@microsoft/teamsfx-core 3.1.0 → 3.1.2-alpha.31d08fb48a.0

package/build/component/driver/teamsApp/createAppPackage.js

@@ -13,6 +13,7 @@ const path = tslib_1.__importStar(require("path"));
 const semver_1 = tslib_1.__importDefault(require("semver"));
 const typedi_1 = require("typedi");
 const uuid = tslib_1.__importStar(require("uuid"));
+const featureFlags_1 = require("../../../common/featureFlags");
 const globalVars_1 = require("../../../common/globalVars");
 const localizeUtils_1 = require("../../../common/localizeUtils");
 const common_1 = require("../../../error/common");
@@ -89,13 +90,9 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         }
         for (const file of relativeFiles) {
             const filePath = path.resolve(appDirectory, file);
-            if (!(await fs_extra_1.default.pathExists(filePath))) {
-                const error = new common_1.FileNotFoundError(exports.actionName, filePath, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage");
-                return (0, teamsfx_api_1.err)(error);
-            }
-            const fileRelativePath = path.relative(appDirectory, filePath);
-            if (fileRelativePath.startsWith("..")) {
-                return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(filePath));
+            const validationResult = await this.validateReferencedFile(filePath, appDirectory, file);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
             }
         }
         // pre-check existence
@@ -126,19 +123,22 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (additionalLanguages && additionalLanguages.length > 0) {
             for (const language of additionalLanguages) {
                 const file = language.file;
-                const fileName = path.join(appDirectory, file);
-                if (!(await fs_extra_1.default.pathExists(fileName))) {
-                    return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, fileName, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                const fileName = path.resolve(appDirectory, file);
+                const validationResult = await this.validateReferencedFile(fileName, appDirectory, file);
+                if (validationResult.isErr()) {
+                    return (0, teamsfx_api_1.err)(validationResult.error);
                 }
             }
         }
         if (defaultLanguageFile) {
-            const fileName = path.join(appDirectory, defaultLanguageFile);
-            if (!(await fs_extra_1.default.pathExists(fileName))) {
-                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, fileName, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            const fileName = path.resolve(appDirectory, defaultLanguageFile);
+            const validationResult = await this.validateReferencedFile(fileName, appDirectory, defaultLanguageFile);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
             }
         }
         const zip = new adm_zip_1.default();
+        const resolvedJsonFiles = new Map();
         zip.addFile(constants_1.Constants.MANIFEST_FILE, Buffer.from(JSON.stringify(manifest, null, 4)));
         // icon images, relative path
         for (const icon of relativeFiles) {
@@ -150,11 +150,10 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             for (const language of additionalLanguages) {
                 const file = language.file;
                 const fileName = path.resolve(appDirectory, file);
-                const relativePath = path.relative(appDirectory, fileName);
-                if (relativePath.startsWith("..")) {
-                    return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileName));
-                }
-                const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName);
+                const realFileName = await fs_extra_1.default.realpath(fileName);
+                const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
+                const relativePath = path.relative(realAppDirectory, realFileName);
+                const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName, context);
                 if (resolvedLocFileRes.isErr()) {
                     return (0, teamsfx_api_1.err)(resolvedLocFileRes.error);
                 }
@@ -165,11 +164,10 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         }
         if (defaultLanguageFile) {
             const fileName = path.resolve(appDirectory, defaultLanguageFile);
-            const relativePath = path.relative(appDirectory, fileName);
-            if (relativePath.startsWith("..")) {
-                return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileName));
-            }
-            const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName);
+            const realFileName = await fs_extra_1.default.realpath(fileName);
+            const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
+            const relativePath = path.relative(realAppDirectory, realFileName);
+            const resolvedLocFileRes = await ManifestUtils_1.manifestUtils.resolveLocFile(fileName, context);
             if (resolvedLocFileRes.isErr()) {
                 return (0, teamsfx_api_1.err)(resolvedLocFileRes.error);
             }
@@ -180,7 +178,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         // API ME, API specification and Adaptive card templates
         if (composeExtensionType == "apiBased" && apiSpecificationFile) {
             const apiSpecificationFilePath = path.resolve(appDirectory, apiSpecificationFile);
-            const checkExistenceRes = await this.validateReferencedFile(apiSpecificationFilePath, appDirectory);
+            const checkExistenceRes = await this.validateReferencedFile(apiSpecificationFilePath, appDirectory, apiSpecificationFile);
             if (checkExistenceRes.isErr()) {
                 return (0, teamsfx_api_1.err)(checkExistenceRes.error);
             }
@@ -192,7 +190,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 for (const command of commands) {
                     if (command.apiResponseRenderingTemplateFile) {
                         const adaptiveCardFile = path.resolve(appDirectory, command.apiResponseRenderingTemplateFile);
-                        const checkExistenceRes = await this.validateReferencedFile(adaptiveCardFile, appDirectory);
+                        const checkExistenceRes = await this.validateReferencedFile(adaptiveCardFile, appDirectory, command.apiResponseRenderingTemplateFile);
                         if (checkExistenceRes.isErr()) {
                             return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                         }
@@ -205,34 +203,41 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         // Copilot GPT
         if (declarativeAgents?.length && declarativeAgents[0].file) {
             const declarativeAgentManifestFile = path.resolve(hasTTKGeneratedFolder ? generatedFolder : appDirectory, declarativeAgents[0].file);
-            const checkExistenceRes = await this.validateReferencedFile(declarativeAgentManifestFile, appDirectory);
+            const checkExistenceRes = await this.validateReferencedFile(declarativeAgentManifestFile, appDirectory, declarativeAgents[0].file);
             if (checkExistenceRes.isErr()) {
                 return (0, teamsfx_api_1.err)(checkExistenceRes.error);
             }
             const addFileWithVariableRes = await this.addFileWithVariable(zip, declarativeAgents[0].file, declarativeAgentManifestFile, envFunctionUtils_1.ManifestType.DeclarativeCopilotManifest, context, shouldwriteAllManifest
                 ? path.join(jsonFileDir, path.relative(appDirectory, declarativeAgentManifestFile))
-                : undefined);
+                : undefined, resolvedJsonFiles);
             if (addFileWithVariableRes.isErr()) {
                 return (0, teamsfx_api_1.err)(addFileWithVariableRes.error);
             }
             const getCopilotGptRes = await CopilotGptManifestUtils_1.copilotGptManifestUtils.getManifest(declarativeAgentManifestFile, context);
             if (getCopilotGptRes.isOk()) {
+                const manifest = getCopilotGptRes.value;
+                if (manifest.actions !== undefined && !Array.isArray(manifest.actions)) {
+                    return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, [`actions (in ${path.basename(declarativeAgentManifestFile)}) must be an array`], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                }
+                if (manifest.capabilities !== undefined && !Array.isArray(manifest.capabilities)) {
+                    return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, [`capabilities (in ${path.basename(declarativeAgentManifestFile)}) must be an array`], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                }
                 // Add action files
-                if (getCopilotGptRes.value.actions) {
-                    const pluginFiles = getCopilotGptRes.value.actions.map((action) => action.file);
+                if (Array.isArray(manifest.actions)) {
+                    const pluginFiles = manifest.actions.map((action) => action.file);
                     for (const pluginFile of pluginFiles) {
                         const pluginFileAbsolutePath = path.resolve(path.dirname(declarativeAgentManifestFile), pluginFile);
                         const pluginFileRelativePath = path.relative(hasTTKGeneratedFolder ? generatedFolder : appDirectory, pluginFileAbsolutePath);
                         const useForwardSlash = declarativeAgents[0].file.concat(pluginFile).includes("/");
-                        const addPluginRes = await this.addPlugin(zip, (0, utils_2.normalizePath)(pluginFileRelativePath, useForwardSlash), hasTTKGeneratedFolder ? generatedFolder : appDirectory, context, !shouldwriteAllManifest ? undefined : jsonFileDir, hasTTKGeneratedFolder ? appDirectory : undefined);
+                        const addPluginRes = await this.addPlugin(zip, (0, utils_2.normalizePath)(pluginFileRelativePath, useForwardSlash), hasTTKGeneratedFolder ? generatedFolder : appDirectory, context, !shouldwriteAllManifest ? undefined : jsonFileDir, hasTTKGeneratedFolder ? appDirectory : undefined, resolvedJsonFiles, pluginFile);
                         if (addPluginRes.isErr()) {
                             return (0, teamsfx_api_1.err)(addPluginRes.error);
                         }
                     }
                 }
                 // Add embedded knowledge files
-                if (getCopilotGptRes.value.capabilities) {
-                    const embeddedKnowledgeCapabilities = getCopilotGptRes.value.capabilities.filter((capability) => capability.name === teamsfx_api_1.DeclarativeCopilotCapabilityName.EmbeddedKnowledge);
+                if (Array.isArray(manifest.capabilities)) {
+                    const embeddedKnowledgeCapabilities = manifest.capabilities.filter((capability) => capability.name === teamsfx_api_1.DeclarativeCopilotCapabilityName.EmbeddedKnowledge);
                     if (embeddedKnowledgeCapabilities.length > 0) {
                         const fileSet = new Set();
                         for (const capability of embeddedKnowledgeCapabilities) {
@@ -250,7 +255,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                             for (const file of fileArr) {
                                 const knowledgeFileAbsolutePath = path.resolve(appDirectory, file);
                                 // check existence
-                                const checkExistenceRes = await this.validateReferencedFile(knowledgeFileAbsolutePath, appDirectory);
+                                const checkExistenceRes = await this.validateReferencedFile(knowledgeFileAbsolutePath, appDirectory, file);
                                 if (checkExistenceRes.isErr()) {
                                     return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                                 }
@@ -260,13 +265,96 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                         }
                     }
                 }
+                // Add agent skill directories (support both agent_skills and x-agent_skills)
+                if (featureFlags_1.featureFlagManager.getBooleanValue(featureFlags_1.FeatureFlags.AgentSkillsManifest)) {
+                    const agentSkills = getCopilotGptRes.value.agent_skills ||
+                        getCopilotGptRes.value["x-agent_skills"];
+                    if (agentSkills && Array.isArray(agentSkills)) {
+                        for (const skill of agentSkills) {
+                            if (skill.folder) {
+                                // Resolve skill folder relative to appDirectory (not .generated/)
+                                // since skill folders don't support env var substitution
+                                const skillFolderAbsolutePath = path.resolve(appDirectory, skill.folder);
+                                const checkExistenceRes = await this.validateReferencedFile(skillFolderAbsolutePath, appDirectory, skill.folder);
+                                if (checkExistenceRes.isErr()) {
+                                    return (0, teamsfx_api_1.err)(checkExistenceRes.error);
+                                }
+                                const skillMdPath = path.join(skillFolderAbsolutePath, "SKILL.md");
+                                if (!(await fs_extra_1.default.pathExists(skillMdPath))) {
+                                    return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(skillMdPath), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+                                }
+                                await this.addLocalFolderRecursive(zip, skillFolderAbsolutePath, appDirectory);
+                            }
+                        }
+                    }
+                }
             }
             else {
                 return (0, teamsfx_api_1.err)(getCopilotGptRes.error);
             }
         }
-        zip.writeZip(zipFileName);
-        await this.writeJsonFile(teamsManifestJsonFileName, JSON.stringify(manifest, null, 4));
+        const teamsManifestAgentSkills = manifest
+            .agentSkills;
+        if (teamsManifestAgentSkills?.length) {
+            const addSkillsRes = await this.addAgentSkillFolders(zip, teamsManifestAgentSkills, appDirectory);
+            if (addSkillsRes.isErr()) {
+                return (0, teamsfx_api_1.err)(addSkillsRes.error);
+            }
+        }
+        const teamsManifestAgentConnectors = manifest.agentConnectors;
+        if (teamsManifestAgentConnectors?.length) {
+            const addConnectorsRes = await this.addAgentConnectorFiles(zip, teamsManifestAgentConnectors, appDirectory);
+            if (addConnectorsRes.isErr()) {
+                return (0, teamsfx_api_1.err)(addConnectorsRes.error);
+            }
+        }
+        if (resolvedJsonFiles.has(teamsManifestJsonFileName)) {
+            return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        resolvedJsonFiles.set(teamsManifestJsonFileName, JSON.stringify(manifest, null, 4));
+        const outputFileNames = [zipFileName, ...resolvedJsonFiles.keys()];
+        const canonicalOutputPaths = [];
+        let hasInvalidOutputPath = false;
+        for (const outputFileName of outputFileNames) {
+            let canonicalOutputPath;
+            try {
+                if (await this.isDirectory(outputFileName)) {
+                    hasInvalidOutputPath = true;
+                    break;
+                }
+                canonicalOutputPath = await this.getCanonicalDestinationPath(outputFileName);
+            }
+            catch (error) {
+                return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageFileSystemError(error, outputFileName));
+            }
+            if (canonicalOutputPaths.some((outputPath) => this.isPathContained(outputPath, canonicalOutputPath) ||
+                this.isPathContained(canonicalOutputPath, outputPath))) {
+                hasInvalidOutputPath = true;
+                break;
+            }
+            canonicalOutputPaths.push(canonicalOutputPath);
+        }
+        if (hasInvalidOutputPath) {
+            return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputZipPath", args.outputJsonPath ? "outputJsonPath" : "outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        const stagedZipFileName = this.getStagedOutputPath(zipFileName);
+        const maxPackageSize = 10 * 1024 * 1024;
+        try {
+            zip.writeZip(stagedZipFileName);
+            const zipStats = await fs_extra_1.default.stat(stagedZipFileName);
+            if (zipStats.size > maxPackageSize) {
+                return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageSizeExceededError(zipStats.size, maxPackageSize));
+            }
+            await this.publishOutputs(stagedZipFileName, zipFileName, resolvedJsonFiles);
+        }
+        catch (error) {
+            return (0, teamsfx_api_1.err)(error instanceof teamsApp_1.AppPackageFileSystemError
+                ? error
+                : new teamsApp_1.AppPackageFileSystemError(error, zipFileName));
+        }
+        finally {
+            await fs_extra_1.default.remove(stagedZipFileName).catch(() => { });
+        }
         const builtSuccess = [
             { content: "(√)Done: ", color: teamsfx_api_1.Colors.BRIGHT_GREEN },
             { content: "App Package ", color: teamsfx_api_1.Colors.BRIGHT_WHITE },
@@ -298,16 +386,89 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             return (0, teamsfx_api_1.ok)(undefined);
         }
     }
-    async validateReferencedFile(file, directory) {
+    async validateReferencedFile(file, directory, originalReference) {
+        const displayDirectory = path.resolve(directory);
+        const resolvedFile = path.resolve(file);
+        const fileReference = originalReference ?? path.relative(displayDirectory, resolvedFile);
+        if (!this.isPathContained(directory, file)) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileReference, resolvedFile, displayDirectory));
+        }
         if (!(await fs_extra_1.default.pathExists(file))) {
-            return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, file, "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(file), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+        }
+        let realFile;
+        let realDirectory;
+        try {
+            realFile = await fs_extra_1.default.realpath(file);
+            realDirectory = await fs_extra_1.default.realpath(directory);
+        }
+        catch (error) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.AppPackageFileSystemError(error, file));
+        }
+        if (!this.isPathContained(realDirectory, realFile)) {
+            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(fileReference, realFile, displayDirectory));
         }
+        return (0, teamsfx_api_1.ok)(undefined);
+    }
+    isPathContained(directory, file) {
         const relativePath = path.relative(directory, file);
-        if (relativePath.startsWith("..")) {
-            return (0, teamsfx_api_1.err)(new teamsApp_1.InvalidFileOutsideOfTheDirectotryError(file));
+        return (relativePath === "" ||
+            (relativePath !== ".." &&
+                !relativePath.startsWith(`..${path.sep}`) &&
+                !path.isAbsolute(relativePath)));
+    }
+    async addAgentSkillFolders(zip, agentSkills, appDirectory) {
+        for (const skill of agentSkills) {
+            const skillFolderAbs = path.resolve(appDirectory, skill.folder);
+            const validationResult = await this.validateReferencedFile(skillFolderAbs, appDirectory, skill.folder);
+            if (validationResult.isErr()) {
+                return (0, teamsfx_api_1.err)(validationResult.error);
+            }
+            const skillMdPath = path.join(skillFolderAbs, "SKILL.md");
+            if (!(await fs_extra_1.default.pathExists(skillMdPath))) {
+                return (0, teamsfx_api_1.err)(new common_1.FileNotFoundError(exports.actionName, path.basename(skillMdPath), "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            }
+            await this.addLocalFolderRecursive(zip, skillFolderAbs, appDirectory);
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
+    async addAgentConnectorFiles(zip, agentConnectors, appDirectory) {
+        for (const connector of agentConnectors) {
+            const mcpToolDescriptionFile = connector.toolSource?.remoteMcpServer?.mcpToolDescription?.file;
+            if (!mcpToolDescriptionFile) {
+                continue;
+            }
+            const mcpFileAbsolutePath = path.resolve(appDirectory, mcpToolDescriptionFile);
+            const checkExistenceRes = await this.validateReferencedFile(mcpFileAbsolutePath, appDirectory, mcpToolDescriptionFile);
+            if (checkExistenceRes.isErr()) {
+                return (0, teamsfx_api_1.err)(checkExistenceRes.error);
+            }
+            const dir = path.dirname(mcpToolDescriptionFile);
+            this.addFileInZip(zip, dir, mcpFileAbsolutePath);
+        }
+        return (0, teamsfx_api_1.ok)(undefined);
+    }
+    async addLocalFolderRecursive(zip, folderAbs, appDirectory) {
+        const entries = await fs_extra_1.default.readdir(folderAbs, { withFileTypes: true });
+        const realAppDirectory = await fs_extra_1.default.realpath(appDirectory);
+        for (const entry of entries) {
+            const entryAbs = path.join(folderAbs, entry.name);
+            if (entry.isSymbolicLink()) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await this.addLocalFolderRecursive(zip, entryAbs, appDirectory);
+            }
+            else if (entry.isFile()) {
+                const realEntryAbs = await fs_extra_1.default.realpath(entryAbs);
+                if (!this.isPathContained(realAppDirectory, realEntryAbs)) {
+                    continue;
+                }
+                const relDir = path.dirname(path.relative(appDirectory, entryAbs));
+                zip.addLocalFile(entryAbs, (0, utils_2.normalizePath)(relDir, true));
+            }
+        }
+    }
     /**
      * Add plugin file and plugin related files to zip.
      * @param zip zip
@@ -317,9 +478,9 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
      * @param outputDirectory optional. Folder where we should put the resolved manifest in.
      * @returns result of adding plugin file and plugin related files
      */
-    async addPlugin(zip, pluginRelativePath, appDirectory, context, outputDirectory, defaultAppDirectry) {
+    async addPlugin(zip, pluginRelativePath, appDirectory, context, outputDirectory, defaultAppDirectry, resolvedJsonFiles, originalReference) {
         const pluginFile = path.resolve(appDirectory, pluginRelativePath);
-        const checkExistenceRes = await this.validateReferencedFile(pluginFile, appDirectory);
+        const checkExistenceRes = await this.validateReferencedFile(pluginFile, appDirectory, originalReference ?? pluginRelativePath);
         if (checkExistenceRes.isErr()) {
             return (0, teamsfx_api_1.err)(checkExistenceRes.error);
         }
@@ -334,12 +495,16 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (pluginFileContent.functions) {
             for (const func of pluginFileContent.functions) {
                 if (func.capabilities?.response_semantics?.static_template?.file) {
-                    const staticTemplateFile = await this.getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry);
+                    const staticTemplateFileResult = await this.getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry);
+                    if (staticTemplateFileResult.isErr()) {
+                        return (0, teamsfx_api_1.err)(staticTemplateFileResult.error);
+                    }
+                    const staticTemplateFile = staticTemplateFileResult.value;
                     if (!staticTemplateFile) {
                         continue;
                     }
                     if (Object.keys(func.capabilities.response_semantics.static_template).length > 1) {
-                        context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.overrideWarning", pluginFile, func.name));
+                        context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.overrideWarning", path.basename(pluginFile), func.name));
                     }
                     const staticTemplateFileContent = await fs_extra_1.default.readJSON(staticTemplateFile);
                     func.capabilities.response_semantics.static_template = staticTemplateFileContent;
@@ -358,22 +523,30 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         if (containExternalAdaptiveCard) {
             await (0, utils_1.updateVersionForTeamsAppYamlFile)(context.projectPath);
         }
-        if (namespaceContainsUnderscore || containExternalAdaptiveCard) {
-            tempFolder = path.join(appDirectory, ".tmp");
-            await fs_extra_1.default.ensureDir(tempFolder);
-            tmpPluginFile = path.join(tempFolder, `tmp-ai-plugin-${uuid.v4().slice(0, 6)}.json`);
-            const processedFunctionRes = await (0, envFunctionUtils_1.expandVariableWithFunction)(JSON.stringify(pluginFileContent), context, undefined, true, envFunctionUtils_1.ManifestType.PluginManifest, pluginFile);
-            if (processedFunctionRes.isErr()) {
-                return (0, teamsfx_api_1.err)(processedFunctionRes.error);
+        let addFileWithVariableRes;
+        try {
+            if (namespaceContainsUnderscore || containExternalAdaptiveCard) {
+                const processedFunctionRes = await (0, envFunctionUtils_1.expandVariableWithFunction)(JSON.stringify(pluginFileContent), context, undefined, true, envFunctionUtils_1.ManifestType.PluginManifest, pluginFile);
+                if (processedFunctionRes.isErr()) {
+                    return (0, teamsfx_api_1.err)(processedFunctionRes.error);
+                }
+                pluginFileContent = JSON.parse(processedFunctionRes.value);
+                tempFolder = await fs_extra_1.default.mkdtemp(path.join(appDirectory, ".tmp-"));
+                const tempFolderValidation = await this.validateReferencedFile(tempFolder, appDirectory);
+                if (tempFolderValidation.isErr()) {
+                    return (0, teamsfx_api_1.err)(tempFolderValidation.error);
+                }
+                tmpPluginFile = path.join(tempFolder, `tmp-ai-plugin-${uuid.v4().slice(0, 6)}.json`);
+                await fs_extra_1.default.writeJSON(tmpPluginFile, pluginFileContent, { spaces: 4 });
             }
-            pluginFileContent = JSON.parse(processedFunctionRes.value);
-            await fs_extra_1.default.writeJSON(tmpPluginFile, pluginFileContent, { spaces: 4 });
+            addFileWithVariableRes = await this.addFileWithVariable(zip, pluginRelativePath, tmpPluginFile, envFunctionUtils_1.ManifestType.PluginManifest, context, !outputDirectory
+                ? undefined
+                : path.join(outputDirectory, path.relative(appDirectory, pluginFile)), resolvedJsonFiles);
         }
-        const addFileWithVariableRes = await this.addFileWithVariable(zip, pluginRelativePath, tmpPluginFile, envFunctionUtils_1.ManifestType.PluginManifest, context, !outputDirectory
-            ? undefined
-            : path.join(outputDirectory, path.relative(appDirectory, pluginFile)));
-        if (containExternalAdaptiveCard && tmpPluginFile !== pluginFile && tempFolder) {
-            await fs_extra_1.default.remove(tempFolder);
+        finally {
+            if (tempFolder) {
+                await fs_extra_1.default.remove(tempFolder);
+            }
         }
         if (addFileWithVariableRes.isErr()) {
             return (0, teamsfx_api_1.err)(addFileWithVariableRes.error);
@@ -403,7 +576,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                 if (runtime.type === "OpenApi" && runtime.spec?.url) {
                     const specFile = path.resolve(path.dirname(pluginFilePath), runtime.spec.url);
                     // add openapi spec
-                    const checkExistenceRes = await this.validateReferencedFile(specFile, appDirectory);
+                    const checkExistenceRes = await this.validateReferencedFile(specFile, appDirectory, runtime.spec.url);
                     if (checkExistenceRes.isErr()) {
                         return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                     }
@@ -418,7 +591,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
                     runtime.spec?.mcp_tool_description?.file) {
                     const mcpFile = path.resolve(path.dirname(pluginFilePath), runtime.spec.mcp_tool_description.file);
                     // add mcp tool description file
-                    const checkExistenceRes = await this.validateReferencedFile(mcpFile, appDirectory);
+                    const checkExistenceRes = await this.validateReferencedFile(mcpFile, appDirectory, runtime.spec.mcp_tool_description.file);
                     if (checkExistenceRes.isErr()) {
                         return (0, teamsfx_api_1.err)(checkExistenceRes.error);
                     }
@@ -429,8 +602,7 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
-    async addFileWithVariable(zip, entryName, filePath, manifestType, context, outputPath // If outputPath exists, we will write down the file after replacing placeholders.
-    ) {
+    async addFileWithVariable(zip, entryName, filePath, manifestType, context, outputPath, resolvedJsonFiles) {
         const expandedEnvVarResult = await CreateAppPackageDriver_1.expandEnvVars(filePath, context, manifestType);
         if (expandedEnvVarResult.isErr()) {
             return (0, teamsfx_api_1.err)(expandedEnvVarResult.error);
@@ -439,7 +611,11 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
         const attr = await fs_extra_1.default.stat(filePath);
         zip.addFile(entryName, Buffer.from(content), "", attr.mode);
         if (outputPath && path.extname(outputPath).toLowerCase() === ".json") {
-            await this.writeJsonFile(`${outputPath.substring(0, outputPath.length - 5)}.${process.env.TEAMSFX_ENV}.json`, content);
+            const resolvedOutputPath = `${outputPath.substring(0, outputPath.length - 5)}.${process.env.TEAMSFX_ENV}.json`;
+            if (resolvedJsonFiles?.has(resolvedOutputPath)) {
+                return (0, teamsfx_api_1.err)(new common_1.InvalidActionInputError(exports.actionName, ["outputFolder"], "https://aka.ms/teamsfx-actions/teamsapp-zipAppPackage"));
+            }
+            resolvedJsonFiles?.set(resolvedOutputPath, content);
         }
         return (0, teamsfx_api_1.ok)(undefined);
     }
@@ -451,26 +627,163 @@ let CreateAppPackageDriver = CreateAppPackageDriver_1 = class CreateAppPackageDr
             await fs_extra_1.default.chmod(jsonFileName, 0o777);
         }
         await fs_extra_1.default.ensureDir(path.dirname(jsonFileName));
-        await fs_extra_1.default.writeFile(jsonFileName, content);
+        await fs_extra_1.default.outputFile(jsonFileName, content);
         await fs_extra_1.default.chmod(jsonFileName, 0o444);
     }
+    getStagedOutputPath(outputPath) {
+        return path.join(path.dirname(outputPath), `.${path.basename(outputPath)}.${uuid.v4()}.tmp`);
+    }
+    async isDirectory(filePath) {
+        try {
+            return (await fs_extra_1.default.stat(filePath)).isDirectory();
+        }
+        catch (error) {
+            if (this.isFileNotFoundError(error)) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async getCanonicalDestinationPath(outputPath) {
+        try {
+            return await fs_extra_1.default.realpath(outputPath);
+        }
+        catch (error) {
+            if (!this.isFileNotFoundError(error)) {
+                throw error;
+            }
+        }
+        const missingDirectories = [];
+        let ancestor = path.dirname(outputPath);
+        while (true) {
+            try {
+                const realAncestor = await fs_extra_1.default.realpath(ancestor);
+                return path.join(realAncestor, ...missingDirectories, path.basename(outputPath));
+            }
+            catch (error) {
+                if (!this.isFileNotFoundError(error)) {
+                    throw error;
+                }
+                const parent = path.dirname(ancestor);
+                if (parent === ancestor) {
+                    throw error;
+                }
+                missingDirectories.unshift(path.basename(ancestor));
+                ancestor = parent;
+            }
+        }
+    }
+    async publishOutputs(stagedZipFile, outputZipFile, jsonFiles) {
+        const stagedJsonFiles = new Map();
+        const backupFiles = new Map();
+        const publishedFiles = [];
+        let publicationError;
+        try {
+            for (const [jsonFile, content] of jsonFiles) {
+                const stagedJsonFile = this.getStagedOutputPath(jsonFile);
+                stagedJsonFiles.set(jsonFile, stagedJsonFile);
+                await this.writeJsonFile(stagedJsonFile, content);
+            }
+            for (const [jsonFile, stagedJsonFile] of stagedJsonFiles) {
+                await this.backUpOutputFile(jsonFile, backupFiles);
+                await fs_extra_1.default.rename(stagedJsonFile, jsonFile);
+                publishedFiles.push(jsonFile);
+            }
+            await this.backUpOutputFile(outputZipFile, backupFiles);
+            await fs_extra_1.default.rename(stagedZipFile, outputZipFile);
+            publishedFiles.push(outputZipFile);
+        }
+        catch (error) {
+            let rollbackError;
+            for (const publishedFile of publishedFiles.reverse()) {
+                try {
+                    await fs_extra_1.default.chmod(publishedFile, 0o777);
+                }
+                catch (cleanupError) {
+                    if (!this.isFileNotFoundError(cleanupError)) {
+                        rollbackError ??= cleanupError;
+                    }
+                }
+                try {
+                    await fs_extra_1.default.remove(publishedFile);
+                }
+                catch (cleanupError) {
+                    rollbackError ??= cleanupError;
+                }
+            }
+            for (const [outputFile, backupFile] of Array.from(backupFiles.entries()).reverse()) {
+                try {
+                    await fs_extra_1.default.rename(backupFile, outputFile);
+                }
+                catch (restoreError) {
+                    rollbackError ??= restoreError;
+                }
+            }
+            if (rollbackError) {
+                publicationError = rollbackError;
+            }
+            else {
+                publicationError = error;
+            }
+        }
+        let stagedCleanupError;
+        for (const stagedJsonFile of stagedJsonFiles.values()) {
+            try {
+                await fs_extra_1.default.remove(stagedJsonFile);
+            }
+            catch (error) {
+                stagedCleanupError ??= error;
+            }
+        }
+        if (publicationError) {
+            throw new teamsApp_1.AppPackageFileSystemError(publicationError, outputZipFile);
+        }
+        if (stagedCleanupError) {
+            throw new teamsApp_1.AppPackageFileSystemError(stagedCleanupError, outputZipFile);
+        }
+        for (const backupFile of backupFiles.values()) {
+            await fs_extra_1.default.chmod(backupFile, 0o600).catch(() => { });
+            await fs_extra_1.default.remove(backupFile).catch(() => { });
+        }
+    }
+    async backUpOutputFile(outputFile, backupFiles) {
+        const backupFile = this.getStagedOutputPath(outputFile);
+        try {
+            await fs_extra_1.default.rename(outputFile, backupFile);
+            backupFiles.set(outputFile, backupFile);
+        }
+        catch (error) {
+            if (!this.isFileNotFoundError(error)) {
+                throw error;
+            }
+        }
+    }
+    isFileNotFoundError(error) {
+        return error instanceof Error && "code" in error && error.code === "ENOENT";
+    }
     async getAdaptiveCardTemplateFile(context, pluginFile, func, appDirectory, defaultAppDirectry) {
         let staticTemplateFile = path.resolve(defaultAppDirectry ?? path.dirname(pluginFile), func.capabilities.response_semantics.static_template.file);
-        let checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, defaultAppDirectry ?? appDirectory);
+        let checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, defaultAppDirectry ?? appDirectory, func.capabilities.response_semantics.static_template.file);
         if (checkExistenceRes.isOk()) {
-            return staticTemplateFile;
+            return (0, teamsfx_api_1.ok)(staticTemplateFile);
+        }
+        if (checkExistenceRes.error instanceof teamsApp_1.InvalidFileOutsideOfTheDirectotryError) {
+            return (0, teamsfx_api_1.err)(checkExistenceRes.error);
         }
         if (defaultAppDirectry) {
             // Try generated folder
             staticTemplateFile = path.resolve(appDirectory, func.capabilities.response_semantics.static_template.file);
-            checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, appDirectory);
+            checkExistenceRes = await this.validateReferencedFile(staticTemplateFile, appDirectory, func.capabilities.response_semantics.static_template.file);
         }
         if (checkExistenceRes.isErr()) {
-            delete func.capabilities.response_semantics.static_template.file;
-            context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.invalidFilePropertyWarning", pluginFile, func.name));
-            return undefined;
+            if (checkExistenceRes.error instanceof teamsApp_1.InvalidFileOutsideOfTheDirectotryError) {
+                return (0, teamsfx_api_1.err)(checkExistenceRes.error);
+            }
+            delete func.capabilities.response_semantics.static_template;
+            context.logProvider.warning((0, localizeUtils_1.getLocalizedString)("plugins.appstudio.createPackage.aiPlugin.invalidFilePropertyWarning", path.basename(pluginFile), func.name));
+            return (0, teamsfx_api_1.ok)(undefined);
         }
-        return staticTemplateFile;
+        return (0, teamsfx_api_1.ok)(staticTemplateFile);
     }
 };
 exports.CreateAppPackageDriver = CreateAppPackageDriver;