@aifabrix/builder 2.51.1 → 2.52.1

package/templates/channels/microsoft-copilot/entra-sso-registration.template.md.hbs

@@ -0,0 +1,27 @@
+## Microsoft Entra SSO registration (Teams Developer Portal)
+
+Direct URL:
+
+{{{entraSsoRegistrationUrl}}}
+
+Open **Tools → Microsoft Entra SSO client ID registration → Register client ID** (or New).
+
+### Values to paste into the form
+
+| Field | Value |
+| --- | --- |
+| Registration name | `{{appName}}` |
+| Base URL | {{#if entraSsoBaseUrl}}`{{{entraSsoBaseUrl}}}`{{else}}*(missing — dataplane URL not resolved)*{{/if}} |
+| Restrict usage by organization | My organization only (DEV) |
+| Restrict usage by Teams app | Any Teams app (until the Teams app id is stable) |
+| Client (application) ID | {{#if entraSsoClientId}}`{{entraSsoClientId}}`{{else}}*(missing — Entra SSO enterprise app (client) id from controller Keycloak status `entraIdentityProvider.enterpriseAppId`; complete Entra onboarding if empty)*{{/if}} |
+| Scope | {{#if entraSsoScope}}`{{entraSsoScope}}`{{else}}*(missing — set Runtime MCP delegated scopes on Trust source `microsoft-entra-id` `allowedScopes`; not openid/profile alone)*{{/if}} |
+
+### Related (for your records)
+
+{{#if mcpUrl}}- **Remote MCP URL (package):** `{{{mcpUrl}}}`{{/if}}
+{{#if entraIssuer}}- **Entra issuer (Trust source):** `{{{entraIssuer}}}`{{/if}}
+{{#if entraTenantId}}- **Tenant id:** `{{entraTenantId}}`{{/if}}
+{{#if entraEnterpriseAppId}}- **Enterprise app id (Keycloak):** `{{entraEnterpriseAppId}}`{{/if}}
+
+After Save, copy the **Microsoft Entra SSO registration ID** (auth config id). That value is `--oauth-plugin-vault-reference-id`.

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -2,9 +2,11 @@
 
 {{appDescription}}
 
-Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+Environment: **{{environment}}**
 
-This channel output is a Microsoft 365 Copilot app package:
+This channel uses **Microsoft Entra SSO** (trustedIssuer). Users already signed into
+Microsoft 365 do **not** complete a separate AI Fabrix sign-in. Admin consent may still
+apply for the Runtime MCP delegated scope.
 
 ```text
 dist/channels/microsoft-copilot/source/manifest.json
@@ -13,42 +15,59 @@ dist/channels/microsoft-copilot/source/ai-plugin.json
 dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
 ```
 
-## Microsoft admin workflow (manual)
+## Install in Microsoft Teams
 
-1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.
-2. Upload or sideload `appPackage.{{environment}}.zip` to your organization app catalog.
-3. Review the declarative agent + Remote MCP plugin metadata and approve tenant distribution.
-4. Configure workspace authentication and consent according to your Entra/OAuth policy.
-5. Store credential references in AI Fabrix authentication settings: [Authentication settings]({{credentialPortalUrl}})
-6. Assign the app to users/groups and complete first-user sign-in.
+1. Open Microsoft Teams using your target Microsoft 365 account.
+2. Select **Apps → Manage your apps**.
+3. Select **Upload an app → Upload a custom app**.
+4. Upload `appPackage.{{environment}}.zip`.
+5. Review the requested permissions and select **Add**.
+6. Open **{{appName}}** from your installed apps.
+7. If prompted, complete **Entra / admin consent** for the Runtime MCP resource (not an AI Fabrix OAuth client login).
+
+Upload only the ZIP package. Do not upload individual manifest files or `channel-microsoft-copilot.json`.
+
+If **Upload a custom app** is unavailable, a Teams administrator must enable custom app uploads for your account in the Teams admin center or deploy the package centrally.
+
+Do **not** configure AI Fabrix OAuth client secrets in Connected Systems → Authentication for this flow. Entra SSO uses the Teams OAuthPluginVault auth-config id.
 
 ## Runtime connection contract
 
 - **Runtime system key:** `{{runtimeSystemKey}}`
-- **Remote MCP URL:** `{{mcpUrl}}`
+- **Remote MCP URL:** `{{{mcpUrl}}}`
 - **Transport:** `{{runtimeTransport}}`
-- **Auth mode:** `{{runtimeAuthMode}}`
-- **Layer B tools expected:**
+- **Auth mode:** `{{runtimeAuthMode}}` (Entra SSO / trustedIssuer; controller exchanges the Microsoft user token)
+- **Plugin auth:** `OAuthPluginVault` · Teams auth-config reference id `{{oauthPluginVaultReferenceId}}`
+{{#if entraIssuer}}- **Entra issuer (from Trust source):** `{{{entraIssuer}}}`{{/if}}
+- **Delegated scopes:** {{#each scopes}}`{{this}}` {{else}}*(missing — package not install-ready)*{{/each}}
+- **Install ready:** {{#if installReady}}yes{{else}}no{{#if discoveryBlocker}} ({{discoveryBlocker}}){{/if}}{{/if}}
+- **Governed tools expected:**
 {{#each layerBToolNames}}
   - `{{this}}`
 {{/each}}
 
+{{> entraSsoRegistration}}
+
+## Package links
+
+- README / install guide: `INSTALL.md`
+- Package ZIP: `build/appPackage.{{environment}}.zip`
 ## Assistant catalog
 
-Runtime lists **assistants** available to each user from:
+Runtime lists the assistants available to the signed-in user from:
 
-{{assistantCatalogUrl}}
+{{{assistantCatalogUrl}}}
 
 ## Probe truthfulness
 
-- `builderValidated` means package files, ZIP, hashes, and secret checks passed.
-- `runtimeValidated` means Runtime MCP is reachable and tool boundary checks pass.
-- `requiresMicrosoftAdmin` remains true until tenant upload/approval/assignment is complete.
+- `builderValidated` means package files, ZIP structure, hashes, and secret checks passed.
+- `runtimeValidated` means Runtime MCP is reachable and its tool boundary checks passed.
+- `requiresMicrosoftAdmin` means Microsoft-side installation or approval remains incomplete. A user may install the package directly when their Teams custom-app policy permits it; otherwise, Teams administrator action is required.
 
-## Validate after admin setup
+## Validate after Teams installation
 
 ```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --oauth-plugin-vault-reference-id "{{oauthPluginVaultReferenceId}}" --probe
 ```
 
-`--force` regenerates artifacts but does not rotate credentials.
+`--force` regenerates the package artifacts. microsoft-copilot does not create Fabrix oauth2 channel credentials for Entra SSO.

package/templates/channels/microsoft-copilot/integration/README.md

@@ -5,9 +5,8 @@ Generated by `aifabrix channel scaffold microsoft-copilot`.
 Recommended flow:
 
 ```bash
-aifabrix upload microsoft-copilot --force
 aifabrix channel add microsoft-copilot --name "Your Assistant" --probe
 ```
 
-`channel add` generates package artifacts under
-`dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.
+`channel add` scaffolds (if needed), uploads when missing (always with `--force`), then
+generates package artifacts under `dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -6,28 +6,7 @@
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
-    "authType": "credential",
-    "credential": {
-      "credentialKey": "microsoft-copilot-channel",
-      "displayName": "Microsoft Copilot package channel",
-      "method": "oauth2",
-      "writeOnce": true,
-      "variables": {
-        "baseUrl": "https://login.microsoftonline.com",
-        "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        "grantType": "authorization_code",
-        "scope": "openid profile offline_access"
-      },
-      "security": {
-        "clientId": "kv://microsoft-copilot/clientId",
-        "clientSecret": "kv://microsoft-copilot/clientSecret"
-      },
-      "formFields": [
-        { "name": "clientId", "required": true },
-        { "name": "clientSecret", "required": true }
-      ]
-    }
+    "authType": "system"
   },
   "configuration": [],
   "dataSources": [],

package/templates/channels/microsoft-copilot/manifest.template.json.hbs

@@ -4,18 +4,18 @@
   "version": "{{packageVersion}}",
   "id": "{{packageAppId}}",
   "name": {
-    "short": "{{baseName}}",
-    "full": "{{appName}}"
+    "short": "{{shortName}}",
+    "full": "{{fullName}}"
   },
   "description": {
-    "short": "{{appDescription}}",
-    "full": "{{appDescription}}"
+    "short": "{{shortDescription}}",
+    "full": "{{fullDescription}}"
   },
   "developer": {
     "name": "AI Fabrix",
-    "websiteUrl": "{{dataplaneBaseUrl}}",
-    "privacyUrl": "{{dataplaneBaseUrl}}/privacy",
-    "termsOfUseUrl": "{{dataplaneBaseUrl}}/terms"
+    "websiteUrl": "{{{dataplaneBaseUrl}}}",
+    "privacyUrl": "{{{dataplaneBaseUrl}}}/privacy",
+    "termsOfUseUrl": "{{{dataplaneBaseUrl}}}/terms"
   },
   "icons": {
     "color": "color.png",

package/templates/channels/microsoft-copilot/oauth-plugin-vault-required.template.md.hbs

@@ -0,0 +1,11 @@
+microsoft-copilot packaging requires `--oauth-plugin-vault-reference-id` with the Teams Entra SSO auth-config id.
+
+Register Entra SSO in the Teams Developer Portal **before** packaging (no ZIP needed first), paste the values below, Save, then re-run with the registration id.
+
+{{> entraSsoRegistration}}
+
+Then:
+
+```bash
+aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<Teams-Entra-SSO-registration-id>"
+```

package/templates/channels/slack/install.template.md.hbs

@@ -17,7 +17,7 @@ One Slack app delivers **Role Assistant** chat, **Work hub** shortcuts, and **do
 5. Confirm **App Home → Messages tab** is **ON** in the manifest (required for bot DMs and proactive notifications; slash commands work without it).
 6. Click **Create**, then open **Install App** → **Install to Workspace** and approve.
 7. Copy **Bot User OAuth Token** and **Signing Secret** from the Slack app settings.
-8. Save **Bot User OAuth Token** and **Signing Secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+8. Save **Bot User OAuth Token** and **Signing Secret** in AI Fabrix: [Authentication settings]({{{credentialPortalUrl}}})
 
 ## Platform callback URLs
 
@@ -32,6 +32,11 @@ Configure these in your Slack app if you edit settings manually. Do not embed se
 {{#if commandUrl}}
 - **Slash commands:** {{commandUrl}}
 {{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth Redirect URL:** {{oauthCallbackUrl}}
+{{/if}}
+
+Paste the **OAuth Redirect URL** into Slack app settings → **OAuth & Permissions** → **Redirect URLs** (required for Add to Slack / OAuth).
 
 Register these **V1** slash commands in the manifest (all use the same request URL):
 

package/templates/channels/slack/integration/README.md

@@ -30,9 +30,7 @@ Registered at `/api/v1/external/systems/slack/`:
 ## Workflow
 
 ```bash
-aifabrix channel scaffold slack   # or use this folder as SSOT
-aifabrix upload slack --force
-aifabrix channel add slack --name "Your Assistant"
+aifabrix channel add slack --name "Your Assistant" --probe
 ```
 
-Publish template changes: `make sync-json` in dataplane → `aifabrix-builder/templates/channels/slack/integration/`.
+Optional low-level: `channel scaffold` / `upload`. Publish template changes: `make sync-json` in dataplane → `aifabrix-builder/templates/channels/slack/integration/`.

package/templates/channels/teams-bot/install.template.md.hbs

@@ -44,6 +44,10 @@ Users message the bot with:
 
 Review cards use **Approve**, **Reject**, and **Edit metadata** actions on the **Bot messages** endpoint. Proactive review notifications use the **Notifications** URL.
 
+## Authentication
+
+Teams bot authentication uses a **Microsoft token**. AI Fabrix controller performs token exchange — generated package and INSTALL files carry public connection specs only (no secrets).
+
 ## Assistant catalog
 
 Runtime lists **assistants** available to each user from:

package/templates/channels/teams-bot/integration/README.md

@@ -8,11 +8,9 @@ SSOT for Teams Bot Framework communication channel — **Role Assistants** and *
 - **Document approval:** `documents`, `document`, `approve`, `help` bot commands; review Adaptive Cards; proactive `/notifications`
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate teams-bot
-aifabrix upload teams-bot --probe
-aifabrix deploy teams-bot
-aifabrix channel add teams-bot --name "Your Assistant"
+aifabrix channel add teams-bot --name "Your Assistant" --probe
 ```
 
+Optional low-level (dataplane fixture tree): `validate` / `upload` / `deploy` before add.
+
 Authentication: oidc — prefilled discovery settings; operators add Microsoft App ID + client secret on Connected Systems → Authentication.

package/templates/channels/web-embed/integration/web-embed-system.json

@@ -6,22 +6,7 @@
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
-    "authType": "credential",
-    "credential": {
-      "credentialKey": "web-embed-channel",
-      "displayName": "Web embed assistant channel",
-      "method": "apikey",
-      "writeOnce": true,
-      "variables": {
-        "baseUrl": "https://embed.aifabrix.dev"
-      },
-      "security": {
-        "apiKey": "kv://web-embed/apiKey"
-      },
-      "formFields": [
-        { "name": "apiKey", "required": true }
-      ]
-    }
+    "authType": "system"
   },
   "configuration": [],
   "dataSources": [],

package/templates/python/docker-compose.hbs

@@ -53,6 +53,10 @@ services:
     {{/if}}
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    # Bind-mount replaces /app and hides image ENTRYPOINT scripts (e.g. docker-entrypoint.sh).
+    entrypoint: []
+    {{/if}}
     {{#if reloadStartCommand}}
     command: ["sh", "-c", "cd /app && {{{reloadStartCommand}}}"]
     {{/if}}
@@ -111,6 +115,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
     networks:
       - {{networkName}}
@@ -136,6 +143,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
     networks:
       - {{networkName}}

package/templates/typescript/docker-compose.hbs

@@ -53,6 +53,10 @@ services:
     {{/if}}
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    # Bind-mount replaces /app and hides image ENTRYPOINT scripts (e.g. docker-entrypoint.sh).
+    entrypoint: []
+    {{/if}}
     {{#if reloadStartCommand}}
     command: ["sh", "-c", "cd /app && {{reloadStartCommand}}"]
     {{/if}}
@@ -111,6 +115,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
     networks:
       - {{networkName}}
@@ -134,6 +141,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
     networks:
       - {{networkName}}