Merge remote main into users/sellak/customBPPermissions

Resolved merge conflict in Agent365ConfigTests.cs by retaining both
the CustomBlueprintPermissions validation tests from this branch and
the BotName derived property tests that were added in main.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sellakumaran

.claude/agents/pr-code-reviewer.md

@@ -350,6 +350,49 @@ Create a **blocking** architectural finding if:
 - ✅ Be BALANCED: Praise good work alongside constructive criticism
 - ✅ Be ACCURATE: Only report real issues you can verify in the diff
 
+### Verification Rules (MANDATORY — prevent false positives)
+
+#### Rule 1: Mismatch Claims Require Quoted Evidence from Both Sides
+Before reporting ANY claim of the form "X doesn't match Y", "property name mismatch",
+"test uses different value than production code", or similar:
+1. Quote the **exact line from the diff** for side A (e.g. production code)
+2. Quote the **exact line from the diff** for side B (e.g. test code)
+3. Only then state whether they match or not
+
+If you cannot quote both sides verbatim from the diff, do NOT make the claim.
+
+#### Rule 2: Replacement Suggestions Must Acknowledge Behavioral Differences
+When suggesting "replace X with Y", always state explicitly whether X and Y are
+behaviorally equivalent. If they are NOT equivalent, describe the difference.
+
+Example of what NOT to do:
+  "Replace Console.WriteLine() with logger.LogInformation("")"
+  ← Wrong: these are not equivalent (logging pipeline vs. direct stdout)
+
+Example of correct form:
+  "Replace Console.WriteLine() with logger.LogInformation("") for consistency.
+   Note: these differ — Console.WriteLine always writes to stdout; LogInformation
+   is filtered by log level and can be suppressed or redirected by the logging provider."
+
+#### Rule 3: Code Suggestions Must Use Idiomatic .NET Patterns
+When suggesting a refactor to replace weak-typed constructs (e.g. string-keyed
+dictionaries, magic strings, parallel arrays), prefer the most idiomatic C# solution:
+- A small `record` or `sealed class` over two separate typed lists
+- Constants as a minimal alternative when structure change is not warranted
+- Never suggest two parallel variables/lists when a single typed container is cleaner
+
+Example:
+  ❌ Weak suggestion: "Use two typed lists: var orphanedUsers = ...; var orphanedSps = ...;"
+  ✅ Better suggestion: "Use a typed record: private sealed record OrphanedResources(...)"
+
+#### Rule 4: Blocking/High Severity Requires Verifiable Concrete Evidence
+Before marking an issue as `blocking` or `high`:
+1. You must be able to point to a specific line in the diff that demonstrates the problem
+2. For logic bugs: trace the execution path in the code to confirm the bug occurs
+3. For test failures: quote both the assertion AND the value it will actually receive
+4. If any step requires assumption or inference, lower severity to `medium` or add
+   a qualifier like "if X is true, then..." to the description
+
 ### Context Awareness
 
 Differentiate between:

src/Directory.Packages.props

@@ -34,6 +34,10 @@
     <PackageVersion Include="Azure.ResourceManager.AppService" Version="1.2.0" />
     <!-- Microsoft Graph -->
     <PackageVersion Include="Microsoft.Graph" Version="5.36.0" />
+    <!-- Transitive pin: resolves NU1107 conflict between Microsoft.Extensions.Http 9.x (needs >= 9.0.8)
+         and Microsoft.Kiota.Abstractions 1.7.2 (needs < 9.0.0). CentralPackageTransitivePinningEnabled
+         allows this pin to override the Kiota upper bound. -->
+    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.8" />
     <!-- Testing packages -->
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageVersion Include="xunit" Version="2.9.2" />

src/Microsoft.Agents.A365.DevTools.Cli/Commands/CleanupCommand.cs

@@ -741,7 +741,7 @@ private static async Task<bool> DeleteMessagingEndpointAsync(
         }
 
         logger.LogInformation("Deleting messaging endpoint registration...");
-        var endpointName = EndpointHelper.GetEndpointName(config.BotName);
+        var endpointName = ResolveEndpointName(config);
 
         var endpointDeleted = await botConfigurator.DeleteEndpointWithAgentBlueprintAsync(
             endpointName,
@@ -787,8 +787,8 @@ private static async Task ExecuteEndpointOnlyCleanupAsync(
             return;
         }
 
-        // Get the actual endpoint name that will be used for deletion (truncated to 42 chars)
-        var endpointName = EndpointHelper.GetEndpointName(config.BotName);
+        // Get the actual endpoint name that will be used for deletion (truncated to 42 chars).
+        var endpointName = ResolveEndpointName(config);
 
         logger.LogInformation("");
         logger.LogInformation("Endpoint Cleanup Preview:");
@@ -842,4 +842,23 @@ private static async Task ExecuteEndpointOnlyCleanupAsync(
             return null;
         }
     }
+
+    /// <summary>
+    /// Resolves the Azure Bot Service endpoint name from config.
+    /// For needsDeployment=false, prefers BotMessagingEndpoint (updated after each registration)
+    /// over MessagingEndpoint (static) so that delete targets the currently registered endpoint.
+    /// </summary>
+    private static string ResolveEndpointName(Agent365Config config)
+    {
+        if (!config.NeedDeployment)
+        {
+            // Use BotMessagingEndpoint (updated by registration) over MessagingEndpoint (static).
+            var urlForName = !string.IsNullOrWhiteSpace(config.BotMessagingEndpoint)
+                ? config.BotMessagingEndpoint
+                : config.MessagingEndpoint;
+            if (!string.IsNullOrWhiteSpace(urlForName))
+                return EndpointHelper.GetEndpointNameFromUrl(urlForName, config.AgentBlueprintId);
+        }
+        return EndpointHelper.GetEndpointName(config.BotName);
+    }
 }

src/Microsoft.Agents.A365.DevTools.Cli/Commands/PublishCommand.cs

@@ -235,18 +235,21 @@ public static Command CreateCommand(
                 logger.LogInformation("    - Replace 'color.png' and 'outline.png' with your custom branding");
                 logger.LogInformation("");
 
-                // Ask if user wants to open the file now
-                Console.Write("Open manifest in your default editor now? (Y/n): ");
-                var openResponse = Console.ReadLine()?.Trim().ToLowerInvariant();
-                
-                if (openResponse != "n" && openResponse != "no")
+                // Ask if user wants to open the file now (skip when stdin is not a terminal)
+                if (!Console.IsInputRedirected)
                 {
-                    FileHelper.TryOpenFileInDefaultEditor(manifestPath, logger);
+                    Console.Write("Open manifest in your default editor now? (Y/n): ");
+                    var openResponse = Console.ReadLine()?.Trim().ToLowerInvariant();
+
+                    if (openResponse != "n" && openResponse != "no")
+                    {
+                        FileHelper.TryOpenFileInDefaultEditor(manifestPath, logger);
+                    }
+
+                    Console.Write("Press Enter when you have finished editing the manifest to continue with publish: ");
+                    Console.Out.Flush();
+                    Console.ReadLine();
                 }
-                
-                Console.Write("Press Enter when you have finished editing the manifest to continue with publish: ");
-                Console.Out.Flush();
-                Console.ReadLine();
 
                 logger.LogInformation("Continuing with publish process...");
                 logger.LogInformation("");