Merge branch 'main' into feat/respect-function-choice-filters

Author: moonbox3

.devcontainer/devcontainer.json

@@ -2,10 +2,23 @@
 	"image": "mcr.microsoft.com/devcontainers/universal:2",
 	"features": {
 		"ghcr.io/devcontainers/features/node:1": {},
-		"ghcr.io/devcontainers/features/dotnet:1": {
-			"version": "8"
+		"ghcr.io/jlaundry/devcontainer-features/azure-functions-core-tools:1": {},
+		"ghcr.io/devcontainers/features/github-cli:1": {
+			"version": "2"
 		},
-		"ghcr.io/jlaundry/devcontainer-features/azure-functions-core-tools:1": {}
+		"ghcr.io/devcontainers/features/powershell:1": {
+			"version": "latest"
+		},
+		"ghcr.io/azure/azure-dev/azd:0": {
+			"version": "latest"
+		},
+		"ghcr.io/devcontainers/features/common-utils:2": {},
+		"ghcr.io/devcontainers/features/dotnet:2": {
+			"version": "none",
+			"dotnetRuntimeVersions": "10.0",
+			"aspNetCoreRuntimeVersions": "10.0"
+		},
+		"ghcr.io/devcontainers/features/copilot-cli:1": {}
 	},
 	"customizations": {
 		"vscode": {

.github/upgrades/prompts/SemanticKernelToAgentFramework.md

@@ -384,6 +384,73 @@ AIAgent agent = chatClient.CreateAIAgent(
 7. Pass tools directly to agent creation method
 </configuration_changes>
 
+### Runtime Tool Registration Transformation
+
+<configuration_changes>
+In Semantic Kernel, plugins/tools could be added to the kernel after it was already built using `kernel.Plugins.Add()`. Agent Framework provides a similar capability using the builder middleware API.
+
+**Replace this Semantic Kernel post-creation tool registration pattern:**
+```csharp
+// Define the tool function
+[Description("Get the weather for a location")]
+static string GetWeather(string location) => $"Weather in {location}";
+
+// Semantic Kernel - Tools added after kernel is already built
+Kernel kernel = kernelBuilder.Build();
+ChatCompletionAgent agent = new() { Kernel = kernel };
+
+// Later: Add tools to the existing kernel instance
+KernelFunction function = KernelFunctionFactory.CreateFromMethod(GetWeather);
+KernelPlugin plugin = KernelPluginFactory.CreateFromFunctions("WeatherPlugin", [function]);
+kernel.Plugins.Add(plugin);
+
+// Tools are now available on subsequent invocations
+await foreach (var item in agent.InvokeAsync(userInput, thread)) { ... }
+```
+
+**With this Agent Framework pattern using builder middleware:**
+```csharp
+// Define the tool function
+[Description("Get the weather for a location")]
+static string GetWeather(string location) => $"Weather in {location}";
+
+// Start with an existing agent
+AIAgent existingAgent = chatClient.CreateAIAgent(
+    instructions: "You are a helpful assistant");
+
+// Create an augmented agent with additional tools using builder middleware
+var augmentedAgent = existingAgent.AsBuilder()
+    .Use(async (chatMessages, agentThread, agentRunOptions, next, cancellationToken) =>
+    {
+        if (agentRunOptions is ChatClientAgentRunOptions chatClientAgentRunOptions)
+        {
+            chatClientAgentRunOptions.ChatOptions ??= new ChatOptions();
+            chatClientAgentRunOptions.ChatOptions.Tools ??= [];
+            chatClientAgentRunOptions.ChatOptions.Tools.Add(AIFunctionFactory.Create(GetWeather));
+        }
+
+        return await next(chatMessages, agentThread, agentRunOptions, cancellationToken);
+    })
+    .Build();
+
+// Use the augmented agent with the additional tools
+AgentRunResponse result = await augmentedAgent.RunAsync(userInput, thread);
+```
+
+**Required changes:**
+1. Call `AsBuilder()` on the existing agent to get a builder
+2. Use the `Use()` middleware method to intercept and modify run options
+3. Add tools to `ChatClientAgentRunOptions.ChatOptions.Tools` in the middleware
+4. Call `Build()` to create the augmented agent instance
+5. Use the new augmented agent for invocations that need the additional tools
+
+**Note:** This pattern is the preferred approach as it provides:
+- A controlled environment with a dedicated agent instance
+- No disruption to existing agent usages
+- Dynamic tool composition per user, tenant, or feature flags
+- Modular system composition without recreating agents
+</configuration_changes>
+
 ### Invocation Method Transformation
 
 <api_changes>
@@ -803,20 +870,16 @@ var agentOptions = new ChatClientAgentRunOptions(new ChatOptions
 {
     MaxOutputTokens = 8000,
     // Breaking glass to access provider-specific options
-    RawRepresentationFactory = (_) => new OpenAI.Responses.ResponseCreationOptions()
+    RawRepresentationFactory = (_) => new OpenAI.Responses.CreateResponseOptions()
     {
-        ReasoningOptions = new()
-        {
-            ReasoningEffortLevel = OpenAI.Responses.ResponseReasoningEffortLevel.High,
-            ReasoningSummaryVerbosity = OpenAI.Responses.ResponseReasoningSummaryVerbosity.Detailed
-        }
+        TruncationMode = OpenAI.Responses.ResponseTruncationMode.Auto,
     }
 });
 ```
 
 **Use this pattern when:**
 1. Standard `ChatOptions` properties don't cover required model settings
-2. Provider-specific configuration is needed (e.g., reasoning effort level)
+2. Provider-specific configuration is needed (e.g., truncation mode)
 3. Advanced SDK features need to be accessed
 </configuration_changes>
 

.github/workflows/devflow-pr-review.yml

@@ -0,0 +1,139 @@
+name: DevFlow PR Review
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number to review
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: devflow-pr-review-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  DEVFLOW_REPOSITORY: ${{ vars.DF_REPO }}
+  DEVFLOW_REF: main
+  TARGET_REPO_PATH: ${{ github.workspace }}/target-repo
+  DEVFLOW_PATH: ${{ github.workspace }}/devflow
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    if: ${{ github.event_name != 'pull_request_target' || !github.event.pull_request.draft }}
+
+    steps:
+      - name: Resolve PR metadata
+        id: pr
+        shell: bash
+        env:
+          PR_HTML_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER_EVENT: ${{ github.event.pull_request.number }}
+          PR_NUMBER_INPUT: ${{ inputs.pr_number }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_EVENT_NAME}" == "pull_request_target" ]]; then
+            pr_number="${PR_NUMBER_EVENT}"
+            pr_url="${PR_HTML_URL}"
+          else
+            pr_number="${PR_NUMBER_INPUT}"
+            pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/${pr_number}"
+          fi
+
+          if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Could not determine PR number; for workflow_dispatch runs, the 'pr_number' input is required when not running on pull_request_target." >&2
+            exit 1
+          fi
+
+          echo "pr_url=${pr_url}" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${pr_number}" >> "$GITHUB_OUTPUT"
+          echo "repo=${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT"
+
+      # Safe checkout: base repo only, not the untrusted PR head.
+      - name: Checkout target repo base
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+          path: target-repo
+
+      # Private DevFlow checkout: the PAT/token grants access to this repo's code.
+      - name: Checkout DevFlow
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ env.DEVFLOW_REPOSITORY }}
+          ref: ${{ env.DEVFLOW_REF }}
+          token: ${{ secrets.DEVFLOW_TOKEN }}
+          fetch-depth: 1
+          persist-credentials: false
+          path: devflow
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: "0.5.x"
+          enable-cache: true
+
+      - name: Install DevFlow dependencies
+        working-directory: ${{ env.DEVFLOW_PATH }}
+        run: uv sync --frozen
+
+      - name: Classify PR relevance
+        id: spam
+        working-directory: ${{ env.DEVFLOW_PATH }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }}
+          SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
+          AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
+          PR_REPO: ${{ steps.pr.outputs.repo }}
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+        run: |
+          uv run python scripts/classify_pr_spam.py \
+            --repo "$PR_REPO" \
+            --pr-number "$PR_NUMBER" \
+            --repo-path "${TARGET_REPO_PATH}" \
+            --apply-labels
+
+      - name: Stop after spam gate
+        if: ${{ steps.spam.outputs.decision != 'allow' }}
+        shell: bash
+        env:
+          SPAM_DECISION: ${{ steps.spam.outputs.decision }}
+        run: |
+          echo "Skipping review because spam gate decided: ${SPAM_DECISION}"
+
+      - name: Run PR review
+        if: ${{ steps.spam.outputs.decision == 'allow' }}
+        id: review
+        working-directory: ${{ env.DEVFLOW_PATH }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_COPILOT_TOKEN: ${{ secrets.GH_COPILOT_TOKEN }}
+          SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
+          AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
+          PR_URL: ${{ steps.pr.outputs.pr_url }}
+        run: |
+          uv run python scripts/trigger_pr_review.py \
+            --pr-url "$PR_URL" \
+            --github-username "$GITHUB_ACTOR" \
+            --no-require-comment-selection

.github/workflows/dotnet-build-and-test.yml

@@ -57,14 +57,14 @@ jobs:
       matrix:
         include:
           - {
-              dotnet: "8.0",
+              dotnet: "10.0",
               os: "ubuntu-latest",
               configuration: Release,
               integration-tests: true,
               environment: "integration",
             }
-          - { dotnet: "8.0", os: "windows-latest", configuration: Debug }
-          - { dotnet: "8.0", os: "windows-latest", configuration: Release }
+          - { dotnet: "10.0", os: "windows-latest", configuration: Debug }
+          - { dotnet: "9.0", os: "windows-latest", configuration: Release }
 
     runs-on: ${{ matrix.os }}
     environment: ${{ matrix.environment }}
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v4.3.1
+        uses: actions/setup-dotnet@v5
         with:
           global-json-file: ${{ github.workspace }}/dotnet/global.json
 
@@ -138,7 +138,7 @@ jobs:
         run: |
           export INTEGRATION_TEST_PROJECTS=$(find ./dotnet -type f -name "*IntegrationTests.csproj" | grep -v "Experimental.Orchestration.Flow.IntegrationTests.csproj" | grep -v "VectorDataIntegrationTests.csproj" | tr '\n' ' ')
           for project in $INTEGRATION_TEST_PROJECTS; do
-            dotnet test -f net8.0 -c ${{ matrix.configuration }} $project --no-build -v Normal --logger trx
+            dotnet test -f net10.0 -c ${{ matrix.configuration }} $project --no-build -v Normal --logger trx
           done
         env:
           # Azure OpenAI Deployments

.github/workflows/dotnet-ci.yml

@@ -19,8 +19,8 @@ jobs:
         fail-fast: false
         matrix:
           include:
-          - { os: ubuntu-latest, dotnet: '8.0', configuration: Debug }
-          - { os: ubuntu-latest, dotnet: '8.0', configuration: Release }
+          - { os: ubuntu-latest, dotnet: '10.0', configuration: Debug }
+          - { os: ubuntu-latest, dotnet: '10.0', configuration: Release }
 
     runs-on: ${{ matrix.os }}
     steps:
@@ -67,7 +67,7 @@ jobs:
         matrix:
           os: [windows-latest]
           configuration: [Release, Debug]
-          dotnet-version: ['8.0.x']
+          dotnet-version: ['10.0.x']
     runs-on: ${{ matrix.os }}
     env:
       NUGET_CERT_REVOCATION_MODE: offline
@@ -78,7 +78,7 @@ jobs:
         persist-credentials: false
 
     - name: Setup .NET SDK ${{ matrix.dotnet-version }}
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v5
       with:
         dotnet-version: ${{ matrix.dotnet-version }}
       env:

.github/workflows/dotnet-format.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { dotnet: "9.0", configuration: Release, os: ubuntu-latest }
+          - { dotnet: "10.0", configuration: Release, os: ubuntu-latest }
 
     runs-on: ${{ matrix.os }}
     env:

.github/workflows/dotnet-integration-tests.yml

@@ -29,10 +29,10 @@ jobs:
           persist-credentials: false
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         if: ${{ github.event_name != 'pull_request' }}
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 10.0.x
 
       - name: Find projects
         shell: bash