports
        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
-        uses: danielpalme/ReportGenerator-GitHub-Action@5.5.3
+        uses: danielpalme/ReportGenerator-GitHub-Action@2a82782178b2816d9d6960a7345fdd164791b323 # 5.5.3
        with:
          reports: "./TestResults/Coverage/**/*.cobertura.xml"
          targetdir: "./TestResults/Reports"
@@ -326,7 +326,7 @@ jobs:

      - name: Upload coverage report artifact
        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: CoverageReport-${{ matrix.os }}-${{ matrix.targetFramework }}-${{ matrix.configuration }} # Artifact name
          path: ./TestResults/Reports # Directory containing files to upload
@@ -338,7 +338,7 @@ jobs:

      - name: Upload integration test results
        if: always() && github.event_name != 'pull_request' && matrix.integration-tests
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dotnet-test-results-${{ matrix.targetFramework }}-${{ matrix.os }}
          path: IntegrationTestResults/**/*.junit
@@ -356,7 +356,7 @@ jobs:
    env:
      configuration: Release
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -366,7 +366,7 @@ jobs:
            python

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -381,7 +381,7 @@ jobs:
        run: dotnet build dotnet/tests/Foundry.Hosting.IntegrationTests/Foundry.Hosting.IntegrationTests.csproj -c "$configuration" --warnaserror

      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -442,7 +442,7 @@ jobs:
    runs-on: ubuntu-latest
    environment: integration
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -453,7 +453,7 @@ jobs:
            declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -465,7 +465,7 @@ jobs:
          dotnet build ./tests/Microsoft.Agents.AI.Hosting.AzureFunctions.IntegrationTests -c Release -f net10.0 --warnaserror

      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -522,7 +522,7 @@ jobs:

      - name: Upload functions test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dotnet-test-results-functions-net10.0-ubuntu-latest
          path: IntegrationTestResults/**/*.junit
@@ -560,14 +560,14 @@ jobs:
      - name: Fail workflow if tests failed
        id: check_tests_failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        id: check_tests_cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')

@@ -585,7 +585,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -597,12 +597,12 @@ jobs:
          python-version: "3.13"
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: dotnet-test-results-*
          path: dotnet-test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/dotnet-integration-report-history.json
          key: dotnet-integration-report-history-${{ github.run_id }}
@@ -619,13 +619,13 @@ jobs:
        run: cat dotnet-integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/dotnet-integration-report-history.json
          key: dotnet-integration-report-history-${{ github.run_id }}
      - name: Upload trend report
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dotnet-integration-test-report
          path: |
@@ -30,7 +30,7 @@ jobs:

    steps:
      - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -42,7 +42,7 @@ jobs:
      - name: Get changed files
        id: changed-files
        if: github.event_name == 'pull_request'
-        uses: jitterbit/get-changed-files@v1
+        uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1
        continue-on-error: true

      - name: No C# files changed
@@ -29,7 +29,7 @@ jobs:
    environment: integration
    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
          echo "COSMOS_EMULATOR_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -63,7 +63,7 @@ jobs:
          done

      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -41,7 +41,7 @@ jobs:
    environment: 'integration'
    timeout-minutes: 90
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -52,13 +52,13 @@ jobs:
            declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@v5.2.0
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -123,7 +123,7 @@ jobs:

      - name: Upload results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: verify-samples-results
          path: |
@@ -53,7 +53,7 @@ jobs:
          echo "repo=${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT"

      - name: Checkout scripts
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          sparse-checkout: .github/scripts
          fetch-depth: 1
@@ -61,7 +61,7 @@ jobs:

      - name: Check issue author team membership
        id: check
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        env:
          TEAM_NAME: ${{ secrets.DEVELOPER_TEAM }}
          ISSUE_NUMBER: ${{ steps.issue.outputs.issue_number }}
@@ -93,7 +93,7 @@ jobs:
    steps:
      # Safe checkout: base repo only.
      - name: Checkout target repo base
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -101,7 +101,7 @@ jobs:

      # Private DevFlow (maf-dashboard) checkout.
      - name: Checkout DevFlow
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: ${{ env.DEVFLOW_REPOSITORY }}
          ref: ${{ env.DEVFLOW_REF }}
@@ -111,12 +111,12 @@ jobs:
          path: devflow

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.13"

      - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          version: "0.11.x"
          enable-cache: true
@@ -126,7 +126,7 @@ jobs:
        run: uv sync --frozen

      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -137,6 +137,7 @@ jobs:
        working-directory: ${{ env.DEVFLOW_PATH }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEVFLOW_TOKEN: ${{ secrets.DEVFLOW_TOKEN }}
          SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
          AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
          ISSUE_REPO: ${{ needs.team_check.outputs.repo }}
@@ -13,7 +13,7 @@ jobs:
    permissions:
      issues: write
    steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          script: |
@@ -16,6 +16,6 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6
        with:
          repo-token: "${{ secrets.GH_ACTIONS_PR_WRITE }}"
@@ -15,7 +15,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        name: "Issue/PR: update title"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -19,13 +19,13 @@ jobs:
    runs-on: ubuntu-22.04
    # check out the latest version of the code
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      # Checks the status of hyperlinks in all files
      - name: Run linkspector
-        uses: umbrelladocs/action-linkspector@v1
+        uses: umbrelladocs/action-linkspector@963b6264d7de32c904942a70b488d3407453049e # v1
        with:
          reporter: local
          filter_mode: nofilter
@@ -19,7 +19,7 @@ jobs:
    steps:
      - name: Wait for required checks
        if: github.event_name == 'pull_request'
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        env:
          TIMEOUT_SECONDS: "3600"
          INTERVAL_SECONDS: "30"
@@ -27,7 +27,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -38,11 +38,11 @@ jobs:
          os: ${{ runner.os }}
        env:
          UV_CACHE_DIR: /tmp/.uv-cache
-      - uses: actions/cache@v5
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.cache/prek
          key: prek|${{ matrix.python-version }}|${{ hashFiles('python/.pre-commit-config.yaml') }}
-      - uses: j178/prek-action@v1
+      - uses: j178/prek-action@0bb87d7f00b0c99306c8bcb8b8beba1eb581c037 # v1
        name: Run Pre-commit Hooks (excluding poe-check)
        env:
          SKIP: poe-check
@@ -64,7 +64,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -93,7 +93,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -124,7 +124,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -22,7 +22,7 @@ jobs:
      UV_PYTHON: "3.13"
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

@@ -44,7 +44,7 @@ jobs:
      - name: Upload dependency range report
        # Always publish the report so failures are inspectable even when validation fails.
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: dependency-range-results
          path: python/scripts/dependencies/dependency-range-results.json
@@ -53,7 +53,7 @@ jobs:
      - name: Create issues for failed dependency candidates
        # Always process the report so failed candidates create actionable tracking issues.
        if: always()
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: |
            const fs = require("fs")
@@ -18,7 +18,7 @@ jobs:
      UV_PYTHON: "3.13"
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

@@ -24,9 +24,9 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
        with:
          version-file: "python/pyproject.toml"
          enable-cache: true
@@ -36,7 +36,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -69,7 +69,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -90,7 +90,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-openai
          path: ./python/pytest.xml
@@ -112,7 +112,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -141,7 +141,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-azure-openai
          path: ./python/pytest.xml
@@ -163,7 +163,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -177,7 +177,7 @@ jobs:
        run: curl -fsSL https://ollama.com/install.sh | sh
        working-directory: .
      - name: Cache Ollama models
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.ollama/models
          key: ollama-models-qwen2.5-1.5b-nomic-embed-text-v1
@@ -231,7 +231,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-misc
          path: ./python/pytest.xml
@@ -283,7 +283,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -294,7 +294,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -315,7 +315,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-functions
          path: ./python/pytest.xml
@@ -341,7 +341,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -352,7 +352,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -369,7 +369,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-foundry
          path: ./python/pytest.xml
@@ -388,7 +388,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -399,7 +399,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -416,7 +416,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-foundry-hosting
          path: ./python/pytest.xml
@@ -443,7 +443,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -468,7 +468,7 @@ jobs:
        run: uv run --directory packages/azure-cosmos poe integration-tests -n logical --dist worksteal --timeout=120 --session-timeout=900 --timeout_method thread --retries 2 --retry-delay 5 --junitxml=${{ github.workspace }}/python/pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-cosmos
          path: ./python/pytest.xml
@@ -496,7 +496,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -506,12 +506,12 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: test-results-*
          path: test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-integration-${{ github.run_id }}
@@ -528,13 +528,13 @@ jobs:
        run: cat integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-integration-${{ github.run_id }}
      - name: Upload unified trend report
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: integration-test-report
          path: |
@@ -558,12 +558,12 @@ jobs:
    steps:
      - name: Fail workflow if tests failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')
@@ -24,8 +24,8 @@ jobs:
    outputs:
      pythonChanges: ${{ steps.filter.outputs.python}}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        id: filter
        with:
          filters: |
@@ -59,7 +59,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up python and install the project
        id: python-setup
@@ -94,7 +94,7 @@ jobs:
      # Surface failing tests
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/packages/lab/**.xml
          summary: true
@@ -41,8 +41,8 @@ jobs:
      foundryHostingChanged: ${{ steps.filter.outputs.foundry_hosting }}
      cosmosChanged: ${{ steps.filter.outputs.cosmos }}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
        id: filter
        with:
          filters: |
@@ -106,7 +106,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -123,7 +123,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -153,7 +153,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -177,7 +177,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -186,7 +186,7 @@ jobs:
          title: OpenAI integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-openai
          path: ./python/pytest.xml
@@ -214,7 +214,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -223,7 +223,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -247,7 +247,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -256,7 +256,7 @@ jobs:
          title: Azure OpenAI integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-azure-openai
          path: ./python/pytest.xml
@@ -284,7 +284,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -295,7 +295,7 @@ jobs:
        run: curl -fsSL https://ollama.com/install.sh | sh
        working-directory: .
      - name: Cache Ollama models
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.ollama/models
          key: ollama-models-qwen2.5-1.5b-nomic-embed-text-v1
@@ -370,7 +370,7 @@ jobs:
          kill -KILL -- "-$server_pid" 2>/dev/null || kill -KILL "$server_pid" 2>/dev/null || true
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -379,7 +379,7 @@ jobs:
          title: Misc integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-misc
          path: ./python/pytest.xml
@@ -417,7 +417,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -426,7 +426,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -448,7 +448,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -457,7 +457,7 @@ jobs:
          title: Functions integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-functions
          path: ./python/pytest.xml
@@ -488,7 +488,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -497,7 +497,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -515,7 +515,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -524,7 +524,7 @@ jobs:
          title: Test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-foundry
          path: ./python/pytest.xml
@@ -549,7 +549,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -558,7 +558,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -576,7 +576,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -585,7 +585,7 @@ jobs:
          title: Foundry Hosting integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-foundry-hosting
          path: ./python/pytest.xml
@@ -620,7 +620,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -643,7 +643,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -652,7 +652,7 @@ jobs:
          title: Cosmos integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: test-results-cosmos
          path: ./python/pytest.xml
@@ -680,19 +680,19 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        uses: ./.github/actions/python-setup
        with:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: test-results-*
          path: test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-merge-${{ github.run_id }}
@@ -709,13 +709,13 @@ jobs:
        run: cat integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-merge-${{ github.run_id }}
      - name: Upload unified trend report
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: integration-test-report
          path: |
@@ -740,13 +740,13 @@ jobs:
      - name: Fail workflow if tests failed
        id: check_tests_failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        id: check_tests_cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')
@@ -23,7 +23,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -56,7 +56,7 @@ jobs:
      - name: Build the package
        run: uv run poe --directory packages/${{ env.PACKAGE }} build
      - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          files: |
            python/dist/*
@@ -29,7 +29,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -49,7 +49,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 01-get-started --save-report --report-name 01-get-started

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-01-get-started
@@ -82,7 +82,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -111,7 +111,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents --exclude providers --save-report --report-name 02-agents

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents
@@ -130,7 +130,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -152,7 +152,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/openai --save-report --report-name 02-agents-openai

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-openai
@@ -170,7 +170,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -191,7 +191,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/azure --save-report --report-name 02-agents-azure

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-azure
@@ -208,7 +208,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -228,7 +228,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/anthropic --save-report --report-name 02-agents-anthropic

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-anthropic
@@ -242,7 +242,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -257,7 +257,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/github_copilot --save-report --report-name 02-agents-github-copilot

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-github-copilot
@@ -274,7 +274,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -289,7 +289,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/amazon --save-report --report-name 02-agents-amazon

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-amazon
@@ -306,7 +306,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -321,7 +321,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/ollama --save-report --report-name 02-agents-ollama

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-ollama
@@ -341,7 +341,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -363,7 +363,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/foundry --save-report --report-name 02-agents-foundry

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-foundry
@@ -383,7 +383,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -405,7 +405,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/copilotstudio --save-report --report-name 02-agents-copilotstudio

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-copilotstudio
@@ -419,7 +419,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -434,7 +434,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/custom --save-report --report-name 02-agents-custom

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-02-agents-custom
@@ -451,7 +451,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -471,7 +471,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 03-workflows --save-report --report-name 03-workflows

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-03-workflows
@@ -491,7 +491,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -506,7 +506,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 04-hosting --save-report --report-name 04-hosting

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-04-hosting
@@ -534,7 +534,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -549,7 +549,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 05-end-to-end --save-report --report-name 05-end-to-end

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-05-end-to-end
@@ -574,7 +574,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -599,7 +599,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir autogen-migration --save-report --report-name autogen-migration

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-autogen-migration
@@ -633,7 +633,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -662,7 +662,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir semantic-kernel-migration --save-report --report-name semantic-kernel-migration

      - name: Upload validation report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-report-semantic-kernel-migration
@@ -690,10 +690,10 @@ jobs:
      - validate-autogen-migration
      - validate-semantic-kernel-migration
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download all validation reports
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          pattern: validation-report-*
          path: reports/
@@ -701,7 +701,7 @@ jobs:

      - name: Restore validation history
        id: cache-restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: validation-history/
          key: validation-history-${{ github.run_id }}
@@ -719,13 +719,13 @@ jobs:
        run: cat trend-report.md >> "$GITHUB_STEP_SUMMARY"

      - name: Save validation history
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: validation-history/
          key: validation-history-${{ github.run_id }}

      - name: Upload trend report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: validation-trend-report
@@ -19,9 +19,9 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Download coverage report
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          run-id: ${{ github.event.workflow_run.id }}
@@ -46,7 +46,7 @@ jobs:
          echo "PR_NUMBER=$PR_NUMBER" >> "$GITHUB_ENV"
      - name: Pytest coverage comment
        id: coverageComment
-        uses: MishaKav/pytest-coverage-comment@v1.6.0
+        uses: MishaKav/pytest-coverage-comment@26f986d2599c288bb62f623d29c2da98609e9cd4 # v1.6.0
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          issue-number: ${{ env.PR_NUMBER }}
@@ -22,7 +22,7 @@ jobs:
    env:
      UV_PYTHON: "3.11"
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      # Save the PR number to a file since the workflow_run event
      # in the coverage report workflow does not have access to it
      - name: Save PR number
@@ -42,7 +42,7 @@ jobs:
      - name: Check coverage threshold
        run: python ${{ github.workspace }}/.github/workflows/python-check-coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
      - name: Upload coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          path: |
            python/python-coverage.xml
@@ -27,7 +27,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -46,7 +46,7 @@ jobs:
      # Surface failing tests
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@v0.7.2
+        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -31,9 +31,9 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.13'

@@ -26,10 +26,10 @@
    <PackageVersion Include="Azure.AI.AgentServer.Invocations" Version="1.0.0-beta.3" />
    <PackageVersion Include="Azure.AI.AgentServer.Responses" Version="1.0.0-beta.4" />
    <PackageVersion Include="Azure.Search.Documents" Version="12.0.0" />
-    <PackageVersion Include="Azure.AI.Projects" Version="2.1.0-beta.1" />
+    <PackageVersion Include="Azure.AI.Projects" Version="2.1.0-beta.2" />
    <PackageVersion Include="Azure.AI.Agents.Persistent" Version="1.2.0-beta.10" />
    <PackageVersion Include="Azure.AI.OpenAI" Version="2.9.0-beta.1" />
-    <PackageVersion Include="Azure.Core" Version="1.53.0" />
+    <PackageVersion Include="Azure.Core" Version="1.55.0" />
    <PackageVersion Include="Azure.Identity" Version="1.21.0" />
    <PackageVersion Include="DotNetEnv" Version="3.1.1" />
    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.5.0" />
@@ -44,7 +44,7 @@
    <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.6" />
    <PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
    <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.5" />
-    <PackageVersion Include="System.ClientModel" Version="1.10.0" />
+    <PackageVersion Include="System.ClientModel" Version="1.11.0" />
    <PackageVersion Include="System.CodeDom" Version="10.0.0" />
    <PackageVersion Include="System.Collections.Immutable" Version="10.0.1" />
    <PackageVersion Include="System.CommandLine" Version="2.0.0-rc.2.25502.107" />
@@ -112,6 +112,7 @@
    <PackageVersion Include="ModelContextProtocol" Version="1.1.0" />
    <!-- Hyperlight -->
    <PackageVersion Include="Hyperlight.HyperlightSandbox.Api" Version="0.4.0" />
+    <PackageVersion Include="Hyperlight.HyperlightSandbox.Guest.Python" Version="0.4.0" />
    <!-- Inference SDKs -->
    <PackageVersion Include="Microsoft.ML.OnnxRuntimeGenAI" Version="0.10.0" />
    <PackageVersion Include="Microsoft.ML.Tokenizers" Version="2.0.0" />
@@ -121,9 +121,11 @@
  <Folder Name="/Samples/02-agents/Harness/">
    <File Path="samples/02-agents/Harness/README.md" />
    <Project Path="samples/02-agents/Harness/Harness_Shared_Console/Harness_Shared_Console.csproj" />
+    <Project Path="samples/02-agents/Harness/Harness_Shared_Console_OpenAI/Harness_Shared_Console_OpenAI.csproj" />
    <Project Path="samples/02-agents/Harness/Harness_Step01_Research/Harness_Step01_Research.csproj" />
    <Project Path="samples/02-agents/Harness/Harness_Step02_Research_WithBackgroundAgents/Harness_Step02_Research_WithBackgroundAgents.csproj" />
    <Project Path="samples/02-agents/Harness/Harness_Step03_DataProcessing/Harness_Step03_DataProcessing.csproj" />
+    <Project Path="samples/02-agents/Harness/Harness_Step04_CodeExecution/Harness_Step04_CodeExecution.csproj" />
    <Project Path="samples/02-agents/Harness/ConsoleReactiveFramework/ConsoleReactiveFramework.csproj" />
    <Project Path="samples/02-agents/Harness/ConsoleReactiveComponents/ConsoleReactiveComponents.csproj" />
  </Folder>
@@ -210,6 +212,7 @@
  </Folder>
  <Folder Name="/Samples/02-agents/ModelContextProtocol/">
    <File Path="samples/02-agents/ModelContextProtocol/README.md" />
+    <Project Path="samples/02-agents/ModelContextProtocol/Agent_MCP_LongRunningTask_Client/Agent_MCP_LongRunningTask_Client.csproj" />
    <Project Path="samples/02-agents/ModelContextProtocol/Agent_MCP_Server/Agent_MCP_Server.csproj" />
    <Project Path="samples/02-agents/ModelContextProtocol/Agent_MCP_Server_Auth/Agent_MCP_Server_Auth.csproj" />
    <Project Path="samples/02-agents/ModelContextProtocol/FoundryAgent_Hosted_MCP/FoundryAgent_Hosted_MCP.csproj" />
@@ -279,6 +282,7 @@
  </Folder>
  <Folder Name="/Samples/03-workflows/Orchestration/">
    <Project Path="samples/03-workflows/Orchestration/Handoff/Handoff.csproj" />
+    <Project Path="samples/03-workflows/Orchestration/Magentic/Magentic.csproj" />
  </Folder>
  <Folder Name="/Samples/03-workflows/Observability/">
    <Project Path="samples/03-workflows/Observability/ApplicationInsights/ApplicationInsights.csproj" />
@@ -599,6 +603,7 @@
    <Project Path="src/Microsoft.Agents.AI.Hosting.OpenAI/Microsoft.Agents.AI.Hosting.OpenAI.csproj" />
    <Project Path="src/Microsoft.Agents.AI.Hosting/Microsoft.Agents.AI.Hosting.csproj" />
    <Project Path="src/Microsoft.Agents.AI.Hyperlight/Microsoft.Agents.AI.Hyperlight.csproj" />
+    <Project Path="src/Microsoft.Agents.AI.Mcp/Microsoft.Agents.AI.Mcp.csproj" />
    <Project Path="src/Microsoft.Agents.AI.Mem0/Microsoft.Agents.AI.Mem0.csproj" />
    <Project Path="src/Microsoft.Agents.AI.OpenAI/Microsoft.Agents.AI.OpenAI.csproj" />
    <Project Path="src/Microsoft.Agents.AI.Purview/Microsoft.Agents.AI.Purview.csproj" />
@@ -652,6 +657,7 @@
    <Project Path="tests/Microsoft.Agents.AI.Hosting.OpenAI.UnitTests/Microsoft.Agents.AI.Hosting.OpenAI.UnitTests.csproj" />
    <Project Path="tests/Microsoft.Agents.AI.Hosting.UnitTests/Microsoft.Agents.AI.Hosting.UnitTests.csproj" />
    <Project Path="tests/Microsoft.Agents.AI.Hyperlight.UnitTests/Microsoft.Agents.AI.Hyperlight.UnitTests.csproj" />
+    <Project Path="tests/Microsoft.Agents.AI.Mcp.UnitTests/Microsoft.Agents.AI.Mcp.UnitTests.csproj" />
    <Project Path="tests/Microsoft.Agents.AI.Mem0.UnitTests/Microsoft.Agents.AI.Mem0.UnitTests.csproj" />
    <Project Path="tests/Microsoft.Agents.AI.OpenAI.UnitTests/Microsoft.Agents.AI.OpenAI.UnitTests.csproj" />
    <Project Path="tests/Microsoft.Agents.AI.Purview.UnitTests/Microsoft.Agents.AI.Purview.UnitTests.csproj" />
@@ -1151,6 +1151,25 @@ internal static class AgentsSamples
            SkipReason = "Runs as an MCP stdio server that does not exit on its own.",
        },

+        new SampleDefinition
+        {
+            Name = "Agent_MCP_LongRunningTask_Client",
+            ProjectPath = "samples/02-agents/ModelContextProtocol/Agent_MCP_LongRunningTask_Client",
+            RequiredEnvironmentVariables = ["AZURE_OPENAI_ENDPOINT"],
+            OptionalEnvironmentVariables = ["AZURE_OPENAI_DEPLOYMENT_NAME"],
+            MustContain =
+            [
+                "=== Transparent long-running MCP task (RunAsync) ===",
+                "=== Transparent long-running MCP task (RunStreamingAsync) ===",
+            ],
+            ExpectedOutputDescription =
+            [
+                "The output should show an agent analyzing a dataset named 'sales-2025-q1' and producing a summary mentioning rows, revenue, anomalies, or outliers.",
+                "The output should contain both a non-streaming response (after RunAsync) and a streaming response (after RunStreamingAsync) for the same analysis question.",
+                "The output should not contain error messages or stack traces.",
+            ],
+        },
+
        new SampleDefinition
        {
            Name = "AGUI_Step01_GettingStarted_Client",
@@ -1,14 +1,14 @@
 <Project>
  <PropertyGroup>
    <!-- Central version prefix - applies to all nuget packages. -->
-    <VersionPrefix>1.6.1</VersionPrefix>
+    <VersionPrefix>1.6.2</VersionPrefix>
    <RCNumber>1</RCNumber>
-    <DateSuffix>260514</DateSuffix>
+    <DateSuffix>260521</DateSuffix>
    <PackageVersion Condition="'$(IsReleaseCandidate)' == 'true'">$(VersionPrefix)-rc$(RCNumber)</PackageVersion>
    <PackageVersion Condition="'$(IsReleaseCandidate)' != 'true' AND '$(VersionSuffix)' != ''">$(VersionPrefix)-$(VersionSuffix).$(DateSuffix).1</PackageVersion>
    <PackageVersion Condition="'$(IsReleaseCandidate)' != 'true' AND '$(VersionSuffix)' == ''">$(VersionPrefix)-preview.$(DateSuffix).1</PackageVersion>
    <PackageVersion Condition="'$(IsReleased)' == 'true'">$(VersionPrefix)</PackageVersion>
-    <GitTag>1.6.1</GitTag>
+    <GitTag>1.6.2</GitTag>

    <Configurations>Debug;Release;Publish</Configurations>
    <IsPackable>true</IsPackable>
@@ -24,6 +24,11 @@ public static class AnsiEscapes
    /// </summary>
    public static string MoveCursor(int row, int column) => $"\x1b[{row};{column}H";

+    /// <summary>
+    /// Erases the current line from the cursor position to the end of the line (EL 0).
+    /// </summary>
+    public static string EraseToEndOfLine => "\x1b[0K";
+
    /// <summary>
    /// Erases the entire current line (EL 2).
    /// </summary>
@@ -39,7 +39,7 @@ public class ListSelection : ConsoleReactiveComponent<ListSelectionProps, Consol
        {
            foreach (string line in props.Title.Split('\n'))
            {
-                Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
+                Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
                Console.Write(AnsiEscapes.EraseEntireLine);
                Console.Write(line);
                row++;
@@ -51,7 +51,7 @@ public class ListSelection : ConsoleReactiveComponent<ListSelectionProps, Consol

        for (int i = 0; i < totalItems; i++)
        {
-            Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
+            Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
            Console.Write(AnsiEscapes.EraseEntireLine);

            bool isSelected = i == props.SelectedIndex;
@@ -58,11 +58,11 @@ public class TextInput : ConsoleReactiveComponent<TextInputProps, ConsoleReactiv
    public override void RenderCore(TextInputProps props, ConsoleReactiveState state)
    {
        int promptLength = props.Prompt.Length;
-        int textWidth = this.Width - promptLength;
+        int textWidth = props.Width - promptLength;
        string indent = new(' ', promptLength);

        // First line: prompt + start of text
-        Console.Write(AnsiEscapes.MoveCursor(this.Y, this.X));
+        Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
        Console.Write(AnsiEscapes.EraseEntireLine);
        Console.Write(props.Prompt);

@@ -90,7 +90,7 @@ public class TextInput : ConsoleReactiveComponent<TextInputProps, ConsoleReactiv
        while (offset < props.Text.Length)
        {
            int chunk = Math.Min(textWidth, props.Text.Length - offset);
-            Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
+            Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
            Console.Write(AnsiEscapes.EraseEntireLine);
            Console.Write(indent);
            Console.Write(props.Text[offset..(offset + chunk)]);
@@ -17,7 +17,7 @@ public record TextPanelProps : ConsoleReactiveProps
 /// <summary>
 /// A component that renders a list of pre-rendered string items vertically.
 /// Designed for rendering dynamic items in a non-scroll region that may be
-/// re-rendered on each update. If the component's <see cref="ConsoleReactiveComponent.Height"/>
+/// re-rendered on each update. If the component's <see cref="ConsoleReactiveProps.Height"/>
 /// exceeds the number of output lines, leftover lines are erased.
 /// </summary>
 public class TextPanel : ConsoleReactiveComponent<TextPanelProps, ConsoleReactiveState>
@@ -51,18 +51,18 @@ public class TextPanel : ConsoleReactiveComponent<TextPanelProps, ConsoleReactiv

            for (int j = 0; j < lineCount; j++)
            {
-                Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y + currentRow));
+                Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y + currentRow));
                Console.Write(lines[j]);
                currentRow++;
            }
        }

        // If the component height exceeds the output, erase leftover lines
-        if (this.Height > currentRow)
+        if (props.Height > currentRow)
        {
-            for (int i = currentRow; i < this.Height; i++)
+            for (int i = currentRow; i < props.Height; i++)
            {
-                Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y + i));
+                Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y + i));
            }
        }
    }
@@ -52,7 +52,7 @@ public class TextScrollPanel : ConsoleReactiveComponent<TextScrollPanelProps, Te
        }

        // Move cursor to the bottom of the scroll area
-        Console.Write(AnsiEscapes.MoveCursor(this.Y + this.Height - 1, this.X));
+        Console.Write(AnsiEscapes.MoveCursor(props.Y + props.Height - 1, props.X));

        // Output only new items since last rendered
        for (int i = state.RenderedCount; i < props.Items.Count; i++)
@@ -9,9 +9,6 @@ namespace Harness.ConsoleReactiveComponents;
 /// </summary>
 public record TopBottomRuleProps : ConsoleReactiveProps
 {
-    /// <summary>Gets the width of the horizontal rules in characters.</summary>
-    public int Width { get; init; }
-
    /// <summary>Gets the foreground color of the horizontal rules. If <c>null</c>, the default terminal color is used.</summary>
    public ConsoleColor? Color { get; init; }
 }
@@ -32,7 +29,7 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        int childrenHeight = 0;
        foreach (var child in props.Children)
        {
-            childrenHeight += child.Height;
+            childrenHeight += child.BaseProps?.Height ?? 0;
        }

        // Top rule + children + bottom rule
@@ -51,11 +48,11 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        }

        // Top rule
-        Console.Write(AnsiEscapes.MoveCursor(this.Y, this.X));
+        Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
        Console.Write(rule);

        // Render children stacked below the top rule
-        int currentY = this.Y + 1;
+        int currentY = props.Y + 1;

        if (props.Color.HasValue)
        {
@@ -64,10 +61,9 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol

        foreach (var child in props.Children)
        {
-            child.X = this.X;
-            child.Y = currentY;
+            child.BaseProps = child.BaseProps! with { X = props.X, Y = currentY };
            child.Render();
-            currentY += child.Height;
+            currentY += child.BaseProps.Height;
        }

        if (props.Color.HasValue)
@@ -76,7 +72,7 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        }

        // Bottom rule
-        Console.Write(AnsiEscapes.MoveCursor(currentY, this.X));
+        Console.Write(AnsiEscapes.MoveCursor(currentY, props.X));
        Console.Write(rule);

        if (props.Color.HasValue)
@@ -3,8 +3,8 @@
 namespace Harness.ConsoleReactiveFramework;

 /// <summary>
-/// Abstract base class for all console UI components. Provides layout properties
-/// (position and size) and a <see cref="Render"/> method for drawing to the console.
+/// Abstract base class for all console UI components. Provides access to layout
+/// through <see cref="BaseProps"/> and a <see cref="Render"/> method for drawing to the console.
 /// Derive from <see cref="ConsoleReactiveComponent{TProps, TState}"/> instead of this class directly.
 /// </summary>
 public abstract class ConsoleReactiveComponent
@@ -13,20 +13,21 @@ public abstract class ConsoleReactiveComponent
    {
    }

-    /// <summary>Gets or sets the 1-based column position of the component.</summary>
-    public int X { get; set; }
-
-    /// <summary>Gets or sets the 1-based row position of the component.</summary>
-    public int Y { get; set; }
-
-    /// <summary>Gets or sets the width of the component in columns.</summary>
-    public int Width { get; set; }
-
-    /// <summary>Gets or sets the height of the component in rows.</summary>
-    public int Height { get; set; }
+    /// <summary>
+    /// Gets or sets the component's props as the base <see cref="ConsoleReactiveProps"/> type.
+    /// Used by parent components to set layout (X, Y, Width, Height) on children without
+    /// knowing the concrete props type.
+    /// </summary>
+    public abstract ConsoleReactiveProps? BaseProps { get; set; }

    /// <summary>Renders the component to the console at its current position.</summary>
    public abstract void Render();
+
+    /// <summary>
+    /// Invalidates the component's cached render state, causing the next <see cref="Render"/> call
+    /// to proceed even if props and state have not changed. Use after a screen erase to force repaint.
+    /// </summary>
+    public abstract void Invalidate();
 }

 /// <summary>
@@ -46,6 +47,13 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
    /// <summary>Gets or sets the component's props (external configuration).</summary>
    public TProps? Props { get; set; }

+    /// <inheritdoc/>
+    public override ConsoleReactiveProps? BaseProps
+    {
+        get => this.Props;
+        set => this.Props = (TProps?)value;
+    }
+
    /// <summary>Gets or sets the component's internal state.</summary>
    protected TState? State { get; set; }

@@ -73,8 +81,8 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
                return;
            }

-            if (ReferenceEquals(this.Props, this._lastRenderedProps)
-                && ReferenceEquals(this.State, this._lastRenderedState))
+            if (EqualityComparer<TProps>.Default.Equals(this.Props, this._lastRenderedProps)
+                && EqualityComparer<TState>.Default.Equals(this.State, this._lastRenderedState))
            {
                return;
            }
@@ -86,6 +94,16 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
        }
    }

+    /// <inheritdoc/>
+    public override void Invalidate()
+    {
+        lock (this._renderLock)
+        {
+            this._lastRenderedProps = default;
+            this._lastRenderedState = default;
+        }
+    }
+
    /// <summary>
    /// Called by <see cref="Render"/> to perform the actual rendering. Override this in derived classes.
    /// </summary>
@@ -95,11 +113,23 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
 }

 /// <summary>
-/// Base record for component props. Provides an optional <see cref="Children"/> collection
-/// for composing child components.
+/// Base record for component props. Provides layout properties (position and size)
+/// and an optional <see cref="Children"/> collection for composing child components.
 /// </summary>
 public record ConsoleReactiveProps
 {
+    /// <summary>Gets the 1-based column position of the component.</summary>
+    public int X { get; init; }
+
+    /// <summary>Gets the 1-based row position of the component.</summary>
+    public int Y { get; init; }
+
+    /// <summary>Gets the width of the component in columns.</summary>
+    public int Width { get; init; }
+
+    /// <summary>Gets the height of the component in rows.</summary>
+    public int Height { get; init; }
+
    /// <summary>Gets the child components to render within this component.</summary>
    public IReadOnlyList<ConsoleReactiveComponent> Children { get; init; } = [];
 }
@@ -0,0 +1,98 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+using System.Text.Json;
+using Microsoft.Agents.AI;
+
+namespace Harness.Shared.Console.Commands;
+
+/// <summary>
+/// Handles <c>/session-export &lt;filename&gt;</c> and <c>/session-import &lt;filename&gt;</c>
+/// commands for serializing the current session to a file and restoring a session from a file.
+/// </summary>
+public sealed class SessionCommandHandler : CommandHandler
+{
+    private readonly AIAgent _agent;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SessionCommandHandler"/> class.
+    /// </summary>
+    /// <param name="agent">The agent used for session serialization and deserialization.</param>
+    public SessionCommandHandler(AIAgent agent)
+    {
+        this._agent = agent;
+    }
+
+    /// <inheritdoc/>
+    public override string? GetHelpText() => "/session-export <file> | /session-import <file>";
+
+    /// <inheritdoc/>
+    public override async ValueTask<bool> TryHandleAsync(string input, AgentSession session, IUXStateDriver ux)
+    {
+        string command = input.Split(' ', 2)[0];
+
+        if (command.Equals("/session-export", StringComparison.OrdinalIgnoreCase))
+        {
+            await this.HandleExportAsync(input, session, ux).ConfigureAwait(false);
+            return true;
+        }
+
+        if (command.Equals("/session-import", StringComparison.OrdinalIgnoreCase))
+        {
+            await this.HandleImportAsync(input, ux).ConfigureAwait(false);
+            return true;
+        }
+
+        return false;
+    }
+
+    private async Task HandleExportAsync(string input, AgentSession session, IUXStateDriver ux)
+    {
+        string[] parts = input.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+        if (parts.Length < 2)
+        {
+            await ux.WriteInfoLineAsync("Usage: /session-export <filename>").ConfigureAwait(false);
+            return;
+        }
+
+        string filename = parts[1];
+        try
+        {
+            JsonElement serialized = await this._agent.SerializeSessionAsync(session).ConfigureAwait(false);
+            string json = JsonSerializer.Serialize(serialized);
+            await File.WriteAllTextAsync(filename, json).ConfigureAwait(false);
+            await ux.WriteInfoLineAsync($"Session exported to {filename}").ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            await ux.WriteInfoLineAsync($"Failed to export session to {filename}: {ex.Message}").ConfigureAwait(false);
+        }
+    }
+
+    private async Task HandleImportAsync(string input, IUXStateDriver ux)
+    {
+        string[] parts = input.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+        if (parts.Length < 2)
+        {
+            await ux.WriteInfoLineAsync("Usage: /session-import <filename>").ConfigureAwait(false);
+            return;
+        }
+
+        string filename = parts[1];
+        try
+        {
+            string json = await File.ReadAllTextAsync(filename).ConfigureAwait(false);
+            JsonElement element = JsonSerializer.Deserialize<JsonElement>(json);
+            AgentSession newSession = await this._agent.DeserializeSessionAsync(element).ConfigureAwait(false);
+            await ux.ReplaceSessionAsync(newSession).ConfigureAwait(false);
+            await ux.WriteInfoLineAsync($"Session imported from {filename}").ConfigureAwait(false);
+        }
+        catch (FileNotFoundException)
+        {
+            await ux.WriteInfoLineAsync($"File not found: {filename}").ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            await ux.WriteInfoLineAsync($"Failed to import session from {filename}: {ex.Message}").ConfigureAwait(false);
+        }
+    }
+}
@@ -43,7 +43,7 @@ public class AgentModeAndHelp : ConsoleReactiveComponent<AgentModeAndHelpProps,
        }

        System.Console.Write(AnsiEscapes.SaveCursor);
-        System.Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y));
+        System.Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y));

        bool hasMode = props.Mode is not null;

@@ -35,6 +35,7 @@ public class AgentStatus : ConsoleReactiveComponent<AgentStatusProps, AgentStatu
    ];

    private readonly Timer _timer;
+    private AgentStatusProps? _previousProps;

    /// <summary>
    /// Initializes a new instance of the <see cref="AgentStatus"/> class.
@@ -85,7 +86,12 @@ public class AgentStatus : ConsoleReactiveComponent<AgentStatusProps, AgentStatu
        }

        System.Console.Write(AnsiEscapes.SaveCursor);
-        System.Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y));
+        System.Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
+        if (props != this._previousProps)
+        {
+            System.Console.Write(AnsiEscapes.EraseToEndOfLine);
+            this._previousProps = props;
+        }

        if (props.ShowSpinner)
        {
@@ -0,0 +1,67 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+using System.Diagnostics;
+using System.Globalization;
+using OpenTelemetry;
+
+namespace Harness.Shared.Console;
+
+/// <summary>
+/// A simple OpenTelemetry span exporter that writes completed activities (spans) to a text file.
+/// Each span is formatted as a human-readable block with timestamps, operation name, duration,
+/// status, and any tags/events.
+/// </summary>
+public sealed class FileSpanExporter : BaseExporter<Activity>
+{
+    private readonly string _filePath;
+    private readonly object _lock = new();
+
+    public FileSpanExporter(string filePath)
+    {
+        this._filePath = filePath;
+        Directory.CreateDirectory(Path.GetDirectoryName(filePath)!);
+    }
+
+    public override ExportResult Export(in Batch<Activity> batch)
+    {
+        lock (this._lock)
+        {
+            using var writer = new StreamWriter(this._filePath, append: true);
+            foreach (var activity in batch)
+            {
+                WriteActivity(writer, activity);
+            }
+        }
+
+        return ExportResult.Success;
+    }
+
+    private static void WriteActivity(StreamWriter writer, Activity activity)
+    {
+        var start = activity.StartTimeUtc.ToString("yyyy-MM-dd HH:mm:ss.fff", CultureInfo.InvariantCulture);
+        var duration = activity.Duration.TotalMilliseconds.ToString("F1", CultureInfo.InvariantCulture);
+
+        writer.WriteLine($"[{start}] {activity.OperationName} ({duration}ms) [{activity.Status}]");
+
+        if (!string.IsNullOrEmpty(activity.DisplayName) && activity.DisplayName != activity.OperationName)
+        {
+            writer.WriteLine($"  DisplayName: {activity.DisplayName}");
+        }
+
+        foreach (var tag in activity.Tags)
+        {
+            writer.WriteLine($"  {tag.Key}: {tag.Value}");
+        }
+
+        foreach (var ev in activity.Events)
+        {
+            writer.WriteLine($"  Event: {ev.Name} @ {ev.Timestamp:HH:mm:ss.fff}");
+            foreach (var tag in ev.Tags)
+            {
+                writer.WriteLine($"    {tag.Key}: {tag.Value}");
+            }
+        }
+
+        writer.WriteLine();
+    }
+}
@@ -19,15 +19,15 @@ namespace Harness.Shared.Console;
 public sealed class HarnessAgentRunner : IDisposable
 {
    private readonly AIAgent _agent;
-    private readonly AgentSession _session;
    private readonly AgentModeProvider? _modeProvider;
    private readonly MessageInjectingChatClient? _messageInjector;
    private readonly IReadOnlyList<CommandHandler> _commandHandlers;
    private readonly IReadOnlyList<ConsoleObserver> _observers;
    private readonly IUXStateDriver _ux;
-
    private readonly SemaphoreSlim _inputGate = new(1, 1);

+    private AgentSession _session;
+
    /// <summary>
    /// Initializes a new instance of the <see cref="HarnessAgentRunner"/> class.
    /// </summary>
@@ -62,6 +62,25 @@ public sealed class HarnessAgentRunner : IDisposable
    /// </summary>
    public string HelpText { get; }

+    /// <summary>
+    /// Replaces the current session with the specified session. Used by the UX driver
+    /// when importing a serialized session. Acquires the input gate to ensure no
+    /// concurrent agent turn is reading the session.
+    /// </summary>
+    /// <param name="newSession">The new session to use.</param>
+    internal async Task ReplaceSessionAsync(AgentSession newSession)
+    {
+        await this._inputGate.WaitAsync().ConfigureAwait(false);
+        try
+        {
+            this._session = newSession;
+        }
+        finally
+        {
+            this._inputGate.Release();
+        }
+    }
+
    /// <inheritdoc/>
    public void Dispose() => this._inputGate.Dispose();

@@ -173,6 +192,11 @@ public sealed class HarnessAgentRunner : IDisposable
                        }
                    }

+                    foreach (var observer in this._observers)
+                    {
+                        await observer.OnResponseUpdateAsync(this._ux, update, this._agent, this._session).ConfigureAwait(false);
+                    }
+
                    if (!string.IsNullOrEmpty(update.Text))
                    {
                        foreach (var observer in this._observers)
@@ -63,6 +63,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            getState: () => this.State!,
            setState: s => this.SetState(s),
            requestShutdown: () => this._shutdownTcs.TrySetResult(true),
+            replaceSession: s => this.Runner!.ReplaceSessionAsync(s),
            modeColors: modeColors);

        this.Runner = runnerFactory(this._uxDriver);
@@ -370,7 +371,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            };

            bottomChildHeight = ListSelection.CalculateHeight(listProps);
-            this._listSelection.Height = bottomChildHeight;
+            listProps = listProps with { Height = bottomChildHeight };
            this._listSelection.Props = listProps;
            bottomChild = this._listSelection;
        }
@@ -397,8 +398,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            }

            bottomChildHeight = TextInput.CalculateHeight(textInputProps, state.ConsoleWidth);
-            this._textInput.Width = state.ConsoleWidth;
-            this._textInput.Height = bottomChildHeight;
+            textInputProps = textInputProps with { Width = state.ConsoleWidth, Height = bottomChildHeight };
            this._textInput.Props = textInputProps;
            bottomChild = this._textInput;
        }
@@ -412,8 +412,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            };

            bottomChildHeight = TextInput.CalculateHeight(textInputProps, state.ConsoleWidth);
-            this._textInput.Width = state.ConsoleWidth;
-            this._textInput.Height = bottomChildHeight;
+            textInputProps = textInputProps with { Width = state.ConsoleWidth, Height = bottomChildHeight };
            this._textInput.Props = textInputProps;
            bottomChild = this._textInput;
        }
@@ -458,6 +457,16 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            System.Console.Write(AnsiEscapes.EraseScrollbackBuffer);
            this._textScrollPanel.Reset();
            this._resizedSinceLastRender = false;
+
+            // Invalidate all children so they re-render even if props haven't changed
+            this._rule.Invalidate();
+            this._textScrollPanel.Invalidate();
+            this._textPanel.Invalidate();
+            this._queuedPanel.Invalidate();
+            this._agentStatus.Invalidate();
+            this._modeAndHelp.Invalidate();
+            this._textInput.Invalidate();
+            this._listSelection.Invalidate();
        }

        this._scrollRegionBottom = scrollBottom;
@@ -469,35 +478,35 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            ? state.ScrollAreaContentItems.Take(state.ScrollAreaContentItems.Count - 1).ToList()
            : [];

-        this._textScrollPanel.X = 1;
-        this._textScrollPanel.Y = 1;
-        this._textScrollPanel.Width = state.ConsoleWidth;
-        this._textScrollPanel.Height = scrollBottom;
        this._textScrollPanel.Props = new TextScrollPanelProps
        {
+            X = 1,
+            Y = 1,
+            Width = state.ConsoleWidth,
+            Height = scrollBottom,
            Items = scrollItems,
        };
        this._textScrollPanel.Render();

        // Render the text panel for the last (dynamic) item just below the scroll region
-        this._textPanel.X = 1;
-        this._textPanel.Y = scrollBottom + 1;
-        this._textPanel.Width = state.ConsoleWidth;
-        this._textPanel.Height = textPanelHeight;
        this._textPanel.Props = new TextPanelProps
        {
+            X = 1,
+            Y = scrollBottom + 1,
+            Width = state.ConsoleWidth,
+            Height = textPanelHeight,
            Items = lastItems,
        };
        this._textPanel.Render();

        // Render queued input items between text panel and agent status
        int queuedPanelY = scrollBottom + textPanelHeight + 1;
-        this._queuedPanel.X = 1;
-        this._queuedPanel.Y = queuedPanelY;
-        this._queuedPanel.Width = state.ConsoleWidth;
-        this._queuedPanel.Height = queuedPanelHeight;
        this._queuedPanel.Props = new TextPanelProps
        {
+            X = 1,
+            Y = queuedPanelY,
+            Width = state.ConsoleWidth,
+            Height = queuedPanelHeight,
            Items = state.QueuedItems,
        };
        this._queuedPanel.Render();
@@ -506,32 +515,41 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
        int agentStatusY = queuedPanelY + queuedPanelHeight;
        if (showStatusAndHelp)
        {
-            this._agentStatus.X = 1;
-            this._agentStatus.Y = agentStatusY;
-            this._agentStatus.Width = state.ConsoleWidth;
-            this._agentStatus.Height = agentStatusHeight;
-            this._agentStatus.Props = agentStatusProps;
+            this._agentStatus.Props = agentStatusProps with
+            {
+                X = 1,
+                Y = agentStatusY,
+                Width = state.ConsoleWidth,
+                Height = agentStatusHeight,
+            };
            this._agentStatus.Render();
        }

        // Render the bottom rule + child below the agent status
-        this._rule.X = 1;
-        this._rule.Y = agentStatusY + agentStatusHeight;
-        this._rule.Props = ruleProps;
+        this._rule.Props = ruleProps with
+        {
+            X = 1,
+            Y = agentStatusY + agentStatusHeight,
+        };
        this._rule.Render();

        // Render the mode-and-help line below the bottom rule
        if (showStatusAndHelp)
        {
-            int modeAndHelpY = this._rule.Y + ruleHeight;
-            this._modeAndHelp.X = 1;
-            this._modeAndHelp.Y = modeAndHelpY;
-            this._modeAndHelp.Width = state.ConsoleWidth;
-            this._modeAndHelp.Height = modeAndHelpHeight;
-            this._modeAndHelp.Props = modeAndHelpProps;
+            int modeAndHelpY = agentStatusY + agentStatusHeight + ruleHeight;
+            this._modeAndHelp.Props = modeAndHelpProps with
+            {
+                X = 1,
+                Y = modeAndHelpY,
+                Width = state.ConsoleWidth,
+                Height = modeAndHelpHeight,
+            };
            this._modeAndHelp.Render();
        }

+        // Clear the bottom padding line
+        System.Console.Write(AnsiEscapes.MoveAndEraseLine(state.ConsoleHeight));
+
        // Position cursor for natural typing appearance
        this.PositionCursor(state);
    }
@@ -545,7 +563,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            int textWidth = state.ConsoleWidth - promptLength;
            int textLength = state.InputText.Length;

-            int textInputY = this._rule.Y + 1;
+            int textInputY = (this._rule.Props?.Y ?? 0) + 1;

            if (textWidth <= 0 || textLength == 0)
            {
@@ -563,7 +581,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            && state.ListSelectionIndex == state.ListSelectionOptions.Count)
        {
            int titleLines = state.ListSelectionTitle?.Split('\n').Length ?? 0;
-            int customOptionY = this._rule.Y + 1 + titleLines + state.ListSelectionOptions.Count;
+            int customOptionY = (this._rule.Props?.Y ?? 0) + 1 + titleLines + state.ListSelectionOptions.Count;
            int cursorCol = 2 + state.ListSelectionCustomInputText.Length + 1;
            System.Console.Write(AnsiEscapes.MoveCursor(customOptionY, cursorCol));
        }
@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

+using System.Text;
 using Harness.ConsoleReactiveComponents;
 using Microsoft.Agents.AI;

@@ -24,6 +25,8 @@ public static class HarnessConsole
    {
        options ??= new();

+        System.Console.OutputEncoding = Encoding.UTF8;
+
        // Null means use defaults; an explicit (possibly empty) list means use exactly what was provided.
        var observers = options.Observers
            ?? HarnessConsoleOptions.BuildDefaultObservers();
@@ -33,7 +36,9 @@ public static class HarnessConsole
        var modeProvider = agent.GetService<AgentModeProvider>();
        var messageInjector = agent.GetService<MessageInjectingChatClient>();

-        AgentSession session = await agent.CreateSessionAsync();
+        AgentSession session = options.SessionFactory is not null
+            ? await options.SessionFactory(agent)
+            : await agent.CreateSessionAsync();

        using var component = new HarnessAppComponent(
            placeholder: userPrompt,
@@ -63,6 +68,7 @@ public static class HarnessConsole

        System.Console.ResetColor();
        System.Console.Write(AnsiEscapes.ResetScrollRegion);
+        System.Console.Write(AnsiEscapes.EraseScrollbackBuffer);
        System.Console.Write(AnsiEscapes.EraseEntireScreen);
        System.Console.Write(AnsiEscapes.MoveCursor(1, 1));
        System.Console.WriteLine("Goodbye!");
@@ -45,6 +45,12 @@ public class HarnessConsoleOptions
    /// </summary>
    public Dictionary<string, ConsoleColor> ModeColors { get; set; } = new(DefaultModeColors, StringComparer.OrdinalIgnoreCase);

+    /// <summary>
+    /// Gets or sets an optional factory for creating the <see cref="AgentSession"/>.
+    /// When <see langword="null"/> (the default), <see cref="AIAgent.CreateSessionAsync"/> is used.
+    /// </summary>
+    public Func<AIAgent, Task<AgentSession>>? SessionFactory { get; set; }
+
    /// <summary>
    /// Creates the default set of observers without planning support.
    /// Includes tool call display, tool approval, error display, reasoning display,
@@ -128,6 +134,7 @@ public class HarnessConsoleOptions
            new ExitCommandHandler(),
            new TodoCommandHandler(todoProvider),
            new ModeCommandHandler(modeProvider, modeColors ?? DefaultModeColors),
+            new SessionCommandHandler(agent),
        ];
    }
 }
@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft. All rights reserved.

 using Harness.ConsoleReactiveComponents;
+using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;

 namespace Harness.Shared.Console;
@@ -16,6 +17,7 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver
    private readonly Func<HarnessAppComponentState> _getState;
    private readonly Action<HarnessAppComponentState> _setState;
    private readonly Action _requestShutdown;
+    private readonly Func<AgentSession, Task> _replaceSession;
    private readonly IReadOnlyDictionary<string, ConsoleColor>? _modeColors;
    private readonly List<string> _outputItems = [];
    private readonly object _stateLock = new();
@@ -32,16 +34,19 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver
    /// <param name="getState">Returns the component's current state.</param>
    /// <param name="setState">Replaces the component's state and triggers a re-render.</param>
    /// <param name="requestShutdown">Callback invoked when a command handler requests application shutdown.</param>
+    /// <param name="replaceSession">Callback invoked to replace the current agent session (e.g., on import).</param>
    /// <param name="modeColors">Optional mapping of mode names to console colors.</param>
    public HarnessConsoleUXStateDriver(
        Func<HarnessAppComponentState> getState,
        Action<HarnessAppComponentState> setState,
        Action requestShutdown,
+        Func<AgentSession, Task> replaceSession,
        IReadOnlyDictionary<string, ConsoleColor>? modeColors = null)
    {
        this._getState = getState;
        this._setState = setState;
        this._requestShutdown = requestShutdown;
+        this._replaceSession = replaceSession;
        this._modeColors = modeColors;
        this._currentMode = getState().ModeText;
    }
@@ -405,4 +410,7 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver

    /// <inheritdoc/>
    public void RequestShutdown() => this._requestShutdown();
+
+    /// <inheritdoc/>
+    public Task ReplaceSessionAsync(AgentSession newSession) => this._replaceSession(newSession);
 }
@@ -0,0 +1,55 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+#pragma warning disable VSTHRD002 // Synchronous waits are required by OpenTelemetry enrichment callbacks.
+
+using OpenTelemetry;
+using OpenTelemetry.Trace;
+
+namespace Harness.Shared.Console;
+
+/// <summary>
+/// Provides factory methods for creating pre-configured OpenTelemetry tracing for harness samples.
+/// </summary>
+public static class HarnessTracing
+{
+    /// <summary>
+    /// Creates a <see cref="TracerProvider"/> that captures spans from the specified source and HTTP client activity,
+    /// enriching HTTP spans with full request/response headers and bodies, and exports all spans to a timestamped
+    /// text file in the application base directory.
+    /// </summary>
+    /// <param name="sourceName">The activity source name to subscribe to (e.g., "Harness.Research").</param>
+    /// <returns>A configured <see cref="TracerProvider"/>, or <see langword="null"/> if the builder returns null.</returns>
+    public static TracerProvider? CreateFileTracerProvider(string sourceName)
+    {
+        var traceLogPath = Path.Combine(AppContext.BaseDirectory, $"traces_{DateTime.UtcNow:yyyyMMdd_HHmmss}_{Guid.NewGuid()}.log");
+
+        return Sdk.CreateTracerProviderBuilder()
+            .AddSource(sourceName)
+            .AddHttpClientInstrumentation((options) =>
+            {
+                options.EnrichWithHttpRequestMessage = (activity, request) =>
+                {
+                    activity.SetTag("http.request.headers", request.Headers.ToString());
+                    if (request.Content != null)
+                    {
+                        activity.SetTag("http.request.content.headers", request.Content.Headers.ToString());
+                        var content = request.Content.ReadAsStringAsync().GetAwaiter().GetResult();
+                        activity.SetTag("http.request.content.body", content);
+                    }
+                };
+
+                options.EnrichWithHttpResponseMessage = (activity, response) =>
+                {
+                    activity.SetTag("http.response.headers", response.Headers.ToString());
+                    if (response.Content != null)
+                    {
+                        activity.SetTag("http.response.content.headers", response.Content.Headers.ToString());
+                        var content = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();
+                        activity.SetTag("http.response.content.body", content);
+                    }
+                };
+            })
+            .AddProcessor(new SimpleActivityExportProcessor(new FileSpanExporter(traceLogPath)))
+            .Build();
+    }
+}
@@ -7,6 +7,11 @@
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>

+  <ItemGroup>
+    <PackageReference Include="OpenTelemetry" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" />
+  </ItemGroup>
+
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI\Microsoft.Agents.AI.csproj" />
    <ProjectReference Include="..\ConsoleReactiveFramework\ConsoleReactiveFramework.csproj" />
@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

+using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;

 namespace Harness.Shared.Console;
@@ -117,4 +118,11 @@ public interface IUXStateDriver
    /// on the owning component.
    /// </summary>
    void RequestShutdown();
+
+    /// <summary>
+    /// Replaces the current agent session with the specified session (e.g., after importing
+    /// a serialized session from a file).
+    /// </summary>
+    /// <param name="newSession">The new session to use.</param>
+    Task ReplaceSessionAsync(AgentSession newSession);
 }
@@ -24,6 +24,17 @@ public abstract class ConsoleObserver
    {
    }

+    /// <summary>
+    /// Called for each <see cref="AgentResponseUpdate"/> in the response stream, regardless of
+    /// whether it contains content. Override to inspect update-level metadata such as
+    /// <see cref="AgentResponseUpdate.RawRepresentation"/> for provider-specific events.
+    /// </summary>
+    /// <param name="ux">The UX state driver, used for rendering output.</param>
+    /// <param name="update">The streaming response update.</param>
+    /// <param name="agent">The agent being interacted with.</param>
+    /// <param name="session">The current agent session.</param>
+    public virtual Task OnResponseUpdateAsync(IUXStateDriver ux, AgentResponseUpdate update, AIAgent agent, AgentSession session) => Task.CompletedTask;
+
    /// <summary>
    /// Called for each <see cref="AIContent"/> item in the response stream.
    /// </summary>
@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFrameworks>net10.0</TargetFrameworks>
+
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="OpenAI" />
+    <PackageReference Include="Microsoft.Extensions.AI" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
+
+using Harness.Shared.Console.Observers;
+using Microsoft.Agents.AI;
+using Microsoft.Extensions.AI;
+using OpenAI.Responses;
+
+namespace Harness.Shared.Console.OpenAI;
+
+/// <summary>
+/// Detects and displays error/incomplete status from OpenAI Responses API streaming updates.
+/// Handles <see cref="StreamingResponseFailedUpdate"/> and <see cref="StreamingResponseIncompleteUpdate"/>
+/// which are not surfaced as <see cref="ErrorContent"/> by the chat client.
+/// </summary>
+/// <remarks>
+/// Note: <see cref="StreamingResponseErrorUpdate"/> is already handled by the SDK — it produces
+/// an <see cref="ErrorContent"/> which is displayed by <see cref="ErrorDisplayObserver"/>.
+/// This observer covers the cases where the SDK does not produce <see cref="ErrorContent"/>.
+/// </remarks>
+public sealed class OpenAIResponsesErrorObserver : ConsoleObserver
+{
+    /// <inheritdoc/>
+    public override async Task OnResponseUpdateAsync(IUXStateDriver ux, AgentResponseUpdate update, AIAgent agent, AgentSession session)
+    {
+        // AgentResponseUpdate.RawRepresentation is the ChatResponseUpdate,
+        // whose RawRepresentation is the underlying StreamingResponseUpdate.
+        object? rawUpdate = (update.RawRepresentation as ChatResponseUpdate)?.RawRepresentation
+            ?? update.RawRepresentation;
+
+        switch (rawUpdate)
+        {
+            case StreamingResponseFailedUpdate failedUpdate:
+                // Only display if the response has error details populated.
+                // When error is null, a follow-up StreamingResponseErrorUpdate typically
+                // carries the real error — the SDK surfaces that as ErrorContent,
+                // which is displayed by ErrorDisplayObserver.
+                if (failedUpdate.Response?.Error is { } error)
+                {
+                    string errorMessage = error.Message ?? "Unknown error";
+                    string? errorCode = error.Code.ToString();
+                    string errorText = $"❌ Response failed: {errorMessage}";
+                    if (!string.IsNullOrEmpty(errorCode))
+                    {
+                        errorText += $" (code: {errorCode})";
+                    }
+
+                    await ux.WriteInfoLineAsync(errorText, ConsoleColor.Red);
+                }
+
+                break;
+
+            case StreamingResponseIncompleteUpdate incompleteUpdate:
+                string? reason = incompleteUpdate.Response?.IncompleteStatusDetails?.Reason?.ToString();
+                string incompleteText = $"⚠️ Response incomplete: {reason ?? "unknown reason"}";
+                await ux.WriteInfoLineAsync(incompleteText, ConsoleColor.Yellow);
+                break;
+        }
+    }
+}
@@ -3,19 +3,18 @@
 #pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.

 using System.Text;
-using Harness.Shared.Console;
 using Harness.Shared.Console.Observers;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
 using OpenAI.Responses;

-namespace SampleApp;
+namespace Harness.Shared.Console.OpenAI;

 /// <summary>
 /// Displays web search activity in the scroll area. Shows search queries,
 /// page opens, and find-in-page actions as they stream in from the API.
 /// </summary>
-internal sealed class OpenAIResponsesWebSearchDisplayObserver : ConsoleObserver
+public sealed class OpenAIResponsesWebSearchDisplayObserver : ConsoleObserver
 {
    private const int MaxQueryDisplayLength = 120;

@@ -13,9 +13,10 @@
  </ItemGroup>

  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
+    <ProjectReference Include="..\Harness_Shared_Console_OpenAI\Harness_Shared_Console_OpenAI.csproj" />
  </ItemGroup>

 </Project>
@@ -16,20 +16,26 @@
 #pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.

 using System.ClientModel.Primitives;
+using Azure.AI.Projects;
 using Azure.Identity;
 using Harness.Shared.Console;
+using Harness.Shared.Console.OpenAI;
 using Harness.Shared.Console.ToolFormatters;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
-using OpenAI;
-using OpenAI.Responses;
 using SampleApp;

-var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
+var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";

 const int MaxContextWindowTokens = 1_050_000;
 const int MaxOutputTokens = 128_000;
+const string TracingSourceName = "Harness.Research";
+
+// Set up OpenTelemetry tracing that writes spans to a text file.
+// This captures all agent activity (tool calls, model invocations, compaction, etc.)
+// as well as HTTP requests made by the underlying HttpClient transport.
+using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);

 // Create a HarnessAgent with the Harness providers (TodoProvider and AgentModeProvider)
 // and research-focused instructions including the mandatory planning workflow.
@@ -63,23 +69,22 @@ var instructions =
 // Only custom instructions, a WebBrowsingTool, and FileAccess opt-out are needed.
 AIAgent agent =
    // Create an OpenAIClient that communicates with the Foundry responses service.
-    new OpenAIClient(
+    new AIProjectClient(
+        new Uri(endpoint),
        // WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
        // In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
        // latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
-        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
-        new OpenAIClientOptions()
-        {
-            Endpoint = new Uri(endpoint),
-            RetryPolicy = new ClientRetryPolicy(3)          // Enable retries to improve resiliency.
-        })
+        new DefaultAzureCredential(),
+        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })  // Enable retries to improve resiliency.
+    .GetProjectOpenAIClient()
    .GetResponsesClient()
-    .AsIChatClientWithStoredOutputDisabled(deploymentName)  // We want to manage chat history locally (not stored in the responses service), so that we can manage compaction ourselves.
+    .AsIChatClient(deploymentName)
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "ResearchAgent",
        Description = "A research assistant that plans and executes research tasks.",
-        DisableFileMemory = true,                           // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
+        DisableFileAccess = true,                           // If enabled, this would allow the agent to read/write files in a working directory
+        OpenTelemetrySourceName = TracingSourceName,        // Use our custom source name so spans are captured by the TracerProvider above.
        FileMemoryStore = new FileSystemAgentFileStore(     // Configure the file memory provider to store files in a local folder called "agent-files".
            Path.Combine(AppContext.BaseDirectory, "agent-files")),
        ChatOptions = new ChatOptions
@@ -103,6 +108,7 @@ await HarnessConsole.RunAgentAsync(
    {
        Observers = [
            new OpenAIResponsesWebSearchDisplayObserver(),
+            new OpenAIResponsesErrorObserver(),
            .. HarnessConsoleOptions.BuildObserversWithPlanning(
                agent,
                planModeName: "plan",
@@ -13,9 +13,10 @@
  </ItemGroup>

  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
+    <ProjectReference Include="..\Harness_Shared_Console_OpenAI\Harness_Shared_Console_OpenAI.csproj" />
  </ItemGroup>

 </Project>
@@ -13,36 +13,42 @@
 #pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.

 using System.ClientModel.Primitives;
+using Azure.AI.Projects;
 using Azure.Identity;
 using Harness.Shared.Console;
+using Harness.Shared.Console.OpenAI;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
-using OpenAI;
-using OpenAI.Responses;

-var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
+var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";

 const int MaxContextWindowTokens = 1_050_000;
 const int MaxOutputTokens = 128_000;
+const string TracingSourceName = "Harness.SubAgents";
+
+// Set up OpenTelemetry tracing that writes spans to a text file.
+using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);
+
+// Create the AIProjectClient for communicating with the Foundry responses service.
+var projectClient = new AIProjectClient(
+    new Uri(endpoint),
+    new DefaultAzureCredential(),
+    new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) });

 // --- Background agent: Web Search Agent ---
 // This agent uses the HarnessAgent's built-in HostedWebSearchTool to search the web.
 // Features not needed by this sub-agent are disabled.
 AIAgent webSearchAgent =
-    new OpenAIClient(
-        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
-        new OpenAIClientOptions()
-        {
-            Endpoint = new Uri(endpoint),
-            RetryPolicy = new ClientRetryPolicy(3)
-        })
+    projectClient
+    .GetProjectOpenAIClient()
    .GetResponsesClient()
-    .AsIChatClientWithStoredOutputDisabled(deploymentName)
+    .AsIChatClient(deploymentName)
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "WebSearchAgent",
        Description = "An agent that can search the web to find information.",
+        OpenTelemetrySourceName = TracingSourceName,
        DisableTodoProvider = true,
        DisableAgentModeProvider = true,
        DisableFileMemory = true,   // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
@@ -82,29 +88,22 @@ var parentInstructions =
 // This agent orchestrates the sub-agent to look up stock prices in parallel.
 // Most features are disabled since the parent only needs SubAgentsProvider.
 AIAgent parentAgent =
-    new OpenAIClient(
-        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
-        new OpenAIClientOptions()
-        {
-            Endpoint = new Uri(endpoint),
-            RetryPolicy = new ClientRetryPolicy(3)
-        })
+    projectClient
+    .GetProjectOpenAIClient()
    .GetResponsesClient()
-    .AsIChatClientWithStoredOutputDisabled(deploymentName)
+    .AsIChatClient(deploymentName)
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "StockPriceResearcher",
        Description = "An agent that researches stock prices using background agents.",
+        OpenTelemetrySourceName = TracingSourceName,
        DisableTodoProvider = true,
        DisableAgentModeProvider = true,
        DisableFileMemory = true,   // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
        DisableFileAccess = true,   // If enabled, this would allow the agent to read/write files in a working directory
        DisableToolApproval = true, // If enabled, this allows don't-ask-again approval functionality.
        DisableWebSearch = true,
-        AIContextProviders =
-        [
-            new BackgroundAgentsProvider([webSearchAgent]),
-        ],
+        BackgroundAgents = [webSearchAgent],
        ChatOptions = new ChatOptions
        {
            Instructions = parentInstructions,
@@ -115,4 +114,8 @@ AIAgent parentAgent =
 // Run the interactive console session.
 await HarnessConsole.RunAgentAsync(
    parentAgent,
-    userPrompt: "Enter a list of stock tickers (e.g., BAC, MSFT, BA):");
+    userPrompt: "Enter a list of stock tickers (e.g., BAC, MSFT, BA):",
+    options: new HarnessConsoleOptions
+    {
+        Observers = [new OpenAIResponsesErrorObserver(), .. HarnessConsoleOptions.BuildDefaultObservers()],
+    });
@@ -13,8 +13,8 @@
  </ItemGroup>

  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
  </ItemGroup>

@@ -16,18 +16,21 @@
 #pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.

 using System.ClientModel.Primitives;
+using Azure.AI.Projects;
 using Azure.Identity;
 using Harness.Shared.Console;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
-using OpenAI;
-using OpenAI.Responses;

-var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
+var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";

 const int MaxContextWindowTokens = 1_050_000;
 const int MaxOutputTokens = 128_000;
+const string TracingSourceName = "Harness.DataProcessing";
+
+// Set up OpenTelemetry tracing that writes spans to a text file.
+using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);

 var instructions =
    """
@@ -58,19 +61,18 @@ var instructions =
 // sample's working/ folder (copied to the output directory) so it works regardless of cwd.
 // Unused features are disabled.
 AIAgent agent =
-    new OpenAIClient(
-        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
-        new OpenAIClientOptions()
-        {
-            Endpoint = new Uri(endpoint),
-            RetryPolicy = new ClientRetryPolicy(3)
-        })
+    new AIProjectClient(
+        new Uri(endpoint),
+        new DefaultAzureCredential(),
+        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })
+    .GetProjectOpenAIClient()
    .GetResponsesClient()
-    .AsIChatClientWithStoredOutputDisabled(deploymentName)
+    .AsIChatClient(deploymentName)
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "DataAnalyst",
        Description = "A data analyst assistant that reads, analyzes, and processes data files.",
+        OpenTelemetrySourceName = TracingSourceName,
        FileAccessStore = new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, "working")),
        DisableTodoProvider = true,
        DisableAgentModeProvider = true,
@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFrameworks>net10.0</TargetFrameworks>
+
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.AI.Projects" />
+    <PackageReference Include="Azure.Identity" />
+    <PackageReference Include="Hyperlight.HyperlightSandbox.Guest.Python" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Hyperlight\Microsoft.Agents.AI.Hyperlight.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
+    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="skills\**\*" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,122 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+// This sample demonstrates a HarnessAgent with ALL features enabled, plus:
+// - Hyperlight CodeAct (HyperlightCodeActProvider) for sandboxed Python code execution
+// - Skills (AgentSkillsProvider) discovering a local "regex-tester" skill
+//
+// The agent can plan tasks with todos, manage modes, store memories, read/write files,
+// search the web, approve sensitive tools, discover and use skills, and execute arbitrary
+// Python code in a Hyperlight sandbox — all pre-configured by the HarnessAgent.
+//
+// Try asking: "Help me write a regex that matches valid email addresses, then test it."
+//
+// Special commands:
+//   /todos  — Display the current todo list without invoking the agent.
+//   /mode   — Get or set the current agent mode.
+//   /exit   — End the session.
+
+#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
+#pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.
+
+using System.ClientModel.Primitives;
+using Azure.AI.Projects;
+using Azure.Identity;
+using Harness.Shared.Console;
+using HyperlightSandbox.Guest.Python;
+using Microsoft.Agents.AI;
+using Microsoft.Agents.AI.Hyperlight;
+using Microsoft.Extensions.AI;
+
+var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
+var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";
+
+const int MaxContextWindowTokens = 1_050_000;
+const int MaxOutputTokens = 128_000;
+const string TracingSourceName = "Harness.CodeExecution";
+
+// Set up OpenTelemetry tracing that writes spans to a text file.
+using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);
+
+// Create the HyperlightCodeActProvider with the Python/Wasm backend.
+// The guest module path is resolved automatically from the Hyperlight.HyperlightSandbox.Guest.Python NuGet package.
+using var codeAct = new HyperlightCodeActProvider(
+    HyperlightCodeActProviderOptions.CreateForWasm(PythonGuestModule.GetModulePath()));
+
+var instructions =
+    """
+    ## Technical Assistant Instructions
+
+    You are a code-powered technical assistant. You can execute Python code in a sandboxed environment
+    to solve problems precisely rather than guessing. You also have access to skills that provide
+    structured workflows for specific technical tasks.
+
+    ### Code Execution
+
+    When a problem requires computation, validation, or testing:
+    - Write Python code and use `execute_code` to run it in the sandbox.
+    - Always verify results by running the code rather than reasoning about what would happen.
+    - If code fails, read the error message carefully, fix the issue, and retry.
+
+    ### Skills
+
+    You have access to discoverable skills. When a task matches a skill's description:
+    - Follow the skill's instructions carefully.
+    - Use the skill's reference materials for context.
+    - Combine the skill's workflow with code execution when appropriate.
+
+    ### Planning and Research
+
+    For complex tasks:
+    - Break the problem into steps using your todo list.
+    - Research background information using web search when needed.
+    - Save important findings to file memory for later reference.
+
+    ### Presenting Results
+
+    - Show your work: include the code you ran and its output.
+    - Explain what each part of your solution does.
+    - If applicable, save final results to file memory.
+    """;
+
+// Create the agent with ALL HarnessAgent features enabled plus Hyperlight CodeAct.
+// No Disable* flags are set — TodoProvider, AgentModeProvider, FileMemory, FileAccess,
+// ToolApproval, WebSearch, and AgentSkillsProvider are all active.
+AIAgent agent =
+    new AIProjectClient(
+        new Uri(endpoint),
+        new DefaultAzureCredential(),
+        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })
+    .GetProjectOpenAIClient()
+    .GetResponsesClient()
+    .AsIChatClient(deploymentName)
+    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
+    {
+        Name = "CodeExecutionAgent",
+        Description = "A technical assistant with sandboxed code execution and skill-based workflows.",
+        OpenTelemetrySourceName = TracingSourceName,
+        // Point the file memory at a local folder for persistent memory across sessions.
+        FileMemoryStore = new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, "agent-files")),
+        // Add the HyperlightCodeActProvider so the agent can execute Python code in a sandbox.
+        AIContextProviders = [codeAct],
+        ChatOptions = new ChatOptions
+        {
+            Instructions = instructions,
+            MaxOutputTokens = MaxOutputTokens,
+            Reasoning = new() { Effort = ReasoningEffort.Medium },
+        },
+    });
+
+// Run the interactive console session using the shared HarnessConsole helper.
+await HarnessConsole.RunAgentAsync(
+    agent,
+    userPrompt: "Ask me a technical question, or try: \"Help me write a regex that matches valid email addresses.\"",
+    new HarnessConsoleOptions
+    {
+        Observers = HarnessConsoleOptions.BuildObserversWithPlanning(
+            agent,
+            planModeName: "plan",
+            executionModeName: "execute",
+            maxContextWindowTokens: MaxContextWindowTokens,
+            maxOutputTokens: MaxOutputTokens),
+        CommandHandlers = HarnessConsoleOptions.BuildDefaultCommandHandlers(agent),
+    });
@@ -0,0 +1,51 @@
+# Harness Step 04 — Code Execution (Hyperlight + Skills)
+
+This sample demonstrates a HarnessAgent with **all features enabled**, plus:
+
+- **Hyperlight CodeAct** — sandboxed Python code execution via `execute_code` (requires KVM)
+- **Skills** — file-based skill discovery (a `regex-tester` skill is included)
+
+The agent can plan tasks, manage modes, store memories, read/write files, search the web, approve sensitive operations, discover and use skills, and execute arbitrary Python code — all pre-configured by the HarnessAgent.
+
+## Prerequisites
+
+- .NET 10 SDK
+- An Azure AI Foundry project endpoint
+- KVM-capable host (the Hyperlight sandbox runs code in micro-VMs)
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `AZURE_AI_PROJECT_ENDPOINT` | Your Azure AI Foundry project endpoint |
+| `AZURE_AI_MODEL_DEPLOYMENT_NAME` | Model deployment name (default: `gpt-5.4`) |
+
+## Running
+
+```bash
+dotnet run
+```
+
+## What to Try
+
+- **Regex testing**: "Help me write a regex that matches valid email addresses, then test it against some examples."
+- **Code execution**: "Calculate the first 20 prime numbers using the Sieve of Eratosthenes."
+- **Skill + code combo**: "I need a regex for ISO 8601 dates — test it thoroughly with edge cases."
+
+## Included Skill
+
+The `skills/regex-tester/` skill instructs the agent to validate regex patterns by executing Python test code in the Hyperlight sandbox. It includes a regex cheatsheet as reference material.
+
+## Features Enabled
+
+| Feature | Description |
+|---------|-------------|
+| TodoProvider | Task planning and tracking (`/todos` command) |
+| AgentModeProvider | Mode switching (`/mode` command) |
+| FileMemoryProvider | Persistent memory stored as files |
+| FileAccessProvider | Read/write files in a working directory |
+| ToolApproval | Don't-ask-again approval for sensitive tools |
+| WebSearch | Built-in hosted web search |
+| AgentSkillsProvider | Discovers and uses skills from the `skills/` folder |
+| HyperlightCodeActProvider | Sandboxed Python execution via `execute_code` |
+| OpenTelemetry | Trace logging to a text file |
@@ -0,0 +1,36 @@
+---
+name: regex-tester
+description: Validate, test, and debug regular expressions by executing them against sample inputs. Use when asked to build, verify, or explain a regex pattern.
+---
+
+## Usage
+
+When the user asks you to create, validate, or debug a regular expression:
+
+1. **Understand the requirement** — clarify what the pattern should match and what it should reject.
+2. **Consult the cheatsheet** — review `references/regex-cheatsheet.md` for syntax reminders if needed.
+3. **Write and execute test code** — use the `execute_code` tool to run Python code that:
+   - Compiles the regex with `re.compile()`
+   - Tests it against a set of positive examples (should match) and negative examples (should not match)
+   - Extracts and displays any capturing groups
+   - Reports pass/fail for each test case
+4. **Iterate** — if any test fails, refine the pattern and re-run until all cases pass.
+5. **Present the result** — give the user the final pattern, explain what each part does, and show the test results.
+
+## Example Test Script
+
+```python
+import re
+
+pattern = re.compile(r'^[\w.+-]+@[\w-]+\.[\w.-]+$')
+
+positives = ["user@example.com", "first.last+tag@sub.domain.org"]
+negatives = ["@missing.com", "no-at-sign", "spaces in@address.com"]
+
+for s in positives:
+    assert pattern.match(s), f"FAIL: expected match for '{s}'"
+for s in negatives:
+    assert not pattern.match(s), f"FAIL: expected no match for '{s}'"
+
+print("All tests passed!")
+```
@@ -0,0 +1,97 @@
+# Regex Quick Reference (Python `re` module)
+
+## Character Classes
+
+| Pattern | Matches |
+|---------|---------|
+| `.`     | Any character except newline |
+| `\d`    | Digit `[0-9]` |
+| `\D`    | Non-digit |
+| `\w`    | Word character `[a-zA-Z0-9_]` |
+| `\W`    | Non-word character |
+| `\s`    | Whitespace `[ \t\n\r\f\v]` |
+| `\S`    | Non-whitespace |
+| `[abc]` | Any of a, b, or c |
+| `[^abc]`| Any character except a, b, c |
+| `[a-z]` | Range: a through z |
+
+## Quantifiers
+
+| Pattern | Meaning |
+|---------|---------|
+| `*`     | 0 or more (greedy) |
+| `+`     | 1 or more (greedy) |
+| `?`     | 0 or 1 (greedy) |
+| `{n}`   | Exactly n |
+| `{n,}`  | n or more |
+| `{n,m}` | Between n and m |
+| `*?`, `+?`, `??` | Non-greedy versions |
+
+## Anchors
+
+| Pattern | Meaning |
+|---------|---------|
+| `^`     | Start of string (or line with `re.MULTILINE`) |
+| `$`     | End of string (or line with `re.MULTILINE`) |
+| `\b`    | Word boundary |
+| `\B`    | Non-word boundary |
+
+## Groups and Backreferences
+
+| Pattern | Meaning |
+|---------|---------|
+| `(...)` | Capturing group |
+| `(?:...)`| Non-capturing group |
+| `(?P<name>...)` | Named group |
+| `\1`    | Backreference to group 1 |
+| `(?=...)` | Positive lookahead |
+| `(?!...)` | Negative lookahead |
+| `(?<=...)` | Positive lookbehind |
+| `(?<!...)` | Negative lookbehind |
+
+## Flags
+
+| Flag | Effect |
+|------|--------|
+| `re.IGNORECASE` / `re.I` | Case-insensitive matching |
+| `re.MULTILINE` / `re.M`  | `^`/`$` match line boundaries |
+| `re.DOTALL` / `re.S`     | `.` matches newline |
+| `re.VERBOSE` / `re.X`    | Allow comments and whitespace |
+
+## Common Patterns
+
+| Use Case | Pattern |
+|----------|---------|
+| Email (simple) | `^[\w.+-]+@[\w-]+\.[\w.-]+$` |
+| IPv4 address | `^\d{1,3}(\.\d{1,3}){3}$` |
+| ISO date | `^\d{4}-\d{2}-\d{2}$` |
+| URL (http/https) | `^https?://[^\s/$.?#].[^\s]*$` |
+| Phone (US) | `^(\+1)?[-.\s]?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}$` |
+
+## Python API
+
+```python
+import re
+
+# Test if a string matches
+re.match(r'pattern', "string")       # match at start
+re.search(r'pattern', "string")      # match anywhere
+re.fullmatch(r'pattern', "string")   # match entire string
+
+# Find all matches
+re.findall(r'\d+', "abc 123 def 456")  # ['123', '456']
+
+# Named groups
+m = re.match(r'(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})', "2025-01-15")
+m.group('year')   # '2025'
+
+# Replace
+re.sub(r'\d+', 'X', "abc 123 def")   # 'abc X def'
+
+# Split
+re.split(r',+', "a,b,,c")            # ['a', 'b', 'c']
+
+# Compile for reuse
+pattern = re.compile(r'^\d{4}-\d{2}-\d{2}$')
+pattern.match("2025-01-15")           # Match object
+```
@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFrameworks>net10.0</TargetFrameworks>
+
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <NoWarn>$(NoWarn);MAAI001;MEAI001;MCPEXP001</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.AI.OpenAI" />
+    <PackageReference Include="Azure.Identity" />
+    <PackageReference Include="Microsoft.Extensions.AI.OpenAI" />
+    <PackageReference Include="Microsoft.Extensions.Hosting" />
+    <PackageReference Include="ModelContextProtocol" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Mcp\Microsoft.Agents.AI.Mcp.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,145 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+// This sample demonstrates the Microsoft Agent Framework's MCP long-running task support.
+//
+// A small MCP server (hosted in this same executable when launched with "--server") exposes
+// a single task-supporting tool "AnalyzeDataset" that simulates ~15 seconds of work. The
+// client (default mode) connects to it over stdio via Microsoft.Agents.AI.Mcp's
+// McpClientTaskExtensions.ListAgentToolsWithTaskSupportAsync, hands the wrapped tools to a
+// ChatClientAgent, and exercises both invocation styles:
+//   * RunAsync          — blocks until the agent's final response is ready.
+//   * RunStreamingAsync — yields response updates as the model produces them; the model
+//                         still waits for the tool's terminal result before it can begin
+//                         producing the final answer, so the perceived "pause" reflects
+//                         tool execution time, not stream-channel latency.
+//
+// In both cases the wrapper transparently:
+//   1. Calls tools/call with task augmentation (CallToolAsTaskAsync)
+//   2. Polls tasks/get until terminal (PollTaskUntilCompleteAsync)
+//   3. Fetches tasks/result and returns the final result to the function-calling loop
+//
+// No application-level loop or continuation tokens are required in either mode.
+
+using System.ComponentModel;
+using Azure.AI.OpenAI;
+using Azure.Identity;
+using Microsoft.Agents.AI;
+using Microsoft.Agents.AI.Mcp;
+using Microsoft.Extensions.AI;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using ModelContextProtocol;
+using ModelContextProtocol.Client;
+using ModelContextProtocol.Protocol;
+using ModelContextProtocol.Server;
+using OpenAI.Chat;
+
+if (args.Length > 0 && args[0] == "--server")
+{
+    await RunMcpServerAsync();
+    return;
+}
+
+var endpoint = Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_OPENAI_ENDPOINT is not set.");
+var deploymentName = Environment.GetEnvironmentVariable("AZURE_OPENAI_DEPLOYMENT_NAME") ?? "gpt-5.4-mini";
+
+// Launch this same assembly as a stdio MCP server in a child process.
+var thisAssemblyPath = typeof(Program).Assembly.Location;
+await using var mcpClient = await McpClient.CreateAsync(new StdioClientTransport(new()
+{
+    Name = "DatasetAnalyzer",
+    Command = "dotnet",
+    Arguments = [thisAssemblyPath, "--server"],
+}));
+
+// Wrap each MCP tool with task-aware behavior. The wrapper inspects the server's
+// execution.taskSupport on each tool and, when it is Required, drives the task lifecycle
+// transparently within the agent's tool loop. Tools that don't require task semantics are
+// returned as-is and invoked inline.
+var taskOptions = new McpTaskOptions
+{
+    DefaultTimeToLive = TimeSpan.FromMinutes(5),
+};
+var mcpTools = await mcpClient.ListAgentToolsWithTaskSupportAsync(taskOptions);
+
+// WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+// In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+// latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
+AIAgent agent = new AzureOpenAIClient(
+    new Uri(endpoint),
+    new DefaultAzureCredential())
+     .GetChatClient(deploymentName)
+     .AsAIAgent(
+        instructions: "You answer data-analysis questions by invoking the available tools. Always invoke a tool when one matches the request.",
+        tools: [.. mcpTools.Cast<AITool>()]);
+
+const string Prompt = "Analyze the dataset named 'sales-2025-q1' and summarize the findings.";
+
+Console.WriteLine("=== Transparent long-running MCP task (RunAsync) ===");
+Console.WriteLine("Asking the agent to analyze a dataset; the tool takes ~15s to complete.");
+Console.WriteLine("RunAsync blocks while the wrapper polls the task to completion.");
+Console.WriteLine();
+
+var stopwatch = System.Diagnostics.Stopwatch.StartNew();
+var response = await agent.RunAsync(Prompt);
+stopwatch.Stop();
+
+Console.WriteLine($"Agent response (after {stopwatch.Elapsed.TotalSeconds:F1}s):");
+Console.WriteLine(response.Text);
+
+Console.WriteLine();
+Console.WriteLine("=== Transparent long-running MCP task (RunStreamingAsync) ===");
+Console.WriteLine("Same request via the streaming API. Updates only begin to arrive after the");
+Console.WriteLine("tool's task reaches the Completed state, since the model needs the tool result");
+Console.WriteLine("before it can produce its final answer.");
+Console.WriteLine();
+
+stopwatch.Restart();
+await foreach (var update in agent.RunStreamingAsync(Prompt))
+{
+    Console.Write(update.Text);
+}
+stopwatch.Stop();
+
+Console.WriteLine();
+Console.WriteLine($"(Streaming completed after {stopwatch.Elapsed.TotalSeconds:F1}s.)");
+
+// --- Server mode (launched as a child process via --server) ---------------------------------
+static async Task RunMcpServerAsync()
+{
+    var builder = Host.CreateApplicationBuilder();
+
+    // Critical for stdio transport: any provider that writes to stdout will corrupt the
+    // JSON-RPC channel. Clear all providers; the MCP SDK routes its own diagnostics
+    // appropriately.
+    builder.Logging.ClearProviders();
+    builder.Logging.AddConsole(o => o.LogToStandardErrorThreshold = LogLevel.Trace);
+
+    builder.Services.AddMcpServer(o =>
+    {
+        o.TaskStore = new InMemoryMcpTaskStore();
+        o.ServerInfo = new Implementation { Name = "DatasetAnalyzer", Version = "1.0.0" };
+    })
+    .WithStdioServerTransport()
+    .WithTools<DatasetAnalysisTools>();
+
+    await builder.Build().RunAsync();
+}
+
+#pragma warning disable CA1812 // Discovered by MCP SDK via [McpServerToolType] attribute
+[McpServerToolType]
+internal sealed class DatasetAnalysisTools
+#pragma warning restore CA1812
+{
+    [McpServerTool(Name = "AnalyzeDataset", TaskSupport = ToolTaskSupport.Required)]
+    [Description("Analyze a tabular dataset and return summary statistics. This tool simulates a long-running analytic job (~15 seconds).")]
+    public static async Task<string> AnalyzeDatasetAsync(
+        [Description("The dataset identifier, e.g. 'sales-2025-q1'.")] string datasetName,
+        CancellationToken cancellationToken)
+    {
+        await Task.Delay(TimeSpan.FromSeconds(15), cancellationToken).ConfigureAwait(false);
+
+        return $"Findings for '{datasetName}': 12,403 rows; avg revenue $48,712; 3 anomalies detected in week 7; outliers concentrated in EMEA region.";
+    }
+}
@@ -0,0 +1,60 @@
+# Agent with MCP long-running task (transparent polling)
+
+This sample demonstrates Microsoft Agent Framework's MCP long-running task support: an agent invokes an MCP tool whose execution takes too long for a single request/response cycle, and the framework polls it to completion behind the function-calling loop. From the agent's perspective the tool simply returns its result.
+
+## What this sample shows
+
+- Using `McpClient.ListAgentToolsWithTaskSupportAsync(...)` (in `Microsoft.Agents.AI.Mcp`) to wrap MCP tools with task-aware behavior.
+- Configuring `McpTaskOptions.DefaultTimeToLive` to bound the server-side task.
+- Hosting a small MCP server (in this same executable, launched with `--server`) that advertises `execution.taskSupport=required` on a tool that sleeps for ~15 seconds.
+- No application-level polling, continuation tokens, or `AllowBackgroundResponses` flag are required.
+
+The decorator drives the lifecycle internally:
+
+1. `tools/call` augmented with task metadata (`CallToolAsTaskAsync`)
+2. `tasks/get` polled until terminal (`PollTaskUntilCompleteAsync`)
+3. `tasks/result` retrieved (`GetTaskResultAsync`) and returned to the function-calling loop
+
+The sample exercises both invocation styles against the same wrapper:
+
+- `agent.RunAsync(...)` blocks until the tool completes (~15 seconds in this sample) and returns the final response.
+- `agent.RunStreamingAsync(...)` returns immediately and yields `AgentResponseUpdate` chunks as the model emits them; in this scenario the model only begins streaming its answer once the wrapped tool's task reaches the `Completed` state, so the perceived "pause" before tokens arrive reflects tool execution time, not stream-channel latency.
+
+# Prerequisites
+
+- .NET 10 SDK or later
+- Azure OpenAI service endpoint and a chat-completions deployment
+- Azure CLI installed and authenticated (`az login`)
+
+Set the following environment variables:
+
+```powershell
+$env:AZURE_OPENAI_ENDPOINT="https://your-resource.openai.azure.com/"
+$env:AZURE_OPENAI_DEPLOYMENT_NAME="gpt-5.4-mini"  # optional; defaults to gpt-5.4-mini
+```
+
+# Running
+
+```powershell
+cd Agent_MCP_LongRunningTask_Client
+dotnet run
+```
+
+You should see output similar to:
+
+```
+=== Transparent long-running MCP task (RunAsync) ===
+Asking the agent to analyze a dataset; the tool takes ~15s to complete.
+RunAsync blocks while the wrapper polls the task to completion.
+
+Agent response (after 15.4s):
+The 'sales-2025-q1' dataset contains 12,403 rows ...
+
+=== Transparent long-running MCP task (RunStreamingAsync) ===
+Same request via the streaming API. Updates only begin to arrive after the
+tool's task reaches the Completed state, since the model needs the tool result
+before it can produce its final answer.
+
+The 'sales-2025-q1' dataset contains 12,403 rows ...
+(Streaming completed after 15.7s.)
+```
@@ -22,6 +22,7 @@ Before you begin, ensure you have the following prerequisites:
 |[Agent with MCP server tools](./Agent_MCP_Server/)|This sample demonstrates how to use MCP server tools with a simple agent|
 |[Agent with MCP server tools and authorization](./Agent_MCP_Server_Auth/)|This sample demonstrates how to use MCP Server tools from a protected MCP server with a simple agent|
 |[Responses Agent with Hosted MCP tool](./ResponseAgent_Hosted_MCP/)|This sample demonstrates how to use the Hosted MCP tool with the Responses Service, where the service invokes any MCP tools directly|
+|[Agent with long-running MCP task (transparent polling)](./Agent_MCP_LongRunningTask_Client/)|This sample demonstrates how an agent transparently drives a long-running MCP task (SEP-2663) to completion. The wrapper polls the task internally on both `RunAsync` and `RunStreamingAsync` invocations.|

 ## Running the samples from the console

@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFrameworks>net10.0</TargetFrameworks>
+
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <NoWarn>$(NoWarn);MAAIW001;OPENAI001</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.AI.Projects" />
+    <PackageReference Include="Azure.Identity" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Workflows\Microsoft.Agents.AI.Workflows.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI\Microsoft.Agents.AI.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,193 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+// This sample ports the Python Magentic orchestration sample to .NET.
+// A Magentic workflow coordinates a researcher and a coder, streams orchestration
+// events as the plan evolves, and prints the final conversation transcript.
+
+using Azure.AI.Projects;
+using Azure.Identity;
+using Microsoft.Agents.AI;
+using Microsoft.Agents.AI.Workflows;
+using Microsoft.Agents.AI.Workflows.Specialized.Magentic;
+using Microsoft.Extensions.AI;
+
+namespace WorkflowMagenticOrchestrationSample;
+
+/// <summary>
+/// Demonstrates Magentic orchestration with a researcher, a coder, and an LLM manager.
+/// </summary>
+/// <remarks>
+/// Pre-requisites:
+/// - An Azure AI Foundry project endpoint and model deployment must be configured.
+/// - Run <c>az login</c> before executing the sample.
+/// </remarks>
+public static class Program
+{
+    private const string TaskPrompt =
+        "I am preparing a report on the energy efficiency of different machine learning model architectures. " +
+        "Compare the estimated training and inference energy consumption of ResNet-50, BERT-base, and GPT-2 " +
+        "on standard datasets (e.g., ImageNet for ResNet, GLUE for BERT, WebText for GPT-2). " +
+        "Then, estimate the CO2 emissions associated with each, assuming training on an Azure Standard_NC6s_v3 " +
+        "VM for 24 hours. Provide tables for clarity, and recommend the most energy-efficient model " +
+        "per task type (image classification, text classification, and text generation).";
+
+    private static async Task Main()
+    {
+        string endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT")
+            ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
+        string deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4-mini";
+
+        // WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
+        // In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
+        // latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
+        AIProjectClient projectClient = new(new Uri(endpoint), new DefaultAzureCredential());
+
+        AIAgent researcherAgent = projectClient.AsAIAgent(
+            deploymentName,
+            name: "ResearcherAgent",
+            description: "Specialist in research and information gathering.",
+            instructions: "You are a researcher. Find relevant information without doing additional computation or quantitative analysis.");
+
+        AIAgent coderAgent = projectClient.AsAIAgent(
+            deploymentName,
+            name: "CoderAgent",
+            description: "A helpful assistant that writes and executes code to analyze data.",
+            instructions: "You solve quantitative questions by writing and running code. Show the analysis and the computation process clearly.",
+            tools: [new HostedCodeInterpreterTool()]);
+
+        AIAgent managerAgent = projectClient.AsAIAgent(
+            deploymentName,
+            name: "MagenticManager",
+            description: "Orchestrator that coordinates the research and coding workflow.",
+            instructions: "You coordinate the team to complete complex tasks efficiently.");
+
+        Workflow workflow = new MagenticWorkflowBuilder(managerAgent)
+            .AddParticipants([researcherAgent, coderAgent])
+            .WithName("Magentic Orchestration Workflow")
+            .WithDescription("Coordinates a researcher and coder to solve a complex analytical task.")
+            .RequirePlanSignoff(false)
+            .WithMaxRounds(10)
+            .WithMaxStalls(3)
+            .WithMaxResets(2)
+            .Build();
+
+        Console.WriteLine("Building Magentic workflow...");
+        Console.WriteLine();
+        Console.WriteLine($"Task: {TaskPrompt}");
+        Console.WriteLine();
+        Console.WriteLine("Starting workflow execution...");
+
+        await using StreamingRun run = await InProcessExecution.RunStreamingAsync(
+            workflow,
+            new List<ChatMessage> { new(ChatRole.User, TaskPrompt) });
+
+        await run.TrySendMessageAsync(new TurnToken(emitEvents: true));
+
+        string? lastResponseId = null;
+        WorkflowOutputEvent? finalOutput = null;
+
+        await foreach (WorkflowEvent workflowEvent in run.WatchStreamAsync())
+        {
+            switch (workflowEvent)
+            {
+                case AgentResponseUpdateEvent updateEvent:
+                    WriteStreamingUpdate(updateEvent, ref lastResponseId);
+                    break;
+
+                case MagenticPlanCreatedEvent planCreated:
+                    WriteMagenticMessage("Initial Plan", planCreated.FullTaskLedger.Text);
+                    PauseIfInteractive();
+                    break;
+
+                case MagenticReplannedEvent replanned:
+                    WriteMagenticMessage("Replanned", replanned.FullTaskLedger.Text);
+                    PauseIfInteractive();
+                    break;
+
+                case MagenticProgressLedgerUpdatedEvent progressUpdated:
+                    WriteMagenticMessage("Progress Ledger", FormatProgressLedger(progressUpdated.ProgressLedger));
+                    PauseIfInteractive();
+                    break;
+
+                case WorkflowOutputEvent outputEvent when outputEvent.Is<List<ChatMessage>>():
+                    finalOutput = outputEvent;
+                    break;
+
+                case WorkflowErrorEvent workflowError:
+                    Console.ForegroundColor = ConsoleColor.Red;
+                    Console.Error.WriteLine(workflowError.Exception?.ToString() ?? "Unknown workflow error occurred.");
+                    Console.ResetColor();
+                    break;
+
+                case ExecutorFailedEvent executorFailed:
+                    Console.ForegroundColor = ConsoleColor.Red;
+                    Console.Error.WriteLine($"Executor '{executorFailed.ExecutorId}' failed with {(executorFailed.Data is null ? "unknown error" : $"exception {executorFailed.Data}")}.");
+                    Console.ResetColor();
+                    break;
+            }
+        }
+
+        if (finalOutput?.As<List<ChatMessage>>() is { } transcript)
+        {
+            Console.WriteLine();
+            Console.WriteLine(new string('=', 80));
+            Console.WriteLine();
+            Console.WriteLine("Final Conversation Transcript:");
+            Console.WriteLine();
+
+            foreach (ChatMessage message in transcript)
+            {
+                Console.WriteLine($"{message.AuthorName ?? message.Role.ToString()}: {message.Text}");
+                Console.WriteLine();
+            }
+        }
+    }
+
+    private static void WriteStreamingUpdate(AgentResponseUpdateEvent updateEvent, ref string? lastResponseId)
+    {
+        string responseId = updateEvent.Update.ResponseId ?? updateEvent.Update.MessageId ?? updateEvent.ExecutorId;
+        if (!string.Equals(responseId, lastResponseId, StringComparison.Ordinal))
+        {
+            if (lastResponseId is not null)
+            {
+                Console.WriteLine();
+                Console.WriteLine();
+            }
+
+            Console.Write($"- {updateEvent.ExecutorId}: ");
+            lastResponseId = responseId;
+        }
+
+        if (!string.IsNullOrEmpty(updateEvent.Update.Text))
+        {
+            Console.Write(updateEvent.Update.Text);
+        }
+    }
+
+    private static void WriteMagenticMessage(string title, string? content)
+    {
+        Console.WriteLine();
+        Console.WriteLine($"[Magentic {title}]");
+        Console.WriteLine(content);
+    }
+
+    private static string FormatProgressLedger(MagenticProgressLedger ledger) =>
+        string.Join(Environment.NewLine,
+            $"Request satisfied: {ledger.IsRequestSatisfied}",
+            $"In loop: {ledger.IsInLoop}",
+            $"Making progress: {ledger.IsProgressBeingMade}",
+            $"Next speaker: {ledger.NextSpeaker}",
+            $"Instruction: {ledger.InstructionOrQuestion}");
+
+    private static void PauseIfInteractive()
+    {
+        if (Console.IsInputRedirected || Console.IsOutputRedirected)
+        {
+            return;
+        }
+
+        Console.Write("Press Enter to continue...");
+        Console.ReadLine();
+        Console.WriteLine();
+    }
+}
@@ -0,0 +1,40 @@
+# Magentic Orchestration Sample
+
+This sample showcases the Magentic Orchestration Pattern in .NET, setting up a team with three roles:
+
+- **ResearcherAgent** gathers factual background information.
+- **CoderAgent** uses `HostedCodeInterpreterTool` for quantitative analysis.
+- **MagenticManager** plans the work, tracks progress, and decides who should act next.
+
+## What This Sample Demonstrates
+
+- Building a Magentic workflow with `MagenticWorkflowBuilder`
+- Combining standard responses-based agents with a code interpreter-enabled participant
+- Streaming orchestration events such as the initial plan, replans, and progress-ledger updates
+- Printing the final multi-agent conversation transcript
+
+## Prerequisites
+
+- `AZURE_AI_PROJECT_ENDPOINT` set to your Azure AI Foundry project endpoint
+- `AZURE_AI_MODEL_DEPLOYMENT_NAME` set to your model deployment name (defaults to `gpt-5.4-mini`)
+- `az login` completed before running the sample
+
+## Running the Sample
+
+```bash
+dotnet run
+```
+
+## Expected Output
+
+The sample prints:
+
+1. The original task prompt
+2. Streamed updates from the participating agents
+3. Magentic plan and progress-ledger events as the workflow coordinates the team
+4. The final conversation transcript returned by the workflow
+
+## Related Samples
+
+- [Handoff Orchestration](../Handoff) - another multi-agent orchestration pattern in .NET workflows
+- [Python Magentic workflow sample](../../../../../python/samples/03-workflows/orchestrations/magentic.py) - the source scenario that this sample ports
@@ -62,3 +62,4 @@ Once completed, please proceed to the other samples listed below.
 | Sample | Concepts |
 |--------|----------|
 | [Handoff Orchestration](./Orchestration/Handoff) | Introduces the Handoff Orchestration pattern |
+| [Magentic Orchestration](./Orchestration/Magentic) | Coordinates multiple agents with a Magentic manager, streamed plan events, and a final transcript |
@@ -11,7 +11,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" VersionOverride="2.1.0-beta.1" />
+    <PackageReference Include="Azure.AI.Projects" />
    <PackageReference Include="Azure.Identity" />
    <PackageReference Include="Azure.Search.Documents" />
    <PackageReference Include="DotNetEnv" />
@@ -22,6 +22,7 @@
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
+    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReferences above
@@ -14,6 +14,7 @@ using Azure.Identity;
 using Azure.Search.Documents;
 using Azure.Search.Documents.Models;
 using DotNetEnv;
+using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -66,14 +67,15 @@ AIAgent agent = new AIProjectClient(new Uri(projectEndpoint), credential)
 // Host the agent as a Foundry Hosted Agent using the Responses API.
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
+builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();

@@ -46,10 +46,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFrameworks>net10.0</TargetFrameworks>
@@ -11,7 +11,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" VersionOverride="2.1.0-beta.1" />
+    <PackageReference Include="Azure.AI.Projects" />
    <PackageReference Include="Azure.Identity" />
    <PackageReference Include="DotNetEnv" />
  </ItemGroup>
@@ -28,6 +28,7 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
+    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -35,6 +35,7 @@ using Azure.AI.Projects;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
+using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -175,14 +176,15 @@ AIAgent agent = new AIProjectClient(new Uri(endpoint), credential)

 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
+builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();

@@ -39,10 +39,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -118,10 +118,10 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();

@@ -87,10 +87,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -11,7 +11,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" VersionOverride="2.1.0-beta.1" />
+    <PackageReference Include="Azure.AI.Projects" />
    <PackageReference Include="Azure.Identity" />
    <PackageReference Include="DotNetEnv" />
  </ItemGroup>
@@ -79,10 +79,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -1,7 +1,6 @@
 .env
 bin/
 obj/
-out/
 .vs/
 .vscode/
 *.user
@@ -66,9 +66,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -53,10 +53,10 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();

@@ -69,10 +69,10 @@ builder.Services.AddFoundryToolboxes(toolboxName);
 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();

@@ -55,9 +55,9 @@ builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debuggi
 var app = builder.Build();
 app.MapFoundryResponses();

-if (app.Environment.IsDevelopment())
-{
-    app.MapFoundryResponses("openai/v1");
-}
+// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
+// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
+// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
+app.MapDevTemporaryLocalAgentEndpoint();

 app.Run();
@@ -0,0 +1,41 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+using Microsoft.Agents.AI.Foundry.Hosting;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Hosting;
+
+namespace Hosted_Shared_Contributor_Setup;
+
+/// <summary>
+/// Routing helpers for contributor samples that host a Foundry-managed agent locally.
+/// </summary>
+public static class HostedContributorRouteExtensions
+{
+    /// <summary>
+    /// In Development, maps the per-agent OpenAI route shape that live Foundry uses
+    /// (<c>/api/projects/{project}/agents/{agentName}/endpoint/protocols/openai/responses</c>) on top
+    /// of the default <c>MapFoundryResponses()</c> so a local REPL client can reach the agent through
+    /// <c>AIProjectClient.AsAIAgent(Uri agentEndpoint)</c>, which is the only supported consumption path
+    /// for Foundry-hosted agents.
+    ///
+    /// <para>
+    /// The <c>{project}</c> and <c>{agentName}</c> segments are route-parameter wildcards on the server
+    /// side; the handler does not consume them, so any value sent by the client is accepted.
+    /// </para>
+    ///
+    /// <para><b>For local contributor debugging only and should not be used in production.</b></para>
+    /// </summary>
+    /// <param name="app">The <see cref="WebApplication"/> to attach the routes to.</param>
+    /// <returns>The same <see cref="WebApplication"/> for chaining.</returns>
+    public static WebApplication MapDevTemporaryLocalAgentEndpoint(this WebApplication app)
+    {
+        ArgumentNullException.ThrowIfNull(app);
+
+        if (app.Environment.IsDevelopment())
+        {
+            app.MapFoundryResponses("api/projects/{project}/agents/{agentName}/endpoint/protocols/openai");
+        }
+
+        return app;
+    }
+}
@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

 using System.ClientModel.Primitives;
-using Azure.AI.Extensions.OpenAI;
 using Azure.AI.Projects;
 using Azure.Identity;
 using DotNetEnv;
@@ -11,28 +10,34 @@ using Microsoft.Agents.AI.Foundry;
 // Load .env file if present (for local development)
 Env.TraversePath().Load();

-Uri agentEndpoint = new(Environment.GetEnvironmentVariable("AGENT_ENDPOINT")
-    ?? "http://localhost:8088");
+// AZURE_AI_PROJECT_ENDPOINT is the Foundry project endpoint. Shape:
+//   https://<host>/api/projects/<project>
+Uri projectEndpoint = new(Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT")
+    ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set."));

-var agentName = Environment.GetEnvironmentVariable("AGENT_NAME")
-    ?? throw new InvalidOperationException("AGENT_NAME is not set.");
+// AZURE_AI_AGENT_NAME is the registered server-side agent name.
+string agentName = Environment.GetEnvironmentVariable("AZURE_AI_AGENT_NAME")
+    ?? throw new InvalidOperationException("AZURE_AI_AGENT_NAME is not set.");

-// ── Create an agent-framework agent backed by the remote Hosted-Files agent ──
+// Derive the per-agent OpenAI endpoint that hosted Foundry agents require.
+Uri agentEndpoint = new($"{projectEndpoint}/agents/{agentName}/endpoint/protocols/openai");
+
+// ── Create an agent-framework agent backed by the remote agent endpoint ──────

 var options = new AIProjectClientOptions();

-if (agentEndpoint.Scheme == "http")
+if (projectEndpoint.Scheme == "http")
 {
    // For local HTTP dev: tell AIProjectClient the endpoint is HTTPS (to satisfy
    // BearerTokenPolicy's TLS check), then swap the scheme back to HTTP right
    // before the request hits the wire.
-
+    projectEndpoint = new UriBuilder(projectEndpoint) { Scheme = "https" }.Uri;
    agentEndpoint = new UriBuilder(agentEndpoint) { Scheme = "https" }.Uri;
    options.AddPolicy(new HttpSchemeRewritePolicy(), PipelinePosition.BeforeTransport);
 }

-var aiProjectClient = new AIProjectClient(agentEndpoint, new AzureCliCredential(), options);
-FoundryAgent agent = aiProjectClient.AsAIAgent(new AgentReference(agentName));
+var aiProjectClient = new AIProjectClient(projectEndpoint, new AzureCliCredential(), options);
+FoundryAgent agent = aiProjectClient.AsAIAgent(agentEndpoint);

 AgentSession session = await agent.CreateSessionAsync();

@@ -41,10 +46,10 @@ AgentSession session = await agent.CreateSessionAsync();
 Console.ForegroundColor = ConsoleColor.Cyan;
 Console.WriteLine($"""
    ══════════════════════════════════════════════════════════
-    Session Files Client                                    
+    Session Files Client
    Connected to: {agentEndpoint}
    Try: "Give me the total revenue in the contoso file."
-    Type a message or 'quit' to exit                        
+    Type a message or 'quit' to exit
    ══════════════════════════════════════════════════════════
    """);
 Console.ResetColor();
@@ -13,18 +13,18 @@ The agent's container-side `ListFiles` and `ReadFile` tools surface the bundled
 ## Configuration

 ```env
-AGENT_ENDPOINT=http://localhost:8088
-AGENT_NAME=hosted-files
+AZURE_AI_PROJECT_ENDPOINT=https://<host>/api/projects/<project>
+AZURE_AI_AGENT_NAME=hosted-files
 ```

-`AGENT_ENDPOINT` defaults to `http://localhost:8088`. Override with the deployed agent endpoint when chatting against Foundry.
+Both are required. `AZURE_AI_PROJECT_ENDPOINT` is the Foundry project endpoint URL and `AZURE_AI_AGENT_NAME` is the registered server-side agent name. The sample builds the per-agent OpenAI endpoint URL from these.

 ## Run

 ```bash
 cd dotnet/samples/04-hosting/FoundryHostedAgents/responses/Using-Samples/SessionFilesClient
-$env:AGENT_ENDPOINT = "http://localhost:8088"
-$env:AGENT_NAME = "hosted-files"
+$env:AZURE_AI_PROJECT_ENDPOINT = "http://localhost:8088/api/projects/local"
+$env:AZURE_AI_AGENT_NAME = "hosted-files"
 dotnet run
 ```

@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

 using System.ClientModel.Primitives;
-using Azure.AI.Extensions.OpenAI;
 using Azure.AI.Projects;
 using Azure.Identity;
 using DotNetEnv;
@@ -11,28 +10,34 @@ using Microsoft.Agents.AI.Foundry;
 // Load .env file if present (for local development)
 Env.TraversePath().Load();

-Uri agentEndpoint = new(Environment.GetEnvironmentVariable("AGENT_ENDPOINT")
-    ?? "http://localhost:8088");
+// AZURE_AI_PROJECT_ENDPOINT is the Foundry project endpoint. Shape:
+//   https://<host>/api/projects/<project>
+Uri projectEndpoint = new(Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT")
+    ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set."));

-var agentName = Environment.GetEnvironmentVariable("AGENT_NAME")
-    ?? throw new InvalidOperationException("AGENT_NAME is not set.");
+// AZURE_AI_AGENT_NAME is the registered server-side agent name.
+string agentName = Environment.GetEnvironmentVariable("AZURE_AI_AGENT_NAME")
+    ?? throw new InvalidOperationException("AZURE_AI_AGENT_NAME is not set.");
+
+// Derive the per-agent OpenAI endpoint that hosted Foundry agents require.
+Uri agentEndpoint = new($"{projectEndpoint}/agents/{agentName}/endpoint/protocols/openai");

 // ── Create an agent-framework agent backed by the remote agent endpoint ──────

 var options = new AIProjectClientOptions();

-if (agentEndpoint.Scheme == "http")
+if (projectEndpoint.Scheme == "http")
 {
    // For local HTTP dev: tell AIProjectClient the endpoint is HTTPS (to satisfy
    // BearerTokenPolicy's TLS check), then swap the scheme back to HTTP right
    // before the request hits the wire.
-
+    projectEndpoint = new UriBuilder(projectEndpoint) { Scheme = "https" }.Uri;
    agentEndpoint = new UriBuilder(agentEndpoint) { Scheme = "https" }.Uri;
    options.AddPolicy(new HttpSchemeRewritePolicy(), PipelinePosition.BeforeTransport);
 }

-var aiProjectClient = new AIProjectClient(agentEndpoint, new AzureCliCredential(), options);
-FoundryAgent agent = aiProjectClient.AsAIAgent(new AgentReference(agentName));
+var aiProjectClient = new AIProjectClient(projectEndpoint, new AzureCliCredential(), options);
+FoundryAgent agent = aiProjectClient.AsAIAgent(agentEndpoint);

 AgentSession session = await agent.CreateSessionAsync();

@@ -41,9 +46,9 @@ AgentSession session = await agent.CreateSessionAsync();
 Console.ForegroundColor = ConsoleColor.Cyan;
 Console.WriteLine($"""
    ══════════════════════════════════════════════════════════
-    Simple Agent Sample                                     
+    Simple Agent Sample
    Connected to: {agentEndpoint}
-    Type a message or 'quit' to exit                        
+    Type a message or 'quit' to exit
    ══════════════════════════════════════════════════════════
    """);
 Console.ResetColor();
@@ -28,9 +28,7 @@ public sealed class A2AAgent : AIAgent
    private static readonly AIAgentMetadata s_agentMetadata = new("a2a");

    private readonly IA2AClient _a2aClient;
-    private readonly string? _id;
-    private readonly string? _name;
-    private readonly string? _description;
+    private readonly A2AAgentOptions _agentOptions;
    private readonly ILogger _logger;

    /// <summary>
@@ -38,17 +36,37 @@ public sealed class A2AAgent : AIAgent
    /// </summary>
    /// <param name="a2aClient">The A2A client to use for interacting with A2A agents.</param>
    /// <param name="id">The unique identifier for the agent.</param>
-    /// <param name="name">The the name of the agent.</param>
+    /// <param name="name">The name of the agent.</param>
    /// <param name="description">The description of the agent.</param>
    /// <param name="loggerFactory">Optional logger factory to use for logging.</param>
    public A2AAgent(IA2AClient a2aClient, string? id = null, string? name = null, string? description = null, ILoggerFactory? loggerFactory = null)
+        : this(
+              a2aClient,
+              new A2AAgentOptions
+              {
+                  Id = id,
+                  Name = name,
+                  Description = description
+              },
+              loggerFactory)
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="A2AAgent"/> class.
+    /// </summary>
+    /// <param name="a2aClient">The A2A client to use for interacting with A2A agents.</param>
+    /// <param name="options">
+    /// Configuration options that control the agent's identity, including its identifier, name, and description.
+    /// </param>
+    /// <param name="loggerFactory">Optional logger factory to use for logging.</param>
+    public A2AAgent(IA2AClient a2aClient, A2AAgentOptions options, ILoggerFactory? loggerFactory = null)
    {
        _ = Throw.IfNull(a2aClient);
+        _ = Throw.IfNull(options);

        this._a2aClient = a2aClient;
-        this._id = id;
-        this._name = name;
-        this._description = description;
+        this._agentOptions = options.Clone();
        this._logger = (loggerFactory ?? NullLoggerFactory.Instance).CreateLogger<A2AAgent>();
    }

@@ -216,13 +234,13 @@ public sealed class A2AAgent : AIAgent
    }

    /// <inheritdoc/>
-    protected override string? IdCore => this._id;
+    protected override string? IdCore => this._agentOptions.Id;

    /// <inheritdoc/>
-    public override string? Name => this._name;
+    public override string? Name => this._agentOptions.Name;

    /// <inheritdoc/>
-    public override string? Description => this._description;
+    public override string? Description => this._agentOptions.Description;

    /// <inheritdoc/>
    public override object? GetService(Type serviceType, object? serviceKey = null)
@@ -456,6 +474,7 @@ public sealed class A2AAgent : AIAgent
            ResponseId = statusUpdateEvent.TaskId,
            RawRepresentation = statusUpdateEvent,
            Role = ChatRole.Assistant,
+            MessageId = statusUpdateEvent.Status.Message?.MessageId,
            FinishReason = MapTaskStateToFinishReason(statusUpdateEvent.Status.State),
            AdditionalProperties = statusUpdateEvent.Metadata?.ToAdditionalProperties() ?? [],
            Contents = statusUpdateEvent.Status.GetUserInputRequests(),
@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+namespace Microsoft.Agents.AI.A2A;
+
+/// <summary>
+/// Represents configuration options for an <see cref="A2AAgent"/>, including its identifier, name, and description.
+/// </summary>
+/// <remarks>
+/// This class is used to encapsulate information about an A2A agent, such as its unique
+/// identifier, display name, and a descriptive summary. It provides an alternative to passing
+/// these values as individual constructor parameters.
+/// </remarks>
+public sealed class A2AAgentOptions
+{
+    /// <summary>
+    /// Gets or sets the agent id.
+    /// </summary>
+    public string? Id { get; set; }
+
+    /// <summary>
+    /// Gets or sets the agent name.
+    /// </summary>
+    public string? Name { get; set; }
+
+    /// <summary>
+    /// Gets or sets the agent description.
+    /// </summary>
+    public string? Description { get; set; }
+
+    /// <summary>
+    /// Creates a new instance of <see cref="A2AAgentOptions"/> with the same values as this instance.
+    /// </summary>
+    public A2AAgentOptions Clone()
+        => new()
+        {
+            Id = this.Id,
+            Name = this.Name,
+            Description = this.Description
+        };
+}
@@ -2,7 +2,9 @@

 using System.Net.Http;
 using Microsoft.Agents.AI;
+using Microsoft.Agents.AI.A2A;
 using Microsoft.Extensions.Logging;
+using Microsoft.Shared.Diagnostics;

 namespace A2A;

@@ -36,4 +38,39 @@ public static class A2AAgentCardExtensions

        return a2aClient.AsAIAgent(name: card.Name, description: card.Description, loggerFactory: loggerFactory);
    }
+
+    /// <summary>
+    /// Retrieves an instance of <see cref="AIAgent"/> for an existing A2A agent.
+    /// </summary>
+    /// <remarks>
+    /// This method can be used to access A2A agents that support the
+    /// <see href="https://github.com/a2aproject/A2A/blob/main/docs/topics/agent-discovery.md#2-curated-registries-catalog-based-discovery">Curated Registries (Catalog-Based Discovery)</see>
+    /// discovery mechanism. When <paramref name="agentOptions"/> is provided, any non-null values override
+    /// the corresponding values from the <see cref="AgentCard"/>.
+    /// </remarks>
+    /// <param name="card">The <see cref="AgentCard" /> to use for the agent creation.</param>
+    /// <param name="agentOptions">
+    /// Configuration options that control the agent's identity. When provided, non-null values override the
+    /// corresponding values from the agent card.
+    /// </param>
+    /// <param name="httpClient">The <see cref="HttpClient"/> to use for HTTP requests.</param>
+    /// <param name="clientOptions">
+    /// Optional <see cref="A2AClientOptions"/> controlling protocol binding preference.
+    /// When not provided, defaults to preferring HTTP+JSON first, with JSON-RPC as fallback.
+    /// </param>
+    /// <param name="loggerFactory">The logger factory for enabling logging within the agent.</param>
+    /// <returns>An <see cref="AIAgent"/> instance backed by the A2A agent.</returns>
+    public static AIAgent AsAIAgent(this AgentCard card, A2AAgentOptions agentOptions, HttpClient? httpClient = null, A2AClientOptions? clientOptions = null, ILoggerFactory? loggerFactory = null)
+    {
+        _ = Throw.IfNull(card);
+        _ = Throw.IfNull(agentOptions);
+
+        var a2aClient = A2AClientFactory.Create(card, httpClient, clientOptions);
+
+        var mergedOptions = agentOptions.Clone();
+        mergedOptions.Name ??= card.Name;
+        mergedOptions.Description ??= card.Description;
+
+        return a2aClient.AsAIAgent(mergedOptions, loggerFactory);
+    }
 }
@@ -6,6 +6,7 @@ using System.Threading.Tasks;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.A2A;
 using Microsoft.Extensions.Logging;
+using Microsoft.Shared.Diagnostics;

 namespace A2A;

@@ -48,4 +49,39 @@ public static class A2ACardResolverExtensions

        return agentCard.AsAIAgent(httpClient, options, loggerFactory);
    }
+
+    /// <summary>
+    /// Retrieves an instance of <see cref="AIAgent"/> for an existing A2A agent.
+    /// </summary>
+    /// <remarks>
+    /// This method can be used to access A2A agents that support the
+    /// <see href="https://github.com/a2aproject/A2A/blob/main/docs/topics/agent-discovery.md#1-well-known-uri">Well-Known URI</see>
+    /// discovery mechanism. When <paramref name="agentOptions"/> is provided, any non-null values override
+    /// the corresponding values from the resolved <see cref="AgentCard"/>.
+    /// </remarks>
+    /// <param name="resolver">The <see cref="A2ACardResolver" /> to use for the agent creation.</param>
+    /// <param name="agentOptions">
+    /// Configuration options that control the agent's identity. When provided, non-null values override the
+    /// corresponding values from the resolved agent card.
+    /// </param>
+    /// <param name="httpClient">
+    /// The <see cref="HttpClient"/> to use for HTTP requests made by the created A2A client.
+    /// This is not used for fetching the agent card; the resolver uses its own configured client for that.
+    /// </param>
+    /// <param name="clientOptions">
+    /// Optional <see cref="A2AClientOptions"/> controlling protocol binding preference.
+    /// When not provided, defaults to preferring HTTP+JSON first, with JSON-RPC as fallback.
+    /// </param>
+    /// <param name="loggerFactory">The logger factory for enabling logging within the agent.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>An <see cref="AIAgent"/> instance backed by the A2A agent.</returns>
+    public static async Task<AIAgent> GetAIAgentAsync(this A2ACardResolver resolver, A2AAgentOptions agentOptions, HttpClient? httpClient = null, A2AClientOptions? clientOptions = null, ILoggerFactory? loggerFactory = null, CancellationToken cancellationToken = default)
+    {
+        _ = Throw.IfNull(agentOptions);
+
+        // Obtain the agent card from the resolver.
+        var agentCard = await resolver.GetAgentCardAsync(cancellationToken).ConfigureAwait(false);
+
+        return agentCard.AsAIAgent(agentOptions, httpClient, clientOptions, loggerFactory);
+    }
 }
@@ -3,6 +3,7 @@
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.A2A;
 using Microsoft.Extensions.Logging;
+using Microsoft.Shared.Diagnostics;

 namespace A2A;

@@ -31,10 +32,32 @@ public static class A2AClientExtensions
    /// </remarks>
    /// <param name="client">The <see cref="IA2AClient" /> to use for the agent.</param>
    /// <param name="id">The unique identifier for the agent.</param>
-    /// <param name="name">The the name of the agent.</param>
+    /// <param name="name">The name of the agent.</param>
    /// <param name="description">The description of the agent.</param>
    /// <param name="loggerFactory">Optional logger factory for enabling logging within the agent.</param>
    /// <returns>An <see cref="AIAgent"/> instance backed by the A2A agent.</returns>
    public static AIAgent AsAIAgent(this IA2AClient client, string? id = null, string? name = null, string? description = null, ILoggerFactory? loggerFactory = null) =>
        new A2AAgent(client, id, name, description, loggerFactory);
+
+    /// <summary>
+    /// Retrieves an instance of <see cref="AIAgent"/> for an existing A2A agent.
+    /// </summary>
+    /// <remarks>
+    /// This method can be used to access A2A agents that support the
+    /// <see href="https://github.com/a2aproject/A2A/blob/main/docs/topics/agent-discovery.md#3-direct-configuration--private-discovery">Direct Configuration / Private Discovery</see>
+    /// discovery mechanism.
+    /// </remarks>
+    /// <param name="client">The <see cref="IA2AClient" /> to use for the agent.</param>
+    /// <param name="options">
+    /// Configuration options that control the agent's identity, including its identifier, name, and description.
+    /// </param>
+    /// <param name="loggerFactory">Optional logger factory for enabling logging within the agent.</param>
+    /// <returns>An <see cref="AIAgent"/> instance backed by the A2A agent.</returns>
+    public static AIAgent AsAIAgent(this IA2AClient client, A2AAgentOptions options, ILoggerFactory? loggerFactory = null)
+    {
+        _ = Throw.IfNull(client);
+        _ = Throw.IfNull(options);
+
+        return new A2AAgent(client, options, loggerFactory);
+    }
 }
@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

+using System;
 using System.ClientModel.Primitives;
 using System.Collections.Generic;
 using System.Reflection;
@@ -9,8 +10,11 @@ using Microsoft.Extensions.AI;
 namespace Microsoft.Agents.AI.Foundry.Hosting;

 /// <summary>
-/// Pipeline policy that appends the hosted-agent <c>User-Agent</c> segment
-/// (e.g. <c>"foundry-hosting/agent-framework-dotnet/{version}"</c>) to outgoing requests.
+/// Pipeline policy that emits the hosted-agent <c>User-Agent</c> segment
+/// (<c>"foundry-hosting/agent-framework-dotnet/{version}"</c>), matching Python's hosted
+/// contract (<c>foundry-hosting/agent-framework-python/{version}</c>, see
+/// <c>python/packages/core/agent_framework/_telemetry.py</c>: the hosted prefix is joined
+/// with the base agent-framework segment into a single combined User-Agent value).
 /// </summary>
 /// <remarks>
 /// <para>
@@ -19,6 +23,12 @@ namespace Microsoft.Agents.AI.Foundry.Hosting;
 /// is already present in the <c>User-Agent</c> header, the policy does not append it again.
 /// </para>
 /// <para>
+/// When a bare <c>agent-framework-dotnet/{version}</c> segment is already present (stamped by
+/// the framework-wide <c>AgentFrameworkUserAgentPolicy</c> registered by
+/// <c>FoundryChatClient</c>), this policy <em>replaces</em> that segment with the combined
+/// hosted form so the wire never carries both forms simultaneously, preserving Python parity.
+/// </para>
+/// <para>
 /// This policy is added at hosted-agent resolution time via the MEAI 10.5.1
 /// <see cref="OpenAIRequestPolicies"/> hook on the agent's underlying chat client. It is only
 /// registered when an agent is resolved by the Foundry hosting layer.
@@ -30,6 +40,12 @@ internal sealed class HostedAgentUserAgentPolicy : PipelinePolicy

    private static readonly string s_supplementValue = CreateSupplementValue();

+    /// <summary>Bare segment stamped by <c>AgentFrameworkUserAgentPolicy</c> in the non-hosted scenario; this policy upgrades it in-place when both run.</summary>
+    private const string BareAgentFrameworkPrefix = "agent-framework-dotnet/";
+
+    /// <summary>Combined hosted segment that this policy emits. Recognized in-place so callers whose pipelines already carry a (possibly different-version) combined segment get it replaced rather than double-prefixed (Q-D fix).</summary>
+    private const string CombinedHostedPrefix = "foundry-hosting/agent-framework-dotnet/";
+
    public override void Process(PipelineMessage message, IReadOnlyList<PipelinePolicy> pipeline, int currentIndex)
    {
        AppendHeader(message);
@@ -46,13 +62,52 @@ internal sealed class HostedAgentUserAgentPolicy : PipelinePolicy
    {
        if (message.Request.Headers.TryGetValue("User-Agent", out var existing) && !string.IsNullOrEmpty(existing))
        {
-            // Guard against double-append on retries or when the policy
-            // is registered on multiple pipeline positions.
-            if (existing.Contains(s_supplementValue))
+            // Guard against double-append on retries or when the policy is registered on
+            // multiple pipeline positions.
+            if (existing!.Contains(s_supplementValue))
            {
                return;
            }

+            // Combined-form check first: if the caller's pipeline already has
+            // `foundry-hosting/agent-framework-dotnet/{version}` (with a version that differs
+            // from ours — otherwise the .Contains above would have returned early), replace the
+            // entire combined span in place. Without this, the bare-prefix search below would
+            // match `agent-framework-dotnet/` *inside* the combined segment and produce a
+            // malformed `foundry-hosting/foundry-hosting/agent-framework-dotnet/...` value.
+            var combinedIdx = existing.IndexOf(CombinedHostedPrefix, StringComparison.Ordinal);
+            if (combinedIdx >= 0)
+            {
+                var combinedEnd = existing.IndexOf(' ', combinedIdx);
+                if (combinedEnd < 0)
+                {
+                    combinedEnd = existing.Length;
+                }
+
+                var replacedCombined = string.Concat(existing.AsSpan(0, combinedIdx), s_supplementValue.AsSpan(), existing.AsSpan(combinedEnd));
+                message.Request.Headers.Set("User-Agent", replacedCombined);
+                return;
+            }
+
+            // If the bare agent-framework segment is present (stamped by
+            // AgentFrameworkUserAgentPolicy when not hosted), upgrade it in place to the
+            // combined hosted form so the wire never carries both segments simultaneously.
+            // Mirrors Python where get_user_agent() returns a single combined string when the
+            // hosted prefix is registered.
+            var idx = existing.IndexOf(BareAgentFrameworkPrefix, StringComparison.Ordinal);
+            if (idx >= 0)
+            {
+                var end = existing.IndexOf(' ', idx);
+                if (end < 0)
+                {
+                    end = existing.Length;
+                }
+
+                var replaced = string.Concat(existing.AsSpan(0, idx), s_supplementValue.AsSpan(), existing.AsSpan(end));
+                message.Request.Headers.Set("User-Agent", replaced);
+                return;
+            }
+
            message.Request.Headers.Set("User-Agent", $"{existing} {s_supplementValue}");
        }
        else
@@ -23,7 +23,7 @@ namespace Azure.AI.Projects;
 /// Provides extension methods for <see cref="AIProjectClient"/>.
 /// </summary>
 [Experimental(DiagnosticIds.Experiments.AIOpenAIResponses)]
-public static partial class AzureAIProjectChatClientExtensions
+public static partial class AIProjectClientExtensions
 {
    /// <summary>
    /// Uses an existing server side agent, wrapped as a <see cref="ChatClientAgent"/> using the provided <see cref="AIProjectClient"/> and <see cref="AgentReference"/>.
@@ -63,7 +63,43 @@ public static partial class AzureAIProjectChatClientExtensions
            clientFactory,
            services);

-        return new FoundryAgent(aiProjectClient, innerAgent);
+        return new FoundryAgent(innerAgent);
+    }
+
+    /// <summary>
+    /// Wraps an existing server side hosted agent as a <see cref="FoundryAgent"/> using the provided
+    /// <see cref="AIProjectClient"/> and an agent-specific endpoint URI.
+    /// </summary>
+    /// <param name="aiProjectClient">The <see cref="AIProjectClient"/> to use for project-level operations. Cannot be <see langword="null"/>.</param>
+    /// <param name="agentEndpoint">
+    /// The agent-specific endpoint URI of shape
+    /// <c>https://&lt;host&gt;/.../projects/&lt;project&gt;/agents/&lt;agentName&gt;/endpoint/protocols/openai</c>.
+    /// The agent name is parsed from this URI and the active agent version is resolved server side
+    /// from the endpoint's administrator-controlled version selector. Cannot be <see langword="null"/>.
+    /// </param>
+    /// <param name="tools">The tools to use when interacting with the agent. This is required when using prompt agent definitions with tools.</param>
+    /// <param name="clientFactory">Provides a way to customize the creation of the underlying <see cref="IChatClient"/> used by the agent.</param>
+    /// <param name="services">An optional <see cref="IServiceProvider"/> to use for resolving services required by the <see cref="AIFunction"/> instances being invoked.</param>
+    /// <returns>A <see cref="FoundryAgent"/> instance that routes calls through the supplied agent endpoint.</returns>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="aiProjectClient"/> or <paramref name="agentEndpoint"/> is <see langword="null"/>.</exception>
+    /// <exception cref="ArgumentException">Thrown when <paramref name="agentEndpoint"/> does not match the expected agent-endpoint shape.</exception>
+    /// <remarks>
+    /// Agent version selection is controlled by the Foundry administrator through the endpoint's
+    /// version selector and cannot be overridden by the caller. Use the
+    /// <see cref="AsAIAgent(AIProjectClient, AgentReference, IList{AITool}?, Func{IChatClient, IChatClient}?, IServiceProvider?)"/>
+    /// overload when an explicit agent version pin is required.
+    /// </remarks>
+    public static FoundryAgent AsAIAgent(
+        this AIProjectClient aiProjectClient,
+        Uri agentEndpoint,
+        IList<AITool>? tools = null,
+        Func<IChatClient, IChatClient>? clientFactory = null,
+        IServiceProvider? services = null)
+    {
+        Throw.IfNull(aiProjectClient);
+        Throw.IfNull(agentEndpoint);
+
+        return new FoundryAgent(aiProjectClient, agentEndpoint, tools, clientFactory, services);
    }

    /// <summary>
@@ -96,7 +132,7 @@ public static partial class AzureAIProjectChatClientExtensions
            !allowDeclarativeMode,
            services);

-        return new FoundryAgent(aiProjectClient, innerAgent);
+        return new FoundryAgent(innerAgent);
    }

    /// <summary>
@@ -129,7 +165,7 @@ public static partial class AzureAIProjectChatClientExtensions
            !allowDeclarativeMode,
            services);

-        return new FoundryAgent(aiProjectClient, innerAgent);
+        return new FoundryAgent(innerAgent);
    }

    /// <summary>
@@ -210,7 +246,7 @@ public static partial class AzureAIProjectChatClientExtensions
        Func<IChatClient, IChatClient>? clientFactory,
        IServiceProvider? services)
    {
-        IChatClient chatClient = new AzureAIProjectChatClient(aiProjectClient, agentVersion, agentOptions.ChatOptions);
+        IChatClient chatClient = new FoundryChatClient(aiProjectClient, agentVersion, agentOptions.ChatOptions);

        if (clientFactory is not null)
        {
@@ -232,10 +268,7 @@ public static partial class AzureAIProjectChatClientExtensions
        Throw.IfNull(agentOptions.ChatOptions);
        Throw.IfNullOrWhitespace(agentOptions.ChatOptions.ModelId);

-        IChatClient chatClient = aiProjectClient
-            .GetProjectOpenAIClient()
-            .GetResponsesClient()
-            .AsIChatClient(agentOptions.ChatOptions.ModelId);
+        IChatClient chatClient = new FoundryChatClient(aiProjectClient, agentOptions.ChatOptions.ModelId);

        if (clientFactory is not null)
        {
@@ -262,7 +295,7 @@ public static partial class AzureAIProjectChatClientExtensions
        Func<IChatClient, IChatClient>? clientFactory,
        IServiceProvider? services)
    {
-        IChatClient chatClient = new AzureAIProjectChatClient(aiProjectClient, agentRecord, agentOptions.ChatOptions);
+        IChatClient chatClient = new FoundryChatClient(aiProjectClient, agentRecord, agentOptions.ChatOptions);

        if (clientFactory is not null)
        {
@@ -280,7 +313,7 @@ public static partial class AzureAIProjectChatClientExtensions
        Func<IChatClient, IChatClient>? clientFactory,
        IServiceProvider? services)
    {
-        IChatClient chatClient = new AzureAIProjectChatClient(aiProjectClient, agentReference, defaultModelId: null, agentOptions.ChatOptions);
+        IChatClient chatClient = new FoundryChatClient(aiProjectClient, agentReference, defaultModelId: null, agentOptions.ChatOptions);

        if (clientFactory is not null)
        {
--- a/Show More
+++ b/Show More