Repository navigation
.NET: Require full LocalCodeAct interpreter paths - #10225
Open
Eduard van Valkenburg (eavanvalkenburg) wants to merge 3 commits into
Open
Eduard van Valkenburg (eavanvalkenburg) wants to merge 3 commits into
Eduard van Valkenburg (eavanvalkenburg) wants to merge 3 commits into
Conversation
Eduard van Valkenburg (eavanvalkenburg)
temporarily deployed
to
github-app-auth
November 10, 2026 10:31 — with 
GitHub Actions
Inactive
Eduard van Valkenburg (eavanvalkenburg)
temporarily deployed
to
github-app-auth
November 10, 2026 10:31 — with
GitHub Actions
Inactive
Copilot started reviewing on behalf of
Eduard van Valkenburg (eavanvalkenburg)
November 10, 2026 10:32
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the Windows interpreter configuration changes.
No open issues 🎉
What changed in this PR
This PR makes Windows interpreter configuration explicit for .NET LocalCodeAct. Both public constructors require a fully qualified path to an existing interpreter file before extracting scripts, while non-Windows behavior remains unchanged.
Changes:
- Add shared Windows path validation, including when code validation is disabled.
- Require explicit Windows interpreter configuration in the hosted sample and document migration guidance.
- Add constructor regression tests and adapt existing tests to valid Windows paths.
| File | Description |
|---|---|
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalExecuteCodeFunctionIntegrationTests.cs |
Filter Windows interpreter discovery to fully qualified paths. |
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/LocalCodeActProviderTests.cs |
Use an existing executable for constructor-only tests. |
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/InterpreterResolutionTests.cs |
Cover path rejection, acceptance, and unchanged non-Windows behavior. |
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/FeatureUsageActivationTests.cs |
Supply a valid executable path for feature-usage testing. |
dotnet/tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/ApprovalPropagationTests.cs |
Adapt approval tests to the Windows path requirement. |
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/README.md |
Document Windows requirements and trusted-location precautions. |
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/LocalExecuteCodeFunction.cs |
Validate interpreter paths and document constructor exceptions. |
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/LocalCodeActProvider.cs |
Apply the same validation to provider construction. |
dotnet/src/Microsoft.Agents.AI.LocalCodeAct/Internal/PythonExecutablePath.cs |
Centralize Windows path and file-existence checks. |
dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-LocalCodeAct/README.md |
Explain platform-specific interpreter configuration. |
dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-LocalCodeAct/Program.cs |
Check Windows configuration at startup; retain the Unix fallback. |
dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-LocalCodeAct/.env.example |
Add Windows interpreter configuration guidance. |
Review effort: Balanced
Contributor
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): 1a78fd942397
Model: gpt-5.6-sol
Overview
The PR consistently applies an explicit Windows interpreter-path contract to both public constructors before script extraction, with focused tests covering validation modes, path forms, missing files, directories, spaces, and preserved Unix behavior. The hosted LocalCodeAct sample and documentation are updated in parallel. One other first-party sample still relies on the now-invalid bare python3 default for direct Windows runs and must be migrated with the breaking contract.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: dotnet/src/Microsoft.Agents.AI.LocalCodeAct/LocalCodeActProvider.cs
Eduard van Valkenburg (eavanvalkenburg)
temporarily deployed
to
github-app-auth
November 10, 2026 12:27 — with
GitHub Actions
Inactive
Eduard van Valkenburg (eavanvalkenburg)
temporarily deployed
to
github-app-auth
November 10, 2026 12:39 — with
GitHub Actions
Inactive
5 of 7 tasks
westey (westey-m)
approved these changes
Nov 10, 2026
Eduard van Valkenburg (eavanvalkenburg)
deployed
to
github-app-auth
November 10, 2026 17:26 — with
GitHub Actions
Active
Eduard van Valkenburg (eavanvalkenburg)
deployed
to
github-app-auth
November 10, 2026 17:27 — with
GitHub Actions
Active
Vincent Biret (baywet)
approved these changes
Nov 10, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation & Context
Make interpreter selection explicit and consistent across LocalCodeAct validation and execution on every platform. Both public entry points now require a fully qualified path to an existing interpreter file.
Description & Review Guide
LocalCodeActProviderandLocalExecuteCodeFunction, before embedded scripts are extracted. Apply it on Windows, Linux, and macOS, update both hosted samples and their configuration guidance, and add constructor regression tests.LOCAL_CODEACT_PYTHON; the ClawAgent container sets it to its installed/usr/bin/python3, and the source-deploy sample forwards the configured hosted-runtime path throughazure.yaml. Validation policy and runner arguments are unchanged.ClawAgent.Hostedrelies on the provider check. The standaloneHosted-LocalCodeActsample retains its own startup check because its currently referenced published package does not enforce this contract.dotnet run --project tests/Microsoft.Agents.AI.LocalCodeAct.UnitTests/Microsoft.Agents.AI.LocalCodeAct.UnitTests.csproj -f net10.0 --no-restore -p:UseSharedCompilation=false(fromdotnet/, on macOS with an installed Python interpreter configured): passed, 287 tests succeeded and 2 Windows-specific root-relative path cases were skipped.dotnet build samples/02-agents/Harness/BuildYourOwnClaw/Claw_Step04_ProductionReady/ClawAgent.Hosted/ClawAgent.Hosted.csproj -f net10.0 --no-restore --tl:off --verbosity minimal --disable-build-servers -p:UseSharedCompilation=false(fromdotnet/): passed, with 0 warnings and 0 errors.dotnet build HostedLocalCodeAct.csproj --tl:off --verbosity minimal --disable-build-servers -p:UseSharedCompilation=false(from a standalone copy of the hosted sample outside the repository): passed, with 0 warnings and 0 errors.git diff --check: passed. The full .NET solution was not built or tested. Windows/Linux runtime validation and hosted deployments were not run locally.Related Issue
N/A
AI Assistance
AI assistance details: GitHub Copilot assisted with the implementation, tests, documentation, and this PR description.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.