agentops-accelerator 0.3.23__tar.gz → 0.4.1__tar.gz

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.3.23",
+      "version": "0.4.1",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/.github/plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.3.23",
+      "version": "0.4.1",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/CHANGELOG.md

@@ -5,6 +5,59 @@ This format follows [Keep a Changelog](https://keepachangelog.com/) and adheres
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-06-15
+
+### Changed
+- **PR-stage Foundry prompt-agent versions are now tagged at the source.** When
+  `agentops.pipeline.prompt_deploy stage` runs in a PR context (GitHub Actions
+  `pull_request` event or Azure DevOps `BUILD_REASON=PullRequest`), the version
+  it creates in the dev Foundry project carries metadata
+  `agentops:candidate=true`, `agentops:pr=<number>`, and
+  `agentops:created_at=<ISO timestamp>`. Portal viewers can filter the
+  Versions tab on `agentops:candidate` to separate abandoned PR candidates
+  from deployed-of-record versions, and downstream consumers that resolve
+  "latest" can refuse to pick up candidates. Deployed-of-record versions
+  (push to `main`/`develop`/`release/**` or `workflow_dispatch`) are not
+  tagged, so absence of `agentops:candidate` is the deployed-of-record
+  signal. The PR/deploy workflow templates and the prompt-agent quickstart
+  tutorial are updated to describe the new contract.
+  ([#214](https://github.com/Azure/agentops/issues/214))
+
+## [0.4.0] - 2026-06-14
+
+### Added
+- **`agentops doctor` now detects missing OpenAI data-plane RBAC on the Foundry
+  resource.** A new `security.missing_openai_data_plane_rbac` check resolves the
+  signed-in principal (via the `oid` claim of the access token used by
+  `DefaultAzureCredential`) and lists role assignments at the Foundry account
+  scope using `azure-mgmt-authorization`. When none of *Cognitive Services
+  OpenAI User*, *Cognitive Services OpenAI Contributor* or *Cognitive Services
+  Contributor* is present (directly or inherited), Doctor surfaces an
+  actionable WARNING that includes the exact `az role assignment create`
+  command for *Cognitive Services OpenAI User* scoped to the Foundry account.
+  The check is read-only and skips silently when the SDK, principal or scope
+  cannot be resolved. ([#228](https://github.com/Azure/agentops/issues/228))
+
+### Changed
+- **`agentops-pr` workflow templates now auto-detect a committed baseline.**
+  Both the GitHub Actions (`.github/workflows/agentops-pr.yml`) and Azure
+  DevOps (`.azuredevops/pipelines/agentops-pr.yml`) PR templates emitted by
+  `agentops workflow generate` wrap `agentops eval run` with a small bash
+  guard. When `.agentops/baseline/results.json` exists in the consumer
+  repo, the step automatically passes `--baseline .agentops/baseline/results.json`;
+  without the file the behaviour is unchanged. Aligns shipped templates
+  with the `tutorial-baseline-comparison.md` "drop a file in your repo"
+  promise. Deploy templates (`dev`/`qa`/`prod`) are untouched.
+  ([#155](https://github.com/Azure/agentops/issues/155))
+
+### Fixed
+- **`agentops skills install --platform` help text now lists `cursor`.** The
+  CLI option help was advertising only `copilot` and `claude` even though the
+  `cursor` platform is fully implemented (registers rules in
+  `.cursor/rules/agentops.mdc`). Updated to `Target platform(s): copilot,
+  claude, cursor.` so users discover the supported value from `--help`.
+  ([#157](https://github.com/Azure/agentops/issues/157))
+
 ## [0.3.23] - 2026-06-12
 
 ### Fixed

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentops-accelerator
-Version: 0.3.23
+Version: 0.4.1
 Summary: Release readiness gates and evidence for Microsoft Foundry agents
 License: MIT License
         
@@ -37,18 +37,19 @@ Provides-Extra: foundry
 Requires-Dist: azure-ai-evaluation<2.0,>=1.0; extra == "foundry"
 Requires-Dist: azure-identity<2.0,>=1.17; extra == "foundry"
 Requires-Dist: azure-monitor-opentelemetry<2.0,>=1.6; extra == "foundry"
-Requires-Dist: pandas<3.0,>=2.0; extra == "foundry"
+Requires-Dist: pandas<4.0,>=2.0; extra == "foundry"
 Provides-Extra: agent
 Requires-Dist: fastapi<1.0,>=0.110; extra == "agent"
 Requires-Dist: uvicorn[standard]<1.0,>=0.30; extra == "agent"
 Requires-Dist: httpx<1.0,>=0.27; extra == "agent"
 Requires-Dist: cryptography>=42; extra == "agent"
 Requires-Dist: markdown<4.0,>=3.6; extra == "agent"
-Requires-Dist: azure-monitor-query<2.0,>=1.3; extra == "agent"
+Requires-Dist: azure-monitor-query<3.0,>=1.3; extra == "agent"
 Requires-Dist: azure-monitor-opentelemetry<2.0,>=1.6; extra == "agent"
 Requires-Dist: azure-identity<2.0,>=1.17; extra == "agent"
-Requires-Dist: azure-mgmt-cognitiveservices<14.0,>=13.5; extra == "agent"
+Requires-Dist: azure-mgmt-cognitiveservices<15.0,>=13.5; extra == "agent"
 Requires-Dist: azure-mgmt-monitor<7.0,>=6.0; extra == "agent"
+Requires-Dist: azure-mgmt-authorization<5.0,>=4.0; extra == "agent"
 Dynamic: license-file
 
 <h1 align="center">AgentOps Accelerator</h1>

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/docs/tutorial-prompt-agent-quickstart.md

@@ -1370,11 +1370,18 @@ The PR workflow now has two jobs:
 
 > **Why does the PR workflow stage in dev, not sandbox?** The PR gate
 > must evaluate the same target the deploy workflow will use. Sandbox
-> is the author's playground and never receives CI traffic. PR
-> candidates accumulate in dev over time and may need periodic
-> cleanup according to your team's Foundry retention policy; AgentOps
-> uses prompt SHAs and git SHAs as the durable identity, not old
-> candidate version numbers.
+> is the author's playground and never receives CI traffic.
+>
+> Candidate versions created by PR runs are tagged in Foundry with
+> `agentops:candidate=true` plus `agentops:pr=<number>` and
+> `agentops:created_at=<ISO timestamp>`. Portal viewers can filter the
+> Versions tab on `agentops:candidate` to separate "abandoned PR
+> candidates" from "deployed versions of record". Downstream consumers
+> that resolve `<agent>` to "latest" should skip versions carrying
+> `agentops:candidate=true`; the supported pinning mechanism remains
+> `foundry-agent.json`, which always points at the deployed-of-record
+> version. AgentOps uses prompt SHAs and git SHAs as the durable
+> identity, not old candidate version numbers.
 
 The dev deploy workflow stages a candidate (same logic), evaluates it,
 summarizes the deployment via `prompt_deploy summarize`, and uploads

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/plugins/agentops/package.json

@@ -2,7 +2,7 @@
   "name": "agentops-accelerator",
   "displayName": "AgentOps Accelerator — Skills for GitHub Copilot",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.3.23",
+  "version": "0.4.1",
   "publisher": "AgentOpsAccelerator",
   "icon": "icon.png",
   "license": "MIT",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/plugins/agentops/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentops-accelerator",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.3.23",
+  "version": "0.4.1",
   "author": {
     "name": "AgentOps Accelerator",
     "url": "https://github.com/Azure/agentops"

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/pyproject.toml

@@ -22,7 +22,7 @@ foundry = [
   "azure-ai-evaluation>=1.0,<2.0",
   "azure-identity>=1.17,<2.0",
   "azure-monitor-opentelemetry>=1.6,<2.0",
-  "pandas>=2.0,<3.0",
+  "pandas>=2.0,<4.0",
 ]
 agent = [
   "fastapi>=0.110,<1.0",
@@ -30,11 +30,12 @@ agent = [
   "httpx>=0.27,<1.0",
   "cryptography>=42",
   "markdown>=3.6,<4.0",
-  "azure-monitor-query>=1.3,<2.0",
+  "azure-monitor-query>=1.3,<3.0",
   "azure-monitor-opentelemetry>=1.6,<2.0",
   "azure-identity>=1.17,<2.0",
-  "azure-mgmt-cognitiveservices>=13.5,<14.0",
+  "azure-mgmt-cognitiveservices>=13.5,<15.0",
   "azure-mgmt-monitor>=6.0,<7.0",
+  "azure-mgmt-authorization>=4.0,<5.0",
 ]
 
 [project.scripts]
@@ -67,6 +68,7 @@ where = ["src"]
 [dependency-groups]
 dev = [
     "azure-ai-evaluation>=1.0,<2.0",
+    "azure-mgmt-authorization>=4.0,<5.0",
     "mypy>=1.19.1",
     "pre-commit>=4.0",
     "pytest>=8.0",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/src/agentops/agent/analyzer.py

@@ -16,6 +16,9 @@ from agentops.agent.checks.observability import run_observability_check
 from agentops.agent.checks.opex_workspace import run_opex_workspace_check
 from agentops.agent.checks.opex import run_opex_check
 from agentops.agent.checks.posture import run_posture_check
+from agentops.agent.checks.rbac_openai_data_plane import (
+    run_rbac_openai_data_plane_check,
+)
 from agentops.agent.checks.regression import run_regression_check
 from agentops.agent.checks.release_readiness import run_release_readiness_check
 from agentops.agent.checks.safety import run_safety_check
@@ -145,6 +148,7 @@ def analyze(
     findings.extend(run_errors_check(monitor, foundry, config.checks.errors))
     findings.extend(run_safety_check(history, config.checks.safety, monitor, foundry))
     findings.extend(run_posture_check(resources, posture_config))
+    findings.extend(run_rbac_openai_data_plane_check(resources))
     findings.extend(run_opex_workspace_check(workspace))
     findings.extend(run_governance_check(workspace))
     findings.extend(run_observability_check(workspace))

agentops_accelerator-0.4.1/src/agentops/agent/checks/_rbac_authorization.py

@@ -0,0 +1,118 @@
+"""Lazy Azure SDK glue for the ``rbac_openai_data_plane`` Doctor check.
+
+Kept in a private module so the parent check can attempt the lazy
+import in a single place and stay silent when ``azure-identity`` /
+``azure-mgmt-authorization`` are not installed. All errors that should
+make the check skip are normalised into :class:`AuthorizationCheckError`.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import List
+
+log = logging.getLogger(__name__)
+
+
+class AuthorizationCheckError(RuntimeError):
+    """Raised when the RBAC check cannot run for an environmental reason."""
+
+
+def resolve_signed_in_principal_object_id() -> str:
+    """Return the ``oid`` claim of the shared Azure credential's access token.
+
+    Raises :class:`AuthorizationCheckError` when the credential chain cannot
+    return a token, or when the token does not expose an ``oid`` claim.
+    """
+    try:
+        from agentops.agent.sources._credentials import (
+            format_source_error,
+            get_shared_credential,
+        )
+    except ImportError as exc:  # pragma: no cover - shipped together
+        raise AuthorizationCheckError(
+            f"shared credential factory unavailable: {exc}"
+        ) from exc
+
+    try:
+        credential = get_shared_credential(process_timeout=30)
+        token = credential.get_token("https://management.azure.com/.default")
+    except Exception as exc:  # noqa: BLE001 - normalised to skip-error
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    from agentops.agent.checks.rbac_openai_data_plane import decode_oid_from_jwt
+
+    oid = decode_oid_from_jwt(getattr(token, "token", "") or "")
+    if not oid:
+        raise AuthorizationCheckError(
+            "access token did not include an 'oid' claim; cannot identify "
+            "the signed-in principal"
+        )
+    return oid
+
+
+def list_principal_role_definition_ids(
+    *,
+    subscription_id: str,
+    scope: str,
+    principal_object_id: str,
+) -> List[str]:
+    """List role definition GUIDs assigned to the principal at/above scope.
+
+    Uses ``RoleAssignmentsOperations.list_for_scope`` with the
+    ``atScopeAndAbove() and assignedTo('<oid>')`` filter so management-plane
+    inheritance (subscription, resource group, account) is honoured.
+    """
+    try:
+        from azure.mgmt.authorization import AuthorizationManagementClient
+    except ImportError as exc:
+        raise AuthorizationCheckError(
+            "azure-mgmt-authorization not installed; install "
+            "`agentops-accelerator[agent]` (or add the package directly) to "
+            "enable the OpenAI data-plane RBAC check"
+        ) from exc
+
+    try:
+        from agentops.agent.sources._credentials import (
+            format_source_error,
+            get_shared_credential,
+        )
+    except ImportError as exc:  # pragma: no cover - shipped together
+        raise AuthorizationCheckError(
+            f"shared credential factory unavailable: {exc}"
+        ) from exc
+
+    try:
+        credential = get_shared_credential(process_timeout=30)
+        client = AuthorizationManagementClient(
+            credential=credential,
+            subscription_id=subscription_id,
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    try:
+        assignments = list(
+            client.role_assignments.list_for_scope(
+                scope=scope,
+                filter=(
+                    f"atScopeAndAbove() and assignedTo('{principal_object_id}')"
+                ),
+            )
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    role_definition_ids: List[str] = []
+    for assignment in assignments:
+        rd_id = (
+            getattr(assignment, "role_definition_id", None)
+            or getattr(getattr(assignment, "properties", None), "role_definition_id", None)
+        )
+        if not rd_id:
+            continue
+        # role_definition_id is a full ARM id ending in `/<guid>`.
+        guid = rd_id.rstrip("/").rsplit("/", 1)[-1]
+        if guid:
+            role_definition_ids.append(guid)
+    return role_definition_ids

agentops_accelerator-0.4.1/src/agentops/agent/checks/rbac_openai_data_plane.py

@@ -0,0 +1,235 @@
+"""Check: signed-in principal has Cognitive Services OpenAI User RBAC.
+
+Cloud eval graders and any other data-plane Azure OpenAI call run by
+``agentops eval run`` need the **Cognitive Services OpenAI User** role
+(or another role granting the
+``Microsoft.CognitiveServices/accounts/OpenAI/*/action`` data action) on
+the AI Services account that backs the Foundry project. Without it the
+runtime raises ``PermissionDenied`` / ``AuthenticationError`` mid-run
+even after Azure CLI authentication looks fine.
+
+Today the tutorial and the ``agentops-eval`` skill document this, and
+the CLI surfaces a clearer warning since v0.3.6, but Doctor was silent
+on the missing assignment. This check fills the gap by inspecting the
+existing :class:`AzureResourcesPayload` (resource group, account name,
+account resource id) and querying ``azure-mgmt-authorization`` for role
+assignments at and above the account scope.
+
+The check is **read-only**: it never grants or modifies RBAC. It stays
+silent when:
+
+- the Azure resources source is disabled or returned a non-``ok`` status;
+- ``azure-mgmt-authorization`` is not installed;
+- the signed-in principal cannot be identified (no ``oid`` claim);
+- the role assignments listing fails (permissions / network / etc.).
+
+Issue: https://github.com/Azure/agentops/issues/228
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import json
+import logging
+from typing import Any, List, Optional, Sequence
+
+from agentops.agent.findings import Category, Finding, Severity
+from agentops.agent.sources.azure_resources import AzureResourcesPayload
+
+log = logging.getLogger(__name__)
+
+SOURCE_NAME = "azure_resources"
+
+# https://learn.microsoft.com/azure/role-based-access-control/built-in-roles/ai-machine-learning#cognitive-services-openai-user
+COGNITIVE_SERVICES_OPENAI_USER_ROLE_ID: str = (
+    "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
+)
+
+# Roles that *also* grant the OpenAI data action and therefore satisfy the
+# same need as Cognitive Services OpenAI User. Listed by definition GUID
+# so renames in display name do not break detection.
+_OPENAI_DATA_PLANE_ROLE_IDS: frozenset[str] = frozenset(
+    {
+        # Cognitive Services OpenAI User
+        "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
+        # Cognitive Services OpenAI Contributor
+        "a001fd3d-188f-4b5d-821b-7da978bf7442",
+        # Cognitive Services Contributor (broader admin role; superset of data
+        # action via control plane).
+        "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",
+    }
+)
+
+_FINDING_ID = "security.missing_openai_data_plane_rbac"
+
+
+def run_rbac_openai_data_plane_check(
+    resources: Optional[AzureResourcesPayload],
+) -> List[Finding]:
+    """Return findings if the signed-in principal lacks OpenAI data-plane RBAC."""
+    if resources is None:
+        return []
+    diag = resources.diagnostics or {}
+    if diag.get("status") != "ok":
+        return []
+    target = diag.get("target")
+    account_name = diag.get("account") or (
+        resources.account.name if resources.account else None
+    )
+    resource_group = diag.get("resource_group")
+    subscription_id = _subscription_id_from_target(target)
+    if not target or not account_name or not subscription_id:
+        return []
+
+    try:  # lazy import — keeps `agentops` CLI light
+        from ._rbac_authorization import (
+            AuthorizationCheckError,
+            list_principal_role_definition_ids,
+            resolve_signed_in_principal_object_id,
+        )
+    except ImportError as exc:  # pragma: no cover - test env always installs it
+        log.debug("rbac_openai_data_plane: helper unavailable: %s", exc)
+        return []
+
+    try:
+        principal_object_id = resolve_signed_in_principal_object_id()
+    except AuthorizationCheckError as exc:
+        log.info(
+            "rbac_openai_data_plane: skipped (cannot resolve principal): %s", exc
+        )
+        return []
+
+    try:
+        role_definition_ids = list_principal_role_definition_ids(
+            subscription_id=subscription_id,
+            scope=target,
+            principal_object_id=principal_object_id,
+        )
+    except AuthorizationCheckError as exc:
+        log.info(
+            "rbac_openai_data_plane: skipped (role assignments listing failed): %s",
+            exc,
+        )
+        return []
+
+    granted_role_ids = {rid.lower() for rid in role_definition_ids}
+    if granted_role_ids & {rid.lower() for rid in _OPENAI_DATA_PLANE_ROLE_IDS}:
+        return []
+
+    return [
+        _missing_rbac_finding(
+            account_name=account_name,
+            resource_group=resource_group,
+            subscription_id=subscription_id,
+            scope=target,
+            principal_object_id=principal_object_id,
+            granted_role_ids=sorted(granted_role_ids),
+        )
+    ]
+
+
+def _subscription_id_from_target(target: Optional[str]) -> Optional[str]:
+    """Extract the subscription GUID from an ARM resource id."""
+    if not target:
+        return None
+    parts = target.strip("/").split("/")
+    try:
+        idx = parts.index("subscriptions")
+    except ValueError:
+        return None
+    if idx + 1 >= len(parts):
+        return None
+    return parts[idx + 1]
+
+
+def _missing_rbac_finding(
+    *,
+    account_name: str,
+    resource_group: Optional[str],
+    subscription_id: str,
+    scope: str,
+    principal_object_id: str,
+    granted_role_ids: Sequence[str],
+) -> Finding:
+    rg_clause = (
+        f" (resource group `{resource_group}`)" if resource_group else ""
+    )
+    az_command = (
+        "az role assignment create "
+        f"--assignee {principal_object_id} "
+        '--role "Cognitive Services OpenAI User" '
+        f"--scope {scope}"
+    )
+    return Finding(
+        id=_FINDING_ID,
+        severity=Severity.WARNING,
+        category=Category.SECURITY,
+        title=(
+            "Signed-in principal is missing Cognitive Services OpenAI User on "
+            f"`{account_name}`"
+        ),
+        summary=(
+            "The Doctor signed-in principal does not hold the **Cognitive "
+            "Services OpenAI User** role (or any role with the OpenAI "
+            "data-plane action) at or above the AI Services account "
+            f"`{account_name}`{rg_clause}. Cloud eval graders and other "
+            "data-plane Azure OpenAI calls will fail with `PermissionDenied` "
+            "/ `AuthenticationError` until this assignment exists and Entra "
+            "ID propagates it (typically a few minutes)."
+        ),
+        recommendation=(
+            "Grant the role at the AI Services account scope (preferred) or "
+            "the resource group scope, then wait for propagation before "
+            f"re-running `agentops eval run`. Suggested command:\n\n"
+            f"```bash\n{az_command}\n```\n\n"
+            "If your team scopes this role at the subscription or resource "
+            "group level instead, grant it there. Doctor will detect any "
+            "role at or above the account scope. If you intentionally use a "
+            "different role granting "
+            "`Microsoft.CognitiveServices/accounts/OpenAI/*/action`, add its "
+            "definition GUID to "
+            "`agentops/agent/checks/rbac_openai_data_plane.py:"
+            "_OPENAI_DATA_PLANE_ROLE_IDS`."
+        ),
+        source=SOURCE_NAME,
+        evidence={
+            "account": account_name,
+            "resource_group": resource_group,
+            "subscription_id": subscription_id,
+            "scope": scope,
+            "principal_object_id": principal_object_id,
+            "granted_role_definition_ids": list(granted_role_ids),
+            "required_role": "Cognitive Services OpenAI User",
+            "required_role_id": COGNITIVE_SERVICES_OPENAI_USER_ROLE_ID,
+            "remediation_command": az_command,
+        },
+    )
+
+
+# Re-exported only so callers and tests can decode an Entra ID access token's
+# ``oid`` claim without depending on a dedicated JWT library. Kept here (not
+# in the helper module) because the helper module lazy-imports azure SDKs.
+
+
+def decode_oid_from_jwt(token: str) -> Optional[str]:
+    """Return the ``oid`` (object id) claim of an Entra access token.
+
+    Returns ``None`` when the token is malformed, when the payload cannot
+    be base64-decoded, or when the JSON has no ``oid`` field. The token's
+    signature is **not** verified — Doctor consumes it strictly as a
+    self-attested identifier already produced by the calling Azure SDK.
+    """
+    if not token or token.count(".") < 2:
+        return None
+    payload = token.split(".")[1]
+    padding = "=" * (-len(payload) % 4)
+    try:
+        raw = base64.urlsafe_b64decode(payload + padding)
+        claims: Any = json.loads(raw.decode("utf-8"))
+    except (binascii.Error, UnicodeDecodeError, ValueError):
+        return None
+    if not isinstance(claims, dict):
+        return None
+    oid = claims.get("oid")
+    return oid if isinstance(oid, str) and oid else None

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/src/agentops/cli/app.py

@@ -3313,7 +3313,7 @@ def cmd_skills_install(
         typer.Option(
             "--platform",
             "-p",
-            help="Target platform(s): copilot, claude.",
+            help="Target platform(s): copilot, claude, cursor.",
         ),
     ] = None,
     from_github: Annotated[

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.1}/src/agentops/pipeline/prompt_deploy.py

@@ -424,9 +424,59 @@ def _deployment_metadata(*, environment: str, prompt_hash: str) -> Dict[str, str
     workflow_url = _workflow_url()
     if workflow_url:
         metadata["agentops.workflow_url"] = workflow_url[:512]
+
+    # When the staging step is invoked from a PR-stage workflow, mark the
+    # version as a candidate so portal viewers can filter it out and naive
+    # consumers that resolve "latest" can refuse to pick it up. See issue
+    # #214 for the full rationale.
+    pr_number = _detect_pr_stage()
+    if pr_number is not None:
+        metadata["agentops:candidate"] = "true"
+        if pr_number:
+            metadata["agentops:pr"] = pr_number[:512]
+        metadata["agentops:created_at"] = datetime.now(timezone.utc).isoformat()
+
     return {key: value for key, value in metadata.items() if value}
 
 
+def _detect_pr_stage() -> Optional[str]:
+    """Return the PR number string when running in a PR-stage context.
+
+    Returns:
+        - A PR number (e.g. ``"42"``) when both the PR context and number are
+          identifiable.
+        - An empty string when the PR context is detected but the number cannot
+          be parsed (the version is still flagged as a candidate).
+        - ``None`` when no PR context is detected (deployed-of-record path).
+
+    Detection covers the two CI platforms AgentOps generates workflows for:
+    GitHub Actions (``GITHUB_EVENT_NAME == 'pull_request'``) and Azure
+    DevOps (``BUILD_REASON == 'PullRequest'``).
+    """
+
+    if os.environ.get("GITHUB_EVENT_NAME") == "pull_request":
+        ref = os.environ.get("GITHUB_REF", "")
+        # ``refs/pull/<N>/merge`` or ``refs/pull/<N>/head``.
+        if ref.startswith("refs/pull/"):
+            parts = ref.split("/")
+            if len(parts) >= 3 and parts[2].isdigit():
+                return parts[2]
+        ref_name = os.environ.get("GITHUB_REF_NAME", "")
+        # GITHUB_REF_NAME for PRs is shaped like ``<N>/merge``.
+        head = ref_name.split("/", 1)[0] if ref_name else ""
+        if head.isdigit():
+            return head
+        return ""
+
+    if os.environ.get("BUILD_REASON") == "PullRequest":
+        return (
+            os.environ.get("SYSTEM_PULLREQUEST_PULLREQUESTNUMBER")
+            or ""
+        )
+
+    return None
+
+
 def _git_sha() -> str:
     return (
         os.environ.get("GITHUB_SHA")