workpilot 0.1.5__tar.gz

workpilot-0.1.5/.claude/ISSUE_TEMPLATE/JitAccess.yml

@@ -0,0 +1,28 @@
+name: Temporary administrator access request
+description: Request for temporary repository administrator access to this repository, a.k.a Just-in-Time (JIT) access.
+title: "JIT Request"
+labels: ["jit"]
+assignees:
+  - gimsvc_microsoft
+  - 
+body:
+  - type: markdown
+    attributes:
+      value: |
+        :closed_lock_with_key: Permanent repository administrator access is not allowed as per Microsoft security policy. You can use this form to request for temporary administrator access to this repository.
+  - type: textarea
+    id: justification
+    attributes:
+      label: Justification
+      description: Describe the actions that you will perform with your temporary administrator access.
+      placeholder: I need to create secrets.
+    validations:
+      required: true
+  - type: dropdown
+    id: duration
+    attributes:
+      label: Duration (hours)
+      description: How long do you need access for? The duration you select is in hours.
+      options:
+        - 1
+        - 2

workpilot-0.1.5/.claude/acl/access.yml

@@ -0,0 +1,16 @@
+# Documentation for ACL policy: https://aka.ms/gim/docs/policy/acl
+
+name: Access control list
+description: List of teams and their permission levels
+resource: repository
+where:
+configuration:
+  manageAccess:
+  - member: weilail
+    role: Maintain
+  - member: xiaowxie
+    role: Maintain
+  - team: CustomerConnectAdmin
+    role: Push
+  - team: M365CENGFTEs
+    role: Push

workpilot-0.1.5/.claude/compliance/inventory.yml

@@ -0,0 +1,6 @@
+inventory:
+- source: DirectOwners
+  items:
+  - id: weilail@microsoft.com
+  - id: xiaowxie@microsoft.com
+  isProduction: false

workpilot-0.1.5/.claude/policies/jit.yml

@@ -0,0 +1,19 @@
+# Documentation for JIT policy: https://aka.ms/gim/docs/policy/jit
+
+# metadata
+id: id
+name: JIT_Access
+description: Policy for admin JIT for repos in this org
+
+# filters
+resource: repository
+
+# primitive configuration
+configuration:
+    jitAccess:
+        enabled: true
+        maxHours: 2
+        approvers:
+            role: Maintain
+        requestors:
+            role: Write

workpilot-0.1.5/.claude/settings.json

@@ -0,0 +1,31 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(*)",
+      "Bash(git clone:*)",
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "Bash(gh:*)",
+      "Bash(gh api:*)",
+      "Bash(gh search:*)",
+      "Bash(gh repo:*)",
+      "Bash(gh issue:*)",
+      "Bash(gh pr:*)",
+      "Bash(wc:*)",
+      "Bash(grep:*)",
+      "Bash(python:*)",
+      "Bash(xargs grep:*)",
+      "Bash(sed:*)",
+      "Write",
+      "Read",
+      "Glob",
+      "Grep",
+      "NotebookEdit",
+      "WebFetch",
+      "WebSearch",
+      "WebFetch(domain:github.com)",
+      "Task",
+      "Skill"
+    ]
+  }
+}

workpilot-0.1.5/.claude/workflows/cloud-gateway-cd.yml

@@ -0,0 +1,156 @@
+name: Cloud Gateway CD
+
+# Deploys to Azure App Service when changes merge to main.
+# Uses OIDC federated credentials — no client secret stored in GitHub.
+#
+# Required GitHub secrets (set in repo Settings → Secrets → Actions):
+#   AZURE_CLIENT_ID        — federated service principal (contributor on resource group)
+#   AZURE_TENANT_ID        — 72f988bf-86f1-41af-91ab-2d7cd011db47
+#   AZURE_SUBSCRIPTION_ID  — 6b3685a0-3ff1-4d6e-80d5-0ea493dc144a
+#
+# Required GitHub variables (Settings → Variables → Actions):
+#   AZURE_WEBAPP_NAME_DEV  — workpilot-gw-dev
+#   AZURE_RESOURCE_GROUP   — future-test
+#
+# To set up federated credentials:
+#   az ad sp create-for-rbac \
+#     --name "workpilot-gw-cd" \
+#     --role "Contributor" \
+#     --scopes /subscriptions/<sub>/resourceGroups/future-test \
+#     --sdk-auth   # outputs clientId, tenantId, subscriptionId
+#   Then add federated credential in Azure Portal:
+#     App Registration → Certificates & secrets → Federated credentials
+#     Scenario: GitHub Actions → repo: gim-home/WorkPilot → branch: main
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "cloud_gateway/src/**"
+      - "cloud_gateway/CloudGateway.slnx"
+      - ".github/workflows/cloud-gateway-cd.yml"
+
+  # Allow manual trigger (e.g., hotfix deploy)
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment"
+        required: true
+        default: "dev"
+        type: choice
+        options:
+          - dev
+
+defaults:
+  run:
+    working-directory: cloud_gateway
+
+permissions:
+  id-token: write   # required for OIDC token
+  contents: read
+
+jobs:
+  # ── 1. Build & publish artifact ───────────────────────────────────────────
+  build:
+    name: Build & Publish (.NET 10)
+    runs-on: windows-latest
+    outputs:
+      artifact-name: ${{ steps.set-artifact.outputs.name }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.x"
+
+      - name: Restore
+        run: dotnet restore CloudGateway.slnx
+
+      - name: Build (Release)
+        run: dotnet build CloudGateway.slnx --no-restore --configuration Release
+
+      - name: Run tests
+        run: |
+          dotnet test CloudGateway.slnx --no-build --configuration Release `
+            --logger "trx;LogFileName=test-results.trx" `
+            --results-directory TestResults
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-cd
+          path: cloud_gateway/TestResults/*.trx
+
+      - name: Publish (self-contained for Windows x64)
+        run: |
+          dotnet publish src/CloudGateway/CloudGateway.csproj `
+            --configuration Release `
+            --runtime win-x64 `
+            --self-contained false `
+            --output publish/
+
+      - name: Set artifact name
+        id: set-artifact
+        run: echo "name=cloud-gateway-${{ github.sha }}" >> $env:GITHUB_OUTPUT
+
+      - name: Upload publish artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.set-artifact.outputs.name }}
+          path: cloud_gateway/publish/
+          if-no-files-found: error
+
+  # ── 2. Deploy to Dev ──────────────────────────────────────────────────────
+  deploy-dev:
+    name: Deploy → Dev
+    runs-on: ubuntu-latest
+    needs: build
+    environment: dev   # maps to GitHub environment for approval gates (optional)
+
+    steps:
+      - name: Download publish artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build.outputs.artifact-name }}
+          path: publish/
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Zip publish output
+        run: zip -r deploy.zip publish/
+
+      - name: Deploy to Azure App Service
+        uses: azure/webapps-deploy@v3
+        with:
+          app-name: ${{ vars.AZURE_WEBAPP_NAME_DEV }}
+          package: deploy.zip
+
+      - name: Smoke test — health endpoint
+        run: |
+          APP_URL="https://${{ vars.AZURE_WEBAPP_NAME_DEV }}.azurewebsites.net"
+          echo "Smoke testing $APP_URL/health ..."
+          for i in $(seq 1 12); do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$APP_URL/health" || true)
+            if [ "$STATUS" = "200" ]; then
+              echo "Health check passed (attempt $i)"
+              exit 0
+            fi
+            echo "Attempt $i: got $STATUS — waiting 5s..."
+            sleep 5
+          done
+          echo "ERROR: health check failed after 60s"
+          exit 1
+
+      - name: Azure logout
+        if: always()
+        run: az logout

workpilot-0.1.5/.claude/workflows/cloud-gateway-ci.yml

@@ -0,0 +1,134 @@
+name: Cloud Gateway CI
+
+on:
+  push:
+    branches:
+      - impl/cloud-gateway
+      - main
+    paths:
+      - "cloud_gateway/**"
+      - ".github/workflows/cloud-gateway-ci.yml"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "cloud_gateway/**"
+      - ".github/workflows/cloud-gateway-ci.yml"
+
+defaults:
+  run:
+    working-directory: cloud_gateway
+
+jobs:
+  # ── 1. Build + Unit/Integration Tests ─────────────────────────────────────
+  build-and-test:
+    name: Build & Test (.NET 10 / Windows)
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.x"
+
+      - name: Restore
+        run: dotnet restore CloudGateway.slnx
+
+      - name: Build
+        run: dotnet build CloudGateway.slnx --no-restore --configuration Release
+
+      - name: Unit + Integration Tests
+        run: |
+          dotnet test CloudGateway.slnx --no-build --configuration Release `
+            --logger "trx;LogFileName=test-results.trx" `
+            --results-directory TestResults
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: cloud_gateway/TestResults/*.trx
+
+  # ── 2. Bicep Validation ───────────────────────────────────────────────────
+  bicep-validate:
+    name: Validate Bicep IaC
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Azure CLI + Bicep
+        run: |
+          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+          az bicep install
+
+      - name: Build / Lint Bicep
+        working-directory: cloud_gateway/infra
+        run: az bicep build --file main.bicep --stdout > /dev/null
+
+  # ── 3. E2E Protocol Tests ─────────────────────────────────────────────────
+  e2e:
+    name: E2E Protocol Tests
+    runs-on: windows-latest
+    needs: build-and-test   # only run if unit tests pass
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.x"
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Python dependencies
+        run: pip install websockets httpx
+
+      - name: Build (Release)
+        run: dotnet build CloudGateway.slnx --configuration Release
+
+      - name: Start Cloud Gateway service
+        shell: pwsh
+        run: |
+          $proc = Start-Process -FilePath "dotnet" `
+            -ArgumentList "run --project src/CloudGateway/CloudGateway.csproj --no-build --configuration Release" `
+            -PassThru -WindowStyle Hidden
+          echo "SERVICE_PID=$($proc.Id)" >> $env:GITHUB_ENV
+          # Wait for service to be healthy
+          $maxAttempts = 20
+          for ($i = 1; $i -le $maxAttempts; $i++) {
+            Start-Sleep -Seconds 1
+            try {
+              $r = Invoke-WebRequest -Uri "http://localhost:5136/health" -UseBasicParsing -TimeoutSec 2
+              if ($r.StatusCode -eq 200) {
+                Write-Host "Service healthy after $i second(s)"
+                break
+              }
+            } catch {}
+            if ($i -eq $maxAttempts) {
+              Write-Error "Service did not start within $maxAttempts seconds"
+              exit 1
+            }
+          }
+
+      - name: Run E2E protocol tests
+        shell: pwsh
+        run: python tests/e2e_protocol_test.py
+
+      - name: Stop service
+        if: always()
+        shell: pwsh
+        run: |
+          if ($env:SERVICE_PID) {
+            Stop-Process -Id $env:SERVICE_PID -Force -ErrorAction SilentlyContinue
+          }

workpilot-0.1.5/.claude/workflows/teams-app-package.yml

@@ -0,0 +1,42 @@
+name: Teams App Package
+
+# Build and upload the WorkPilot Teams app package (WorkPilot-teams-app.zip).
+# Triggered when teams/ assets change on main, or manually.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "teams/**"
+      - ".github/workflows/teams-app-package.yml"
+  pull_request:
+    paths:
+      - "teams/**"
+      - ".github/workflows/teams-app-package.yml"
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: teams
+
+jobs:
+  build:
+    name: Build WorkPilot-teams-app.zip
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build package
+        run: |
+          chmod +x build.sh
+          ./build.sh
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: WorkPilot-teams-app
+          path: teams/WorkPilot-teams-app.zip
+          if-no-files-found: error
+          retention-days: 30

workpilot-0.1.5/.claude/workflows/workpilot-ci.yml

@@ -0,0 +1,88 @@
+name: WorkPilot CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Cache pip
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest tests/ -v --tb=short
+
+      - name: Run tests with coverage
+        if: matrix.os == 'ubuntu-latest'
+        run: pytest tests/ --cov=workpilot --cov-report=term-missing --cov-report=xml
+
+      - name: Upload coverage
+        if: matrix.os == 'ubuntu-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dev deps
+        run: pip install -e ".[dev]"
+
+      - name: Ruff check
+        run: ruff check workpilot/ tests/
+
+      - name: Ruff format check
+        run: ruff format --check workpilot/ tests/
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dev deps
+        run: pip install -e ".[dev]"
+
+      - name: Mypy
+        run: mypy workpilot/
+        continue-on-error: true  # gradual adoption — pre-existing errors in v0.1 code

workpilot-0.1.5/.gitignore

@@ -0,0 +1,88 @@
+# Teams app package zip (built artifact — regenerate with build.ps1 / build.sh)
+teams/*.zip
+
+# .NET / C#
+bin/
+obj/
+*.user
+*.suo
+.vs/
+_ReSharper*/
+*.DotSettings.user
+TestResults/
+*.nupkg
+*.snupkg
+project.lock.json
+project.fragment.lock.json
+artifacts/
+# User secrets (dotnet user-secrets)
+*/secrets.json
+
+# .NET publish output
+publish/
+out/
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+*.egg-info/
+*.egg
+dist/
+build/
+.eggs/
+*.whl
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Testing
+.coverage
+htmlcov/
+.pytest_cache/
+.mypy_cache/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# Logs
+*.log
+logs/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Claude Code local settings
+settings.local.json
+
+# WorkPilot data
+.workpilot/
+!workpilot/
+
+# WorkPilot local config overrides
+*.local.yaml
+*.local.yml
+
+# Secrets
+*.pem
+*.key
+
+# SQLite
+*.db
+*.db-journal
+deploy.zip
+deploy.zip
+/MEMORY.md
+/HISTORY.md