microsoft-agent 2.3.2__tar.gz → 2.3.3__tar.gz

{microsoft_agent-2.3.2/microsoft_agent.egg-info → microsoft_agent-2.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agent
-Version: 2.3.2
+Version: 2.3.3
 Summary: Governed Microsoft Graph agent and MCP server
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License-Expression: MIT
@@ -71,7 +71,7 @@ Dynamic: license-file
 agent. It uses Agent Connector SDK for MCP, identity propagation, intent delegation,
 configuration, telemetry, and graph integration.
 
-Current package version: **2.3.2**
+Current package version: **2.3.3**
 
 ## Capabilities
 

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/README.md

@@ -3,7 +3,7 @@
 agent. It uses Agent Connector SDK for MCP, identity propagation, intent delegation,
 configuration, telemetry, and graph integration.
 
-Current package version: **2.3.2**
+Current package version: **2.3.3**
 
 ## Capabilities
 

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/microsoft_agent/_version.py

@@ -1,3 +1,3 @@
 """Single package version authority."""
 
-__version__ = "2.3.2"
+__version__ = "2.3.3"

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/microsoft_agent/windows_companion_service.py

@@ -60,6 +60,7 @@ from microsoft_agent.windows_runtime import (
     WindowsRuntimeLimits,
     WindowsServiceManager,
     WindowsToastNotificationAdapter,
+    build_client_tls_context,
 )
 
 try:  # Core authentication dependency, guarded for library-only installs.
@@ -241,18 +242,18 @@ def validate_local_service_config(config: WindowsCompanionServiceConfig) -> None
         certificate_der = ssl.PEM_cert_to_DER_cert(certificate_pem)
     except ValueError as exc:
         raise ValueError("Client certificate is not valid PEM") from exc
-    actual_thumbprint = hashlib.sha1(certificate_der).hexdigest().upper()  # noqa: S324
+    actual_thumbprint = (
+        hashlib.sha1(certificate_der, usedforsecurity=False).hexdigest().upper()
+    )
     if not hmac.compare_digest(actual_thumbprint, certificate.thumbprint):
         raise ValueError("Client certificate fingerprint does not match configuration")
     password = _private_key_password(certificate)
-    context = ssl.create_default_context(
-        cafile=str(certificate.ca_bundle_path) if certificate.ca_bundle_path else None
-    )
     try:
-        context.load_cert_chain(
-            certificate.client_certificate_path,
-            certificate.client_private_key_path,
-            password=password,
+        build_client_tls_context(
+            ca_bundle_path=certificate.ca_bundle_path,
+            client_certificate_path=certificate.client_certificate_path,
+            client_private_key_path=certificate.client_private_key_path,
+            private_key_password=password,
         )
     except (OSError, ssl.SSLError) as exc:
         raise ValueError(

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/microsoft_agent/windows_control_plane.py

@@ -21,7 +21,6 @@ import json
 import ntpath
 import os
 import sqlite3
-import ssl
 from collections.abc import Mapping
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
@@ -69,6 +68,7 @@ from microsoft_agent.windows_runtime import (
     RelayActionDelivery,
     RelayPollBatch,
     WindowsRuntimeError,
+    build_client_tls_context,
 )
 
 try:  # FastAPI is supplied by the MCP/agent runtime extras.
@@ -1235,15 +1235,12 @@ class HttpOutboundRelayTransport(OutboundRelayTransport):
         if not 1024 <= maximum_response_bytes <= 268_435_456:
             raise ValueError("maximum_response_bytes is outside the safe range")
         self._maximum_response_bytes = maximum_response_bytes
-        context = ssl.create_default_context(
-            cafile=str(ca_bundle_path) if ca_bundle_path else None
+        context = build_client_tls_context(
+            ca_bundle_path=ca_bundle_path,
+            client_certificate_path=client_certificate_path,
+            client_private_key_path=client_private_key_path,
+            private_key_password=private_key_password,
         )
-        if client_certificate_path and client_private_key_path:
-            context.load_cert_chain(
-                certfile=str(client_certificate_path),
-                keyfile=str(client_private_key_path),
-                password=private_key_password,
-            )
         self._opener = build_opener(_NoRedirect(), HTTPSHandler(context=context))
 
     async def poll(

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/microsoft_agent/windows_runtime.py

@@ -16,12 +16,14 @@ from __future__ import annotations
 
 import asyncio
 import base64
+import contextlib
 import hashlib
 import json
 import ntpath
 import os
 import platform
 import socket
+import ssl
 import stat
 import sys
 from collections import OrderedDict
@@ -30,6 +32,7 @@ from datetime import UTC, datetime
 from pathlib import Path, PureWindowsPath
 from typing import Any, Protocol, TypeVar, runtime_checkable
 
+from agent_connector_sdk.tls.resolve import resolve_tls_profile
 from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from microsoft_agent.windows_companion import (
@@ -227,15 +230,11 @@ class PyWin32OfficeAutomation:
             return {"application": application, "exported": True}
         finally:
             if document is not None:
-                try:
+                with contextlib.suppress(Exception):  # defensive COM cleanup
                     document.Close(False)
-                except Exception:  # pragma: no cover - defensive COM cleanup
-                    pass
             if app is not None:
-                try:
+                with contextlib.suppress(Exception):  # defensive COM cleanup
                     app.Quit()
-                except Exception:  # pragma: no cover - defensive COM cleanup
-                    pass
             self._pythoncom.CoUninitialize()
 
 
@@ -1303,7 +1302,35 @@ def _installed_windows_software() -> list[dict[str, str]]:
     return sorted(found.values(), key=lambda item: item["name"].casefold())[:500]
 
 
+def build_client_tls_context(
+    *,
+    ca_bundle_path: str | os.PathLike[str] | None = None,
+    client_certificate_path: str | os.PathLike[str] | None = None,
+    client_private_key_path: str | os.PathLike[str] | None = None,
+    private_key_password: str | None = None,
+) -> ssl.SSLContext:
+    """Return the verified client context for the control-plane connection.
+
+    Trust comes from the SDK TLS profile (``resolve_tls_profile``): a per-instance
+    CA bundle is passed through the profile, otherwise the deployment's
+    ``MICROSOFT_*`` trust profile applies. The client certificate is loaded onto
+    that context here because the key password is a runtime value that a profile
+    document may not carry.
+    """
+
+    profile = {"ca_bundle_path": str(ca_bundle_path)} if ca_bundle_path else None
+    context = resolve_tls_profile("microsoft", profile=profile).ssl_context
+    if client_certificate_path and client_private_key_path:
+        context.load_cert_chain(
+            certfile=str(client_certificate_path),
+            keyfile=str(client_private_key_path),
+            password=private_key_password,
+        )
+    return context
+
+
 __all__ = [
+    "build_client_tls_context",
     "ClipboardAdapter",
     "DesktopFlowExecutor",
     "NotificationAdapter",

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3/microsoft_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agent
-Version: 2.3.2
+Version: 2.3.3
 Summary: Governed Microsoft Graph agent and MCP server
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License-Expression: MIT
@@ -71,7 +71,7 @@ Dynamic: license-file
 agent. It uses Agent Connector SDK for MCP, identity propagation, intent delegation,
 configuration, telemetry, and graph integration.
 
-Current package version: **2.3.2**
+Current package version: **2.3.3**
 
 ## Capabilities
 

{microsoft_agent-2.3.2 → microsoft_agent-2.3.3}/microsoft_agent.egg-info/SOURCES.txt

@@ -183,6 +183,7 @@ tests/test_settings_and_policy.py
 tests/test_startup.py
 tests/test_teams_reliability.py
 tests/test_transport_migration.py
+tests/test_transport_tls.py
 tests/test_verify_api_integration.py
 tests/test_windows_companion.py
 tests/test_windows_control_plane.py

microsoft_agent-2.3.3/tests/test_transport_tls.py

@@ -0,0 +1,104 @@
+"""The control-plane client TLS context comes from the SDK TLS profile."""
+
+from __future__ import annotations
+
+import ast
+import ssl
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+import pytest
+from agent_connector_sdk.tls.errors import TransportSecurityError
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.x509.oid import NameOID
+
+from microsoft_agent import windows_runtime
+from microsoft_agent.windows_runtime import build_client_tls_context
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _identity(directory: Path) -> tuple[Path, Path]:
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "companion")])
+    now = datetime.now(UTC)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(name)
+        .issuer_name(name)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - timedelta(minutes=1))
+        .not_valid_after(now + timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(key, hashes.SHA256())
+    )
+    cert_path, key_path = directory / "cert.pem", directory / "key.pem"
+    cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    key_path.write_bytes(
+        key.private_bytes(
+            serialization.Encoding.PEM,
+            serialization.PrivateFormat.PKCS8,
+            serialization.NoEncryption(),
+        )
+    )
+    return cert_path, key_path
+
+
+def test_client_context_verifies_peer_and_uses_instance_ca(tmp_path: Path) -> None:
+    """CONN-MICROSOFT-AGENT-TRANSPORT-TLS-R001: profile-built verified context."""
+    cert, key = _identity(tmp_path)
+    context = build_client_tls_context(
+        ca_bundle_path=cert,
+        client_certificate_path=cert,
+        client_private_key_path=key,
+    )
+    assert context.verify_mode == ssl.CERT_REQUIRED
+    assert context.check_hostname is True
+    assert context.minimum_version >= ssl.TLSVersion.TLSv1_2
+    subjects = [entry.get("subject") for entry in context.get_ca_certs()]
+    assert ((("commonName", "companion"),),) in subjects
+
+
+def test_client_context_uses_the_sdk_profile(monkeypatch: pytest.MonkeyPatch) -> None:
+    """CONN-MICROSOFT-AGENT-TRANSPORT-TLS-R001: resolution goes through the SDK."""
+    seen: dict[str, object] = {}
+    real = windows_runtime.resolve_tls_profile
+
+    def spy(service: str, **kwargs: object):
+        seen.update(service=service, **kwargs)
+        return real(service, **kwargs)
+
+    monkeypatch.setattr(windows_runtime, "resolve_tls_profile", spy)
+    build_client_tls_context()
+    assert seen["service"] == "microsoft"
+
+
+def test_missing_ca_bundle_fails_closed(tmp_path: Path) -> None:
+    """CONN-MICROSOFT-AGENT-TRANSPORT-TLS-R001: no silent fallback to default trust."""
+    with pytest.raises(TransportSecurityError):
+        build_client_tls_context(ca_bundle_path=tmp_path / "absent.pem")
+
+
+def test_no_hand_built_tls_context_in_package() -> None:
+    """CONN-MICROSOFT-AGENT-TRANSPORT-TLS-R002: only the SDK builds SSL contexts."""
+    offenders: list[str] = []
+    for path in (ROOT / "microsoft_agent").rglob("*.py"):
+        for node in ast.walk(ast.parse(path.read_text(encoding="utf-8"))):
+            if (
+                isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Attribute)
+                and node.func.attr
+                in {
+                    "create_default_context",
+                    "SSLContext",
+                    "_create_unverified_context",
+                }
+            ):
+                offenders.append(f"{path.relative_to(ROOT)}:{node.lineno}")
+            if isinstance(node, ast.keyword) and node.arg == "verify":
+                if isinstance(node.value, ast.Constant) and node.value.value is False:
+                    offenders.append(f"{path.relative_to(ROOT)}:{node.value.lineno}")
+    assert not offenders