v0.0.6-preview

Draft release created by draft-release.yml. Review and publish manually.

npm publishing is handled by the downstream Microsoft mirror pipeline, not this workflow.

What's Changed

• chore(actions): bump actions/setup-node from 4 to 6 by Dependabot (@dependabot)[bot] in #169
• chore(actions): bump actions/checkout from 4 to 6 by Dependabot (@dependabot)[bot] in #170
• chore(actions): bump actions/configure-pages from 5 to 6 by Dependabot (@dependabot)[bot] in #171
• chore(deps)(deps-dev): bump the dev-dependencies group with 3 updates by Dependabot (@dependabot)[bot] in #172
• Create CODEOWNERS file for Azure Functions team by Tsuyoshi Ushio (@TsuyoshiUshio) in #174
• chore(deps)(deps-dev): bump the dev-dependencies group with 2 updates by Dependabot (@dependabot)[bot] in #176
• Introduce forcePush parameter in code-mirror.yml by Tsuyoshi Ushio (@TsuyoshiUshio) in #177
• chore(actions): bump actions/upload-artifact from 4 to 7 by Dependabot (@dependabot)[bot] in #175
• chore(deps)(deps-dev): bump the dev-dependencies group with 5 updates by Dependabot (@dependabot)[bot] in #179
• Bypass secret scanning for fake doctor fixture by Tsuyoshi Ushio (@TsuyoshiUshio) in #181
• Authenticate npm installs through Azure Artifacts feeds by Tsuyoshi Ushio (@TsuyoshiUshio) in #182
• chore(actions): bump actions/checkout from 6 to 7 by Dependabot (@dependabot)[bot] in #185
• Support library local install by Tsuyoshi Ushio (@TsuyoshiUshio) in #190
• Add telemetry hooks and partner drop pipeline by Tsuyoshi Ushio (@TsuyoshiUshio) in #189
• Use MCP retrieval for serverless agents scaffold by Tsuyoshi Ushio (@TsuyoshiUshio) in #178
• Fix Vally eval routing checks by Tsuyoshi Ushio (@TsuyoshiUshio) in #195
• docs(azure-functions-agents): document Connector Namespace parameterValueSet requirement by Laveesh Rohra (@larohra) in #194
• Update azure-functions-agents skill for observability and endpoint validation by Laveesh Rohra (@larohra) in #193
• chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates by Dependabot (@dependabot)[bot] in #192
• feat: add manifest-backed template apply command by Tsuyoshi Ushio (@TsuyoshiUshio) in #196
• build: onboard npm dependencies to CFS by Tsuyoshi Ushio (@TsuyoshiUshio) in #212
• chore(actions): bump actions/setup-node from 6 to 7 by Dependabot (@dependabot)[bot] in #199
• feat: add Go worker support across the Azure Functions skill suite by Ahmed Muhsin (@ahmedmuhsin) in #210
• refactor: simplify plugin architecture by Tsuyoshi Ushio (@TsuyoshiUshio) in #204
• feat: improve Python doctor diagnostics by Tsuyoshi Ushio (@TsuyoshiUshio) in #205
• build: use shared ESRP npm release template by Tsuyoshi Ushio (@TsuyoshiUshio) in #213
• chore(deps)(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 by Dependabot (@dependabot)[bot] in #207
• build: remove GitHub credentials from release pipeline by Tsuyoshi Ushio (@TsuyoshiUshio) in #220
• chore(deps)(deps-dev): bump postcss from 8.5.16 to 8.5.25 by Dependabot (@dependabot)[bot] in #211
• docs: add coding agent install examples by Tsuyoshi Ushio (@TsuyoshiUshio) in #215
• chore: prepare v0.0.6-preview release by Tsuyoshi Ushio (@TsuyoshiUshio) in #221
• fix: correct official pipeline resource name by Tsuyoshi Ushio (@TsuyoshiUshio) in #228

New Contributors

• Laveesh Rohra (@larohra) made their first contribution in #194
• Ahmed Muhsin (@ahmedmuhsin) made their first contribution in #210

Full Changelog: v0.0.5-preview...v0.0.6-preview

v0.0.2-preview — first release under @azure/functions-skills

First release under the new package name @azure/functions-skills.

Package rename

This package was renamed from @agent-loom/azure-functions-skills (last released as v0.12.1). The version line restarted at 0.0.1-preview to reflect the namespace change. When the preview suffix is dropped we will bump straight to v1.0.0, so version-sort confusion with the legacy tags will resolve itself naturally.

For historical reference, the final release under the old name is tagged legacy-final-agent-loom.

Notable changes

• feat(doctor): two-tier project diagnostics with AI semantic analysis (#118)
  • Tier 1 (always on, < 1s): deterministic built-in checks for host.json, runtime version, extension bundle, language version, local.settings.json, deprecated settings, connection strings, function bindings, entry point, TypeScript build
  • Tier 2 (opt-in, ~60–120s): LLM agent semantic analysis (Copilot CLI / Claude Code / Codex) catching missing error handling, blocking I/O, hardcoded secrets, durable-orchestrator non-determinism
  • --accept-deep-risk required for Tier 2 (agent runs with elevated permissions on workspace)
  • Output formats: text (default), json, markdown, html (self-contained, XSS-safe)
  • Auto-installs skill files via --install-mode local|plugin
• docs: full README + CONTRIBUTING.md restructure for radically intuitive DX
  • README: 11.8 KB → 5.3 KB (-55%), one canonical recipe per topic
  • New: docs/cli-reference.md, docs/doctor-guide.md, docs/skills-vs-azure-skills.md, docs/bad-app-fixtures.md, CONTRIBUTING.md at repo root
• chore: package optimization
  • Removed src/ from npm pack (saved 172 KB unpacked)
  • prepack strips lib/*.js.map (saves 141 KB unpacked)
  • Result: 110 KB packed (-38% from previous 178 KB)

Validation

• 256/256 tests passing (npm run check covers lint + typecheck + validate-skills + verify-plugin-payload + tests + build)
• 3 rounds of GPT-5.5 rubber-duck reviews; all blocking findings fixed via TDD
• 96% recall on 16 bad-app fixtures with real Copilot CLI in E2E run

Install

npx @azure/functions-skills install --agent ghcp --dir ./my-app

See the README for quick start.

Follow-up issues filed during review

Important: #109, #110, #111, #112, #113, #114, #115, #116, #117
Documentation: #119, #120 (closed by #123), #121, #122

Related

• Spec: #106 (F16 azure-functions-doctor PRD)
• Doctor implementation: #118
• README doctor example uses --deep by default: #123

v0.0.5-preview

Highlights

• GHCP workspace MCP fixed (#164, closes #163): GitHub Copilot CLI workspace MCP config is now written to root .mcp.json using the Copilot-compatible { "mcpServers": ... } schema with tools: ["*"], instead of .vscode/mcp.json. Azure MCP now loads correctly in Copilot CLI workspaces.
• Chat passthrough no longer drops startup context (#165): chat preserves the generated Azure Functions startup/setup context when forwarding passthrough args, adds chat --dry-run to preview the resolved agent launch without spawning or mutating state, and aligns GHCP plugin activation with the local layout (uses AGENTS.md + .github/agents/functions-copilot.agent.md; no longer generates .github/copilot-instructions.md).
• Safer workspace updates (#165): customer-owned routing/TOML files are saved aside by default (overridable with --force), while JSON settings (.mcp.json, .claude/settings.json) are deep-merged so custom MCP servers and user settings are preserved across install -> update cycles in both local and plugin modes.
• Setup guidance is now cross-platform and current (#162): azure-functions-setup fix instructions cover Windows / macOS / Linux instead of Linux-only commands, and recommend the latest GA runtimes (Node.js 24, Python 3.13). New setup eval coverage guards against cross-platform and stale-runtime regressions.

Other Changes

• Eval grader fix (#160): command-based tool-call graders now restrict regex checks to bash, powershell, and run, excluding read_bash which lacks a command arg. Fixes the live deploy eval grader failure.
• Workflow cleanup (#161): renamed CI workflows to clearer, purpose-oriented names (Build and Test, Skill Evaluation - Offline, Skill Evaluation - Azure Live Deploy, Cleanup Azure Live Eval Resources) and removed obsolete workflows (Nightly E2E, Live Azure Login Smoke).
• Release prep (#168): bump package to 0.0.5-preview, regenerate plugin payload and marketplace manifests, refresh release helper docs.

What's Changed

• fix(eval): exclude read_bash from command-based tool-call graders by Tsuyoshi Ushio (@TsuyoshiUshio) in #160
• chore(actions): clarify workflow names and remove unused e2e jobs by Tsuyoshi Ushio (@TsuyoshiUshio) in #161
• fix: update setup runtime install guidance by Tsuyoshi Ushio (@TsuyoshiUshio) in #162
• Fix GHCP MCP workspace config path by Tsuyoshi Ushio (@TsuyoshiUshio) in #164
• fix: preserve chat startup context with passthrough by Tsuyoshi Ushio (@TsuyoshiUshio) in #165
• chore: prepare v0.0.5-preview release by Tsuyoshi Ushio (@TsuyoshiUshio) in #168

Full Changelog: v0.0.4-preview...v0.0.5-preview

---

npm publishing is handled by the downstream Microsoft mirror pipeline, not this workflow.

v0.0.4-preview

Release overview

Azure Functions Skills 0.0.4-preview is a pre-release focused on making the public preview safer, easier to install, and easier to validate across GitHub Copilot CLI, Claude Code, and Codex.

Highlights:

• Added the new azure-functions-agents skill for building AI-powered Azure Functions agent apps, including scheduled agents, chat agents, connector-triggered agents, and background AI workflows.
• Improved install, chat, update, and doctor flows for both plugin and local installs across supported coding agents.
• Hardened update behavior with install-mode detection and file-type-aware strategies so user customizations are preserved more safely.
• Reduced workspace routing noise by keeping large skill content in skill files instead of duplicating it into routing instructions.
• Added stronger pre-release validation, including E2E test guidance, current published reports, and Vally evaluation coverage for create/setup/deploy scenarios.
• Refreshed documentation and release-readiness guidance for the Azure Functions Skills public preview.

What's Changed

• docs(readme): simplify Quick Start install/chat examples by Tsuyoshi Ushio (@TsuyoshiUshio) in #140
• ci: add 1ES pipeline configuration for npm publish by Tsuyoshi Ushio (@TsuyoshiUshio) in #107
• chore(actions): bump azure/login from 2 to 3 by Dependabot (@dependabot)[bot] in #135
• chore(actions): bump actions/deploy-pages from 4 to 5 by Dependabot (@dependabot)[bot] in #136
• chore(actions): bump actions/upload-pages-artifact from 3 to 5 by Dependabot (@dependabot)[bot] in #137
• docs: define Azure Skills and Azure Functions Skills boundary by Tsuyoshi Ushio (@TsuyoshiUshio) in #101
• docs: update installation and workspace routing PRD by Tsuyoshi Ushio (@TsuyoshiUshio) in #81
• feat(prd): F16 azure-functions-doctor — two-tier project diagnostics design by Tsuyoshi Ushio (@TsuyoshiUshio) in #106
• chore(deps)(deps-dev): bump the dev-dependencies group with 4 updates by Dependabot (@dependabot)[bot] in #138
• docs: pre-release comprehensive audit report by Tsuyoshi Ushio (@TsuyoshiUshio) in #142
• feat(eval): add Vally LLM evaluation for azure-functions-create (PoC) by Tsuyoshi Ushio (@TsuyoshiUshio) in #141
• ci(eval): install func + azd on runner + add azure-functions-setup eval (re-target #150 onto main) by Tsuyoshi Ushio (@TsuyoshiUshio) in #151
• feat(eval): Tier 3 live deploy eval for azure-functions-deploy + cleanup safety net by Tsuyoshi Ushio (@TsuyoshiUshio) in #154
• Add azure-functions-agents skill by Anthony Chu (@anthonychu) in #158
• fix: update command auto-detects local mode and uses file-type-aware strategies by Tsuyoshi Ushio (@TsuyoshiUshio) in #152
• chore: add AGENTS.md, custom instructions, and reusable prompts for dev harness by Tsuyoshi Ushio (@TsuyoshiUshio) in #155
• fix(eval): use tool-calls grader for deploy assertion + security regression guard by Tsuyoshi Ushio (@TsuyoshiUshio) in #156
• docs(eval): document CI / Azure setup required for the Vally live deploy workflow by Tsuyoshi Ushio (@TsuyoshiUshio) in #157
• chore(release): 0.0.4-preview by Tsuyoshi Ushio (@TsuyoshiUshio) in #159

New Contributors

• Anthony Chu (@anthonychu) made their first contribution in #158

Full Changelog: v0.0.3-preview...v0.0.4-preview

v0.0.3-preview

Supply-chain hardening release for both the doctor command and the release surface of this repository itself. Motivated by the September 2025 durabletask PyPI compromise (Shai-Hulud worm).

Highlights

doctor is now a supply-chain defender

• 5 new Tier 1 deterministic checks (no LLM required):
  • lifecycle-scripts — flags forbidden preinstall / postinstall in the project's package.json.
  • unpinned-prod-deps — flags floating version ranges in production deps.
  • missing-lockfile — warns when package-lock.json/yarn.lock/pnpm-lock.yaml is absent.
  • tracked-secret-files — fails when .env / .env.* files are tracked by git (consults git ls-files, not just .gitignore).
  • install-script-deps — warns when production deps run install-time scripts (excludes well-known natives like sharp, bcrypt).
• 2 new Python Tier 1 checks:
  • python-unpinned-requirements — flags requirements.txt entries not pinned with ==.
  • python-missing-lockfile — warns when no Python lockfile or --hash pinning is present.
• 10 new Tier 2 (LLM) checks SC-101..SC-110 (loaded via references/supply-chain-checks.md): module-load side effects, fetch-then-execute droppers, silent error suppression, C2-like URLs, credential collection, persistence install, lateral movement primitives, anti-analysis guards, hardcoded secrets, suspicious version pinning.
• ALL_CHECKS registry grows from 13 → 20.

--deep is now safe to run in CI

• PR-context refusal: --deep refuses to run on pull request workspaces by default (GITHUB_EVENT_NAME=pull_request, Azure DevOps BUILD_REASON=PullRequest, GitLab MR). Pull request code is untrusted and can prompt-inject the agent. Set AZURE_FUNCTIONS_DOCTOR_TRUST_PR=1 in mirror/release pipelines that need to scan post-merge.
• --deep requires explicit --accept-deep-risk.
• All warning text is pure ASCII to avoid mojibake on Windows PowerShell stderr.

Repository release surface hardening

• Removed the obsolete publish.yml workflow. npm publishing is exclusively handled by the downstream Microsoft mirror pipeline; no NPM_TOKEN lives in this repo.
• Added draft-release.yml so a tag push creates a draft Release for review.
• Added CI guardrails: lint-package-scripts.mjs, lint-skill-content.mjs, audit-npm-token.mjs.
• Added Dependabot config for npm + GitHub Actions.

Documentation

• README now features --deep as the primary doctor example, with a GitHub Actions recipe customers can copy into their own repos to gate deploys.
• Extended SECURITY.md and docs/doctor-guide.md with the supply-chain threat model and trust-boundary guidance.

Bug fixes

• Sanitised the durabletask IOC strings in supply-chain-checks.md that were tripping Windows Defender / Azure SDK release-pipeline anti-malware (Trojan:JS/ShaiWorm.DAH!MTB). Lint patterns added so the verbatim IOCs cannot return.

Distribution

• The package is published to npm as @azure/functions-skills through the Microsoft mirror release pipeline, not from this repository. Tags here produce draft GitHub releases for review only; the actual npm publish is downstream.

Full Changelog: v0.0.2-preview...v0.0.3-preview

v0.12.1

v0.12.1 Release Notes

• Updated feedback skill guidance
• New npm package

v0.12.0

Azure Functions Skills v0.12.0

AI assistant plugins for Azure Functions — one-command setup for GitHub Copilot, Claude Code, and Codex.

Install with npm

npx @agent-loom/azure-functions-skills@0.12.0 setup
npx @agent-loom/azure-functions-skills@0.12.0 chat

Plugin bundles

Download the plugin payload zip and register the extracted directory with your agent's plugin-from-source flow.

Artifact	Download
Cross-tool plugin payload	azure-functions-skills-plugin-0.12.0.zip

What's new

• Claude Code plugin payload now uses a Claude-compatible manifest shape.
• azure-functions-skills chat --help prints local command help while preserving chat -- --help pass-through to agent CLIs.
• E2E guidance and published report coverage were refreshed for GitHub Copilot CLI, Claude Code, and Codex plugin/chat flows.

See the auto-generated changelog below.

What's Changed

• feat: add local release helper by Tsuyoshi Ushio (@TsuyoshiUshio) in #40
• feat: rename Functions Copilot agent by Tsuyoshi Ushio (@TsuyoshiUshio) in #41
• Refactor skill templates to use SKILL.md frontmatter by Tsuyoshi Ushio (@TsuyoshiUshio) in #42
• feat: add committed plugin release payload by Tsuyoshi Ushio (@TsuyoshiUshio) in #43
• Add Azure Functions best practices skill by Tsuyoshi Ushio (@TsuyoshiUshio) in #44
• Proxy Azure Functions deploy to Azure Skills by Tsuyoshi Ushio (@TsuyoshiUshio) in #45
• feat: install Azure Skills prerequisite for Copilot by Tsuyoshi Ushio (@TsuyoshiUshio) in #47
• docs: update create skill MCP template guidance by Tsuyoshi Ushio (@TsuyoshiUshio) in #48
• fix: improve skill definitions based on e2e testing feedback by Tsuyoshi Ushio (@TsuyoshiUshio) in #49
• Add feedback skill and E2E verification guidance by Tsuyoshi Ushio (@TsuyoshiUshio) in #50
• Add customer-friendly usage scenarios by Tsuyoshi Ushio (@TsuyoshiUshio) in #51
• ci: add live Azure login smoke workflow by Tsuyoshi Ushio (@TsuyoshiUshio) in #52
• feat: add Azure Functions E2E test skill by Tsuyoshi Ushio (@TsuyoshiUshio) in #53
• docs: improve E2E skill reporting workflow by Tsuyoshi Ushio (@TsuyoshiUshio) in #54
• docs: publish E2E report with GitHub Pages by Tsuyoshi Ushio (@TsuyoshiUshio) in #55
• Fix chat pass-through for agent CLIs by Tsuyoshi Ushio (@TsuyoshiUshio) in #62
• Fix Claude plugin format and chat help handling by Tsuyoshi Ushio (@TsuyoshiUshio) in #64

Full Changelog: v0.11.0...v0.12.0

v0.11.0

Azure Functions Skills v0.11.0

AI assistant plugins for Azure Functions — one-command setup for GitHub Copilot, Claude Code, and Codex.

Install with npm

bash npx @agent-loom/azure-functions-skills@0.11.0 setup npx @agent-loom/azure-functions-skills@0.11.0 chat

Plugin bundles

Download the zip for your AI assistant and register the extracted target directory with your agent's plugin-from-source flow.

Assistant	Download
GitHub Copilot	azure-functions-skills-ghcp-0.11.0.zip
Claude Code	azure-functions-skills-claude-0.11.0.zip
Codex	azure-functions-skills-codex-0.11.0.zip

What's new

See the auto-generated changelog below.

What's Changed

• Migrate skills package to TypeScript by Tsuyoshi Ushio (@TsuyoshiUshio) in #39

Full Changelog: v0.10.0...v0.11.0

v0.9.0

Azure Functions Skills v0.9.0

AI assistant plugins for Azure Functions — one-command setup for GitHub Copilot, Claude Code, and Codex.

Install with npm

npx @agent-loom/azure-functions-skills@0.9.0 setup
npx @agent-loom/azure-functions-skills@0.9.0 chat

Install without npm

Download the zip for your AI assistant and extract it into your project root:

Assistant	Download
GitHub Copilot	azure-functions-skills-ghcp-0.9.0.zip
Claude Code	azure-functions-skills-claude-0.9.0.zip
Codex	azure-functions-skills-codex-0.9.0.zip

What's new

See the auto-generated changelog below.

What's Changed

• Separate plugin content into templates/ directory by Tsuyoshi Ushio (@TsuyoshiUshio) in #15
• ci: use release notes template to avoid shell escape corruption by Tsuyoshi Ushio (@TsuyoshiUshio) in #16
• Add MIT LICENSE file by Tsuyoshi Ushio (@TsuyoshiUshio) in #17
• Rename content.md to SKILL.md and support references/ subdirectory (closes #8) by Tsuyoshi Ushio (@TsuyoshiUshio) in #18
• azure-functions-create: use templates MCP as primary, func as fallback (closes #9) by Tsuyoshi Ushio (@TsuyoshiUshio) in #19
• chore: bump version to 0.9.0 by Tsuyoshi Ushio (@TsuyoshiUshio) in #20

Full Changelog: v0.8.0...v0.9.0

v0.8.0

Azure Functions Skills v0.8.0

Initial release of the Azure Functions skills plugin for GitHub Copilot, Claude Code, and Codex.

Install with npm

npx @agent-loom/azure-functions-skills setup
npx @agent-loom/azure-functions-skills chat

Install without npm

Download the zip for your AI assistant and extract it into your project root:

Assistant	Download
GitHub Copilot	azure-functions-skills-ghcp-0.8.0.zip
Claude Code	azure-functions-skills-claude-0.8.0.zip
Codex	azure-functions-skills-codex-0.8.0.zip

What's included

• 3 skills: azure-functions-setup, azure-functions-create, azure-functions-deploy
• functions-guide custom agent with MCP template tools
• SessionStart hooks for prerequisite check
• MCP config for Azure Functions Templates
• CLI: setup, chat, build commands
• 20 FRD spec documents
• 56 tests