release: v0.22.1 - #1068
Merged
Merged
Conversation
* feat: add custom installer image refs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: reject shorthand custom image refs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
chore(release): prepare v0.16.0 Consume the five pending changeset fragments, bump VERSION and package mirrors to 0.16.0, and generate the CHANGELOG.md entry. Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
PR #683 added --postgres-access-mode public, but the Postgres egress NetworkPolicies kept allowlisting the private delegated-subnet CIDR (10.225.0.0/28) in both modes. In public mode the Flexible Server answers on an Azure-managed public IP, so those policies blocked every pod-to-Postgres connection (Npgsql timeouts) even with Azure-side firewall/public network access configured correctly -- found live in a v0.16.0 deployment. Private mode is unchanged. Public mode now drops the ipBlock NetworkPolicies and emits allow-api-postgres-egress-fqdn / allow-worker-postgres-egress-fqdn CiliumNetworkPolicies that allow 5432/TCP to <PG_SERVER_NAME>.postgres.database.azure.com via toFQDNs, following the existing agentweaver-app-egress-fqdn-allowlist pattern (including the kube-dns visibility rule Cilium's FQDN proxy needs). FQDN egress avoids the reconciliation burden of a static IP allowlist when Azure rotates the IP. Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
) * fix(azure): parse list-skus array shape in Postgres SKU pre-flight 'az postgres flexible-server list-skus' returns a JSON array of capability sets, but parseSkuAvailability() read supportedServerEditions off the array itself. That always resolved to an empty list, so the fail-fast pre-flight rejected every region with 'Azure reported no supported server editions', blocking all Postgres provisioning regardless of real availability. Normalize the array shape (region is provisionable when any capability entry allows the SKU) and update the test helper to emit the real array shape so the existing pre-flight tests exercise it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(changeset): add patch changeset for Postgres SKU pre-flight fix Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
…tra sign-in detection (#690) fix(auth): server/info 401s and omits auth_mode, breaking Entra sign-in detection The web app calls GET /api/server/info before sign-in (App.tsx AuthGate -> apiClient.getServerInfo) to decide whether to render the Entra or GitHub sign-in button, defaulting to 'github-legacy' when the field is missing or the call fails. Two bugs made that fallback unconditional: 1. The endpoint's .AllowAnonymous() is authorization metadata, but the raw custom middlewares (GitHubTokenAuthMiddleware, GitHubOrgAuthorizationMiddleware, PlatformRoleAuthorizationMiddleware) keep their own hardcoded anonymous-path allowlists and never consult endpoint metadata, so every unauthenticated call got a 401. 2. The response body only returned data_directory / workspace_auto_assigned, never auth_mode / auth_mode_label / auth_mode_recommended, which the frontend ServerInfo type expects. Fix: exempt /api/server/info in all three middlewares (and mark it public in the OpenAPI security transformer), and return the auth mode resolved through the existing AuthModeResolver, with wire values matching the frontend union ('entra' | 'github-legacy') and labels matching AUTH_MODE_LABELS. Found live in a v0.16.0 production deployment where AUTH_MODE=Entra was configured correctly server-side but the UI still showed "Sign in with GitHub". Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
…role/session errors in UI (#697) * fix(auth): add missing GET /api/auth/session endpoint, surface Entra role/session errors in UI The web app's AuthGate has called apiClient.getAuthSession() -> GET /api/auth/session since the Entra dual-mode overhaul (#640), but that route was never implemented on the API. Every Entra sign-in silently 404'd on this call, fell back to the GitHub-legacy identity check, saw no linked GitHub account, and rendered 'not signed in' -- even after Entra auth and platform-role assignment both succeeded. This is why sign-in kept failing after the redirect-URI and App Role fixes. - Add GET /api/auth/session, returning the AuthSessionResponse shape the frontend already expects (authenticated, auth_mode, display_name, email, login, entra_object_id, platform_roles). Exempt it from PlatformRoleAuthorizationMiddleware so a signed-in user with zero platform roles can still see their own identity instead of a 403 dead end. - Carry DisplayName/Email/RawPlatformRoles through CallerContext and the Entra claims parser so the new endpoint (and the 403 diagnostics below) have real values instead of nulls. - PlatformRoleAuthorizationMiddleware's 403 body now includes entra_object_id, entra_tenant_id, entra_client_id, roles_found_on_token, and recognized_platform_roles -- so a role-assignment problem is diagnosable in one response instead of requiring log digging. - AuthGate (App.tsx) no longer swallows session-check failures silently: a 401 still means 'not signed in' quietly, but any other failure (403 role denial, 5xx, network error) is now surfaced on the sign-in screen via a MessageBar, including the diagnostic detail above. - Removed the leftover 'no longer uses a shared fallback GitHub token' contrast-with-old- behavior language across SignInPage, App.tsx, ProjectGalleryPage, ProjectSettingsPage, SettingsPage, and docs/guide/architecture-aks.md; replaced with plain statements of current behavior. * fix(auth): repair linked-GitHub-account route/verb mismatches and dead link flow Audited every client<->server call for the Entra multi-account GitHub linking feature (all introduced by PR #640, which shipped with zero reviews) and fixed: - listLinkedGitHubAccounts/setDefaultLinkedGitHubAccount/unlinkLinkedGitHubAccount/ listAccessibleGitHubRepos in client.ts pointed at routes that never existed server-side (/auth/github/linked-accounts*, /github/repos/accessible); repointed to the real /auth/github-accounts* routes in AuthEndpoints.cs, and fixed setDefaultLinkedGitHubAccount's verb (was POST, server only maps PUT). - 'Add account'/'Link another GitHub account' called /auth/github/authorize with an intent=link query param the server never reads -- that endpoint always runs a plain sign-in exchange, never LinkedGitHubAccountService.BeginLinkAuthorizationAsync(). Added apiClient.beginLinkGitHubAccount() calling the correct, pre-existing POST /auth/github-accounts/link endpoint, and rewired both call sites (GitHubSignIn.tsx, SettingsPage.tsx) to use it and surface errors instead of silently no-oping or mis-linking. - Backend AccessibleGitHubRepositoryResponse used snake_case for fields the frontend GitHubRepo type expects in camelCase (fullName/defaultBranch/etc.), and was missing source_avatar_url/source_is_default that AccessibleGitHubRepo declares. Fixed casing and added the missing source-account fields end to end (service record -> DTO -> endpoint mapping). - LinkedGitHubAccountResponse was missing name/type fields the frontend type requires; populated with Type='user' (identity links are always personal GitHub accounts, never orgs) and Name=null (not fetched at link time). * chore: add changeset for linked-GitHub-account route fixes * fix(auth): redirect completed GitHub account links to Settings, not app root Rubber-duck review of the prior commit found that CompleteLinkAsync's success/error redirects always went to the frontend root (/), even though SettingsPage.tsx tells the user the flow 'returns here'. Linked-account management only lives on the Settings page, so redirect there regardless of which UI surface (sidebar switcher or Settings itself) started the link. --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
…701) * fix(api): add missing Postgres migration for dismissed_notifications The AddDismissedNotifications migration (20260722184157) was only ever added to the SQLite dev-migrations project (Agentweaver.Api/Migrations). The Postgres provider resolves migrations from a separate assembly (MigrationsAssembly("Agentweaver.Api.Migrations.Postgres"), see Program.cs), so the dismissed_notifications table was never created on the live Postgres database even though efbundle reported everything as up to date. This caused /api/notifications to 500 with 42P01: relation "dismissed_notifications" does not exist. The Postgres model snapshot already contained the DismissedNotification entity mapping (someone updated the snapshot but never added the migration class), so the target model was already correct - only the migration itself was missing. Applied the equivalent CREATE TABLE DDL directly to the live database and recorded the corresponding __EFMigrationsHistory row so this migration file reconciles cleanly with the already-fixed prod schema on next deploy (no-op on redeploy, matches history). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500 * fix(api): restore correct migration ID + add second missing Postgres migration Per rubber-duck review of the previous commit: reverts the invented migration ID (20260731000000) and instead restores the exact historical Postgres migration file from origin/release/v0.11.0 (20260722184157_AddDismissedNotifications), which already existed there but was never merged forward into dev. Using the same ID avoids a duplicate-CREATE-TABLE failure on any environment that took the release/v0.11.0 path and already has that ID in __EFMigrationsHistory. The live production database's __EFMigrationsHistory row has been corrected to the matching ID (UPDATE, not a new INSERT). Also discovered and fixed a second instance of the same class of bug while investigating the still-reproducing "Link another GitHub account" 500 (42P01: relation "github_account_link_states" does not exist): the AddLinkedGitHubAccountStateAndProjectOverrides migration (20260729212946, part of the auth account-linking feature) was also only added to the SQLite dev-migrations project, never to Agentweaver.Api.Migrations.Postgres. Added the missing Postgres migration (github_account_link_states + project_github_identity_overrides tables) and applied the equivalent DDL directly to the live database, recording the matching __EFMigrationsHistory row so this reconciles cleanly on next deploy. Verified via a full entity-set diff between the SQLite and Postgres ModelSnapshot files that no further Postgres migrations are missing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500 * fix(web): sidebar GitHub popover UX, Entra ID indicator, and link-toast - GitHubSignIn: wrap trigger in a Tooltip so the sidebar's account switcher is discoverable ('not obvious this is where you link GitHub'); add a small 'Entra ID' badge + popover banner when authMode is entra so there's a persistent visible indicator of the current sign-in mode; truncate long account name/login text in the popover account lists. - LeftNav/shell.css: pass collapsed state into GitHubSignIn and add a dedicated collapsed-rail footer rule (stack + center) so the trigger + status/version no longer squish/overlap ('wonky') at 64px width. - SettingsPage: dispatch a success toast when landing on ?auth=github_linked&login=... (the GitHub account-linking redirect from AuthEndpoints.cs) and strip the query params afterwards so a refresh doesn't re-fire the toast. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500 * fix: address rubber-duck review findings on PR #701 - Restore 20260722184157_AddDismissedNotifications.cs byte-for-byte (LF line endings) from origin/release/v0.11.0 via git checkout -- the previous restore had been re-saved with CRLF line endings by a local tool, which would show as a spurious diff/whitespace change against the historical release-branch file. - GitHubSignIn: keep the trigger's aria-label as the stable 'GitHub account switcher' and make the Tooltip a description instead of a label override, so it doesn't replace the accessible name that GitHubSignIn.test.tsx asserts on. - SettingsPage: wrap the ?auth=github_linked toast dispatch with a ref guard so React StrictMode's dev-only double effect invocation can't fire the toast twice. - SettingsPage.test.tsx: wrap render() calls in MemoryRouter, now required because the page calls useSearchParams(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500 * docs: add changeset for Postgres migration fixes + GitHub sign-in UX polish Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500 --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500
chore(release): prepare v0.16.1 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500
…w linking additional accounts (#704) * fix(auth): use active linked GitHub account token and force account picker when linking * fix(auth): write rotated/mismatched tokens to their own linked identity scope --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 86b9f816-c155-4f74-932e-fac70ce88ddd
…rovision-infra (#705) fix(deploy): wire AUTH_MODE/ENTRA_CLIENT_ID/ENTRA_TENANT_ID through provision-infra's params-file and CLI flags Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500
chore(release): v0.16.2 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500
Lets an already-published release be redeployed by importing its existing GHCR images (published by publish-images.yml) instead of rebuilding them from source. The GHCR ref is always the release tag; owner/repository is derived from the GitHub origin remote. Documents the option in README, RELEASING.md, and the operations guide. Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d315c8d-0893-4aca-830e-058ce2095500
* fix(ui-harness): reject auth loading captures Closes #714 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ui-harness): require declared readiness targets Keep explicit semantic readiness targets mandatory, persist failed commands through finish, and run the UI harness regressions in the required Node toolchain CI job. Closes #714 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Co-authored-by: Morpheus <morpheus@agentweaver.local>
…allowlists (#692) * docs(auth): add architecture plan for retiring hardcoded auth-middleware allowlists Design proposal only, no behaviour change. Frames the recurring 'exempt X from auth middleware' bug class (culminating in the /api/server/info bug in #690), evaluates Istio mesh-level auth and oauth2-proxy (both declined, with reasons), and lays out a flag-gated 3-PR migration to real ASP.NET Core AuthenticationHandler schemes and authorization policies. Refs #690, #691 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(auth): address rubber-duck review findings in the auth architecture plan Four blocking findings: (1) enumerate every current exemption incl. the implicit non-/api rule that keeps the health probes anonymous, so a default-deny fallback policy cannot crash-loop the pods; (2) stamp an explicit agentweaver_auth_scheme claim instead of inferring the scheme from Identity.AuthenticationType; (3) keep the raw GitHub token out of ClaimsPrincipal; (4) split the endpoint decision matrix into a total metadata-classification test plus representative per-shape route fixtures, since asserting 2xx for every endpoint is not implementable. Five non-blocking: substitute controls for the dropped shadow mode (startup-time exclusive registration, auth-outcome telemetry in PR 1, canary enablement); pin signing key and algorithm plus an explicit iss/aud comparison for MCP tokens; migrate the two direct HttpContext.Items readers in PR 1 with a grep guard gating PR 3; correct the claim that MCP OAuth works in Entra mode and preserve parity; rewrite the NoResult semantics for a single-selection policy scheme. Adds risks R12-R14 and a review log in Appendix A.8. Still docs-only. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
* fix(demo): require Edge Default for Entra recording Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(demo): harden recording auth refresh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(demo): route signin through close-first refresh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com> Co-authored-by: Morpheus <morpheus@agentweaver.local>
Closes #717 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Keep the platform caller bearer separate from the linked GitHub token across API, AgentHost, and MCP, and validate Entra issuer, audience, tenant, signature, and lifetime before forwarding. Closes #715 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Closes #569 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
docs(sandbox): finalize rootless BuildKit design (#582) Replace the initial design sketch with an implementation-ready, disabled-by-default broker architecture covering isolation, RBAC, registry auth, quotas, cleanup, observability, and validation gates. Closes #582 Requested-by: Cypher Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Closes #688 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Closes #581 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
* fix(a2a): structure terminal failures across remoted roles Closes #522 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(a2a): harden terminal diagnostic redaction Use the shared sandbox redactor for durable terminal diagnostics and cover Basic auth, query credentials, connection strings, and SAS signatures. Closes #522 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
* fix(auth): recover preview credential tombstones Recover soft-deleted deterministic Key Vault keys before rotating preview-runner credentials, with bounded polling and concurrent recovery handling. Closes #533 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: retrigger issue 533 CI Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Closes #592 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Bound credential refresh and pod recreation to one reason-specific attempt, preserve linked-account scope, and redispatch a reaped non-terminal pod once with structured diagnostics. Closes #536 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Closes #477 Co-authored-by: Cypher <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* fix: clarify GitHub connection errors and background wording Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * chore: add auth UX release note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* fix: recover worker dispatches after disruption Fixes #806 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * fix: release dispatch leases before shutdown Fixes #806 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
…1057) Each beat writes a single-use .cjs script containing seeded session data to .auth/generated/<plan>/. These were never deleted, causing unbounded accumulation across recording runs (374 stale files, ~10MB observed). Delete each script immediately after it runs. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Closes #648 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Fixes #1005 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* feat: add account GitHub connections settings Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * test: align GitHub settings coverage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * test: preserve background readiness coverage Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * chore: add connections page release note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * fix: preserve account settings after rebase Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* fix: separate background settings requirements Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * chore: add background panel release note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* feat: show read-only project GitHub status Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * chore: add auth UX release note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * fix: limit connection prompts to typed GitHub errors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * chore: add status badge release note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
…ld break) (#1058) fix(web): restore getAuthConfig client method and formActions style dropped in merge PR #1046 (auth-ux-stack layer 3) squash-merged with a rebase artifact that removed the getAuthConfig() method from AgentweaverApiClient and the formActions CSS class from SettingsPage, both added earlier by PR #1041 (entra-id-link). This broke dev's TypeScript build (tsc -b failed with 4 errors), blocking every other PR's CI. This restores the missing method/style exactly as originally added by #1041; no design change. Co-authored-by: sabbour <sabbour@users.noreply.github.com>
…1059) * refactor: introduce generic BYOK model source Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * refactor: remove legacy Foundry runner Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * feat: propagate deployment-wide BYOK provider config to AgentHost and sandbox executor Layer 9 of the inference-BYOK stack. When a deployment-wide BYOK provider configuration exists, it now overrides GitHub Copilot for every execution path, not just the one-shot GitHubCopilotAgentRunner: - CopilotAIAgent (used by AgentHost for project/scheduled/webhook runs) builds its SDK session from the BYOK provider config and skips the Copilot capability-snapshot requirement. - KubernetesSandboxExecutor no longer requires a submitting user or a live Copilot capability-snapshot credential when BYOK is configured, and delivers the BYOK config to AgentHost's /configure call. - Fixed a guard in GitHubCopilotAgentRunner that incorrectly keyed the submitting-user requirement off the caller-supplied ModelSource instead of whether a BYOK provider is actually configured, which would have wrongly rejected internal one-shot callers even with BYOK active. Also pins docs' mermaid dependency to the newest version available on the internal npm proxy (env/tooling only, no product change). --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
…1060) feat(web): add Platform settings page with AI mode switch and BYOK form - Add Platform Settings page: deployment-wide AI mode switch between GitHub Copilot mode and Custom key (BYOK) mode, plus a full BYOK configuration form (provider type, base URL, model, API key). - Wire to existing /api/admin/byok-provider GET/PUT/DELETE endpoints. - Mode is derived purely from whether a BYOK config is saved (matches backend semantics; no separate mode flag). - Disable mode switch and form controls while a save/switch request is in flight, and re-derive mode from the actual server response after each mutation, to avoid the UI diverging from persisted state. - API key must always be re-entered on save (backend never returns the stored key and has no partial-update support); UI copy reflects this. Deliberately out of scope (needs new backend OAuth-binding work, not built yet): the first-run app lockout screen and a 'connect the platform-default Copilot account' flow. Tracked as a follow-up. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
Pure mechanical rename of the internal 'TwoApp' nickname (classes, files, namespaces, docs) to 'GitHubConnections' across the backend. No behavior change: wire-format strings, DB table/column names (via explicit ToTable/HasColumnName), and check-constraint SQL text are byte-identical before and after. Intentionally left untouched: the 4 EF Core migration files for 'AddTwoAppPersistence' (both SQLite and Postgres providers, plus their Designer.cs files) — these are frozen, already-applied migration history and must not be renamed. Also fixes a stale 'Two-App cutover validation' VitePress nav label that would have otherwise disagreed with the renamed doc page title. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
…ut (#1063) Adds the deferred Part A of plan item 10: - New PlatformDefaultCopilotBindingService (parallel to, does not modify, the existing project-scoped ProjectCopilotBindingService): lets a PlatformAdmin explicitly connect one deployment-wide GitHub Copilot account via a real OAuth flow to the existing Copilot App, isolated callback route/cookie/state from the per-project flow. - New singleton PlatformDefaultCopilotBindingRecord + dual (SQLite + Postgres) EF migrations. - New PlatformAdmin-gated endpoints: begin/callback/status/disconnect. - /api/auth/session now reports ai_configured (BYOK config OR a usable platform-default Copilot binding). - App.tsx: signed-in users are blocked behind a full-page setup screen until AI is configured platform-wide. A PlatformAdmin sees the Platform Settings page (to fix it); everyone else sees a plain 'contact your administrator' message. Also adds a related fix: a signed-in user with zero platform roles now sees a clear 'access denied' message instead of a broken, permission-less app shell. - PlatformSettingsPage.tsx: adds a connect/status/disconnect UI for the platform-default Copilot account, alongside the existing BYOK form. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
…cs (#1065) PR #1063 added new platform-default Copilot docs using the generic phrase 'GitHub OAuth app', which trips the fleet-oauth-surfaces legacy-terminology guard test (Node toolchain tests were skipped on that PR due to path-based CI gating, so this wasn't caught until the release promotion PR ran the full suite). Reworded to 'Copilot App' with no meaning change. Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
* fix: harden Copilot binding cleanup and config recovery Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 * docs: add release note for Copilot binding hardening Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16 --------- Co-authored-by: sabbour <sabbour@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
chore(release): prepare v0.22.0 Co-authored-by: sabbour <sabbour@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 20ea1af6-c1fb-441c-8c7d-086f7900fc16
sabbour
enabled auto-merge (squash)
August 31, 2026 21:45
Contributor
📝 Docs sync reminderThis PR changes code in doc-relevant paths but does not touch Changed source filesHow to update fast
This is a non-blocking reminder — it will not prevent merge. See |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes release/v0.22.1 to main.
Patch release containing the GitHub Copilot binding hardening fixes from #1066 (revocation endpoint fix, malformed config recovery, migration safety) that merged to dev after v0.22.0's release branch was already cut.