Development - #1358
Merged
Merged
Conversation
…res release Relabels both in-app Latest Features tiers to 0.261.001, adds 10 user-facing cards and 2 admin cards for capabilities shipped after 0.250.001 that never had one, and extends the test contract. Also carries the pending Enhanced Citations blob endpoint SSRF validation.
Adds real 1280x720 captures for the workflow run control, workflow alert rules, Document Access Index and Cosmos Maintenance cards. Matches the existing house screenshot standard.
…blish admin screenshots to docs Promotes the User-Facing Latest Features checklist out of the Support Menu pane into its own Help tab, and renames the admin tab to Admin Latest Features so the two audiences are distinguishable. Form field names are unchanged. Also publishes the 16 admin_release_260 screenshots to the documentation site.
…ted vs retrieved, source continuity, filename search, bulk metadata)
… by, JSON artifact, Tab mention)
…red file approval) - completes all 22 release image slots
…d parity test Adds scripts/build_latest_release_docs.py, which projects the current user and admin Latest Features catalogs from support_menu_config.py onto the docs site so the two surfaces cannot drift. It emits docs/_data/latest_release_features.yml, creates pages for cards that lack one, refreshes generator-authored pages in place, relabels the release tier on hand-authored pages, and publishes catalog screenshots to docs/images/latest-release. Also: renders the new Admin-Managed Latest Features group on the latest-release index; documents the User-Facing Latest Features admin tab and the renamed Admin Latest Features tab in docs/admin/help.md; regenerates the stale app_surface inventory; drops the Screenshot Placeholder sections from the 20 release-260 pages now that every image is a real capture; corrects the formula-extraction guidance, which told users to look for LaTeX in the document details panel when that panel only shows metadata. Adds functional_tests/test_docs_latest_release_catalog_parity.py covering group membership, page and image resolution, front matter parseability, layout coverage, and generator freshness.
…dance The six release-260 pages that have an admin catalog counterpart carried an identical generated paragraph telling readers to ask an admin whether the feature was enabled. Each now describes what an admin actually configures, verified against the settings panes rather than the catalog prose. Notably, release-260-mcp-platform now covers the inbound MCP server: SimpleChat exposing conversations, documents, prompts, tags, and workflow tools to MCP clients from its own Inbound MCP tab, gated on an Entra scope, app and user roles, and optional client and tenant allow-lists, with OAuth protected-resource metadata for discovery. That direction was previously undocumented. Reverts the version to the locked 0.261.001 tier and aligns the parity test floor.
… setting Admin card shortcuts were written against pre-rework tab ids. LEGACY_TAB_REDIRECTS keeps those links working, so nothing appeared broken, but the alias resolves to whichever tab inherited the old id rather than the tab holding the setting. #general landed on Branding while Terms of Use and the Chat AI Notice live on Notices & Agreements; #search-extract landed on Web & Research instead of Document Extraction; #scale landed on Redis & Caching for two cards whose controls are on Cosmos; #governance landed on Feature Governance for block lists that live in Governance Policies and for MCP policy that lives on MCP Governance. The MCP card now also links the dedicated Inbound MCP tab, which governs SimpleChat acting as an MCP server and was previously unreachable from the card. The Safety Violations shortcut now targets /admin/safety_violations, which is a page rather than a settings tab. Azure Blob File Sync no longer lists SAS as a fourth authentication mode: the selectable set is managed identity, client secret, and connection string, and a SAS URL arrives through the connection string and is then reported back with its scope, permissions, and expiry. Adds functional_tests/test_latest_feature_action_targets.py, which resolves every target through the alias table parsed from admin_sidebar_nav.js, checks the alias table itself for dangling and shadowed entries, and requires current-release cards to name their destination directly. Version stays at 0.261.001.
…abel Three tests on this branch were red before today's docs work. The tier relabel and the switch to shipping cards visible landed without updating them, and the docs structure test froze the exact 20-slug current release list, so adding catalog cards broke it. test_support_menu_user_feature and test_latest_features_release_group_integrity now assert the 0.261.001 tier and visible-by-default behaviour, and derive card and image counts instead of hard-coding 20 cards with exactly 3 screenshots each. test_latest_release_docs_structure treats its guide list as a floor rather than an exact roster, since test_docs_latest_release_catalog_parity already pins the full set against the app catalog. Also updates docs/latest-release/index.md, which still advertised v0.260.001, claimed the screenshots were branded placeholders, and pointed admins at a General tab that does not exist. test_admin_send_feedback_tab is left alone: it is equally broken on origin/Development because it expects pre-rework nav markers that exist on neither branch.
…n-cards v0.261.001 Latest Features: user and admin tiers, generated docs catalog, real screenshots
Splitting the Data Management tab into five panes removed the element admin_data_management.js resolved its root from, so the module returned at startup and bound nothing. Toggling scheduled backups left the save button disabled, and the rest of the surface never loaded either. Panes now declare data-admin-group-pane="backup-recovery", the module binds across all of them, and the global save button uses the same attribute instead of the removed id. Fixes #1353 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Fact memory was configured only from Agents & Actions, which hid a plain-chat capability behind an agents workflow, and memory writes genuinely required agents because FactMemoryPlugin was only attached to a kernel with automatic function calling on the Semantic Kernel agent path. Move the control to Chat > Chat Experience as the single source of truth, reusing enable_fact_memory_plugin so no migration is needed. The Actions pane now carries a read-only dependency note, mirroring how Tabular Processing points at Enhanced Citations. The Actions toggle previously saved through POST /api/admin/plugins/settings where the key was a REQUIRED field, so removing the input without relaxing that contract would have made the browser post enable_fact_memory_plugin: false. Toggling any unrelated core action would then have silently disabled fact memory. The key moves to deprecated_optional_keys: accepted for older clients, never written from that endpoint. Add agent-free memory writes via functions_fact_memory_autosave.py, a small kernel carrying only the fact-memory plugin, modeled on the existing tabular mini-SK runner. It runs after the assistant response is finalized in both the standard and streaming paths, so it cannot alter or delay the answer, and is gated by user_requested_memory_update() so ordinary turns pay no extra model call. The pass must run inside the originating request because the plugin resolves its authorization boundary from g.authorized_chat_context, which is what keeps a tool call inside the caller's own user or group scope. All failures are contained and logged. Also repairs a stale feature-doc path in test_fact_memory_profile_and_mini_sk that broke when the doc moved into docs/explanation/features/v0.241.001/. Version locked at 0.261.001. Refs #1352 Partially advances #1153 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…issue Fix Backup & Recovery save button never enabling
…-facts-memories-toggle # Conflicts: # docs/_data/app_surface.yml
SimpleChat returned 429 from four unrelated places, each with its own hard-coded string. In chat it was worse: retries absorbed transient 429s, but once they ran out the failure fell through to the generic "Something went wrong while streaming the response" error, which is indistinguishable from a real fault. That matters most in APIM-fronted deployments where throttling is a deliberate capacity decision and the admin knows something useful to say about it. Adds a single admin-configurable, Markdown-capable message resolved from one place and used by every 429 the app returns. - functions_rate_limit.py: leaf module holding the default, the normalizer, and the payload builder, so no surface reimplements the fallback rules and nothing risks a circular import - Two settings keys, enable_custom_rate_limit_message and rate_limit_message, both non-sensitive so they survive sanitize_settings_for_user - Global @app.errorhandler(429) with content negotiation: JSON for API/XHR callers, rendered HTML for browser navigations, and a plain-text fallback if the shell fails to render - Chat classifies an exhausted throttle via is_rate_limit_error and emits rate_limited/status_code 429 instead of the generic stream error - TTS, Swagger spec endpoints and inbound MCP now share the message; inbound MCP keeps its structured limit/window/reset data so clients can still back off - chat-streaming.js renders the Markdown through DOMPurify.sanitize(marked.parse(...)) only for rate limits; every other stream error keeps its createTextNode rendering - New Security > Rate Limiting admin tab with a SimpleMDE editor Version is locked at 0.261.001 for this work. Fixes #1354 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The in-app Latest Features catalog still described fact memory as a profile-only experience. Update the card so it reflects that the assistant now saves, changes, and removes memories during normal chat when a user asks, and that profile remains the place to review and edit everything saved. Refs #1352 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…-toggle Enable fact and instruction memories from Chat admin settings without agents or actions
Development had moved on to the fact memory work and the v0.261.001 relabel. Only two files conflicted, both docs: - docs/explanation/release_notes.md: both sides added entries under the same v0.261.001 heading. Kept both, merged by category so the fact memory and rate limiting entries sit together under New Features and User Interface Enhancements rather than duplicating the headings. - docs/_data/app_surface.yml: generated file, regenerated from the merged application rather than hand-resolved. config.py needed no resolution; Development had already relabeled to 0.261.001, which matches the version this branch locked to. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Make the rate limiting (429) response message admin-configurable with Markdown support
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several new features and improvements related to user experience, rate limiting, and fact memory management in the chat application. The most significant changes include a new agent-free fact memory autosave system, a unified and customizable rate limiting (HTTP 429) response, and enhancements to the admin settings navigation. Additionally, there are security improvements for Azure Blob endpoint validation and minor version updates.
Fact Memory Features:
functions_fact_memory_autosave.py) that detects explicit user requests to save, update, or delete memories and persists them without requiring agents or actions. This improves the user experience by allowing memory changes directly from standard chat interactions.is_fact_memory_enabledhelper to centralize the feature toggle for fact memory capabilities.Rate Limiting Improvements:
Security and Reliability:
BlobServiceClient, mitigating SSRF risks.Admin and User Experience:
Other:
0.260.028to0.261.001.