Victor Dibia

This commit delivers **critical security fixes** and **documentation updates** across the AutoGen framework to enhance its overall security posture. It **restricts `importlib` provider loading** within the `autogen-core` module's `load_component` function to trusted namespaces, with an environment variable option for additional trusted paths, and adds **security validations** to the `autogen-ext` module's `extract_audio` tool to prevent SSRF and enforce safe file operations. These **vulnerability mitigations** are supported by new tests and are complemented by updated `README.md` and installation documentation that caution users about AutoGen Studio's production readiness and security features.

This commit introduces significant **security enhancements** and **refactoring** within **AutoGen Studio**, alongside a **bug fix** for the `autogen-ext` package. It **deprecates the `FunctionTool`** throughout AutoGen Studio's frontend and validation logic, preventing arbitrary code execution and guiding users towards the more secure MCP Workbenches. Concurrently, the **MCP WebSocket endpoint** (`mcp.py`) is hardened by storing session parameters server-side, mitigating potential security risks. Finally, the `_redis_memory.py` module receives a **bug fix** to correctly handle empty or whitespace queries, returning empty results.

This commit **upgrades the AutoGen GraphRAG integration and sample application** to be compatible with **GraphRAG v2.3+**. It involves **significant refactoring** of the `GlobalSearchTool` and `LocalSearchTool` within `autogen-ext/tools/graphrag` to align with the **updated GraphRAG API** for model loading, data indexing, and search execution, including new data configuration conventions. The **`agentchat_graphrag` sample application** was also enhanced with automated sample data download, direct OpenAI client initialization, and its `settings.yaml` and `README.md` were completely restructured to reflect the new framework configuration. This **maintenance and feature enhancement** ensures that AutoGen's GraphRAG capabilities leverage the latest GraphRAG features and provides an up-to-date, easier-to-use example for developers.

This commit **upgrades** the **MCP (Microsoft Content Platform) integration** within the `autogen-ext` package, specifically impacting the `autogen_ext.tools.mcp` module. It **enhances** the payload normalization and serialization logic in `_base.py` to support new **MCP content types** like `AudioContent` and `ResourceLink`, and to correctly handle optional `meta` fields. The `_normalize_payload_to_content_list` and `return_value_as_string` functions are updated to accommodate these changes. A new test case in `test_mcp_tools.py` verifies the proper serialization of `ResourceLink` objects, ensuring the robustness of this **feature enhancement**. This work ensures compatibility with newer MCP versions and expands the types of content that can be processed by the `autogen-ext` tools.

This commit provides a **bug fix** addressing a **serialization issue** within the **MCP tools**' `StreamableHttpServerParams` configuration. Previously, `timedelta` objects used for `timeout` and `sse_read_timeout` were not JSON serializable, causing problems for UIs like AGS that expect configurations to be JSON compatible. The fix updates the `StreamableHttpServerParams` class in `_config.py` to use `float` values for these timeouts, which are then correctly converted to `timedelta` within the `create_mcp_server_session` function in `_session.py` during session initialization. This ensures that **MCP server parameters** are properly JSON serializable, enhancing compatibility with external systems and UIs.

This commit **fixes a bug** within the **devcontainer setup** that specifically affected integration with **Azure OpenAI (AGS)**. Previously, developers using the `devcontainer` environment might have encountered issues when attempting to utilize AGS services. This **maintenance fix** ensures that the `devcontainer` is correctly configured to support AGS, thereby improving the developer experience and setup reliability for those working with Azure OpenAI.

This commit primarily **updates the AutogenStudio version to 0.4.2.2**, incorporating several **minor fixes and enhancements** across the application. It **improves data serialization** within the `autogenstudio.database` by enhancing `CustomJSONEncoder` to properly handle `datetime` and `enum` objects, ensuring more consistent data storage and retrieval. Additionally, **connection management** in `autogenstudio.web` is made more robust with better error handling and date/time object serialization, while a **bug fix** prevents unbound variable errors in websocket message processing. Finally, the frontend **sidebar UI** sees a temporary adjustment by commenting out the 'Labs' navigation item.

This commit **updates** the **`AzureAIAgent`** within Autogen to align with the latest **Azure AI Agent Foundry SDK**, representing a significant **refactoring** of the integration. It involves adjusting imports, method calls, and parameter names, such as using `endpoint` instead of `connection string`, and refining internal logic for message and file handling in `autogen_ext/agents/azure/_azure_ai_agent.py`. This ensures continued compatibility and leverages new capabilities from the updated SDK, impacting users of the `autogen_ext.agents.azure` extension. Additionally, a new **user guide** (`azure-foundry-agent.ipynb`) is introduced, providing an example of the Bing Search Grounding tool for the Azure AI Foundry Agent.

This commit delivers a crucial **bug fix** and **refactoring** for the **Anthropic Bedrock chat completion client** within the `autogen-ext` package. It resolves import errors by ensuring `AnthropicBedrockChatCompletionClient` is properly exported and updates its internal logic to leverage `AsyncAnthropicBedrock` for correct asynchronous operation. Furthermore, the commit refactors the `BedrockInfo` configuration to securely manage AWS credentials as `SecretStr` and enhances the client's docstring for improved clarity. This work enables users to reliably integrate and utilize Anthropic models via AWS Bedrock with robust asynchronous capabilities and enhanced security for sensitive information.

This commit introduces **support for new OpenAI GPT-4o search preview models** by updating the `_model_info.py` file within the `autogen-ext` package. It registers `gpt-4o-mini-search-preview-2025-03-11` and `gpt-4o-search-preview-2025-03-11`, detailing their capabilities such as function calling and structured output. This **feature addition** allows users to leverage these advanced models for search-related tasks directly within the Autogen framework, enhancing its integration with the latest OpenAI offerings. The update expands the available model choices, providing more powerful options for AI agent configurations.

This commit **fixes a critical CI bug** that was preventing the documentation build from completing successfully. It addresses an issue where a recent update to the `pydocspec` dependency introduced a problematic `nr-utils` dependency, causing import failures. To resolve this, the `docspec` version is now **pinned to 2.2.1** within the `.github/workflows/docs.yml` file. Additionally, this **maintenance update** bumps the Python version used for the documentation build from 3.8 to **3.9**, ensuring the documentation process remains stable and up-to-date.

This commit **fixes an omission in the tracing documentation** by updating the `pip install` command within the `autogen-core` user guide. Specifically, it adds the crucial `opentelemetry-exporter-otlp-proto-grpc` dependency to the installation instructions in `python/packages/autogen-core/docs/src/user-guide/agentchat-user-guide/tracing.ipynb`. This **documentation maintenance** ensures that users can successfully set up the **AgentChat tracing feature** without encountering missing dependency errors, thereby improving the reliability and usability of the guide.

Update AutoGen dependency range in AGS (#6298)

This commit provides a **documentation update** to the `autogen-core` package, specifically within the **models tutorial** (`models.ipynb`). It adds a crucial note and a code example demonstrating how to properly define `ModelInfo` for **new Gemini models**. This **maintenance** work improves user guidance, making it easier for developers to integrate and configure the latest Gemini models within their AutoGen applications. The change ensures the documentation remains current and provides practical, actionable steps for model integration.

This commit significantly enhances **AutoGen Studio (AGS)** by introducing two major new capabilities. Firstly, it enables **file upload and paste functionality** for tasks, allowing users to provide text and image files directly as input for agent processing, such as summarizing documents or analyzing screenshots. Secondly, a **new, comprehensive evaluation framework** is implemented, providing structured tools for assessing agent performance. This framework includes new data models for evaluation tasks, runs, and criteria, an `EvalOrchestrator` for managing the evaluation lifecycle, and extensible `EvalJudge` and `EvalRunner` components. These changes involve substantial **backend data model enhancements**, refactoring of core components like `TeamManager`, and **frontend UI updates** to support file input in the chat and a new "Labs" section for experimentation and guides.

This commit implements a **bug fix** to ensure that **Anthropic model messages** are fully serializable when passed to the `LLMCallEvent`. Previously, complex objects like `TextBlock` and `ToolUseBlock` within message content caused serialization errors in downstream event sinks and applications. The change introduces a new private method, `_serialize_message`, in `autogen_ext/models/anthropic/_anthropic_client.py` to convert these objects into serializable dictionaries before event emission. This **improves data integrity and reliability** for logging and processing Anthropic model interactions, preventing errors in systems that consume `LLMCallEvent` data.

This commit introduces a **bug fix** to the **WebSurfer agent** by explicitly specifying `encoding="utf-8"` when reading `page_script.js` within `playwright_controller.py`. This change addresses an issue where the agent could fail on systems with non-UTF-8 default encodings, particularly Windows machines, due to incorrect file interpretation. By enforcing **UTF-8 encoding**, the commit ensures **cross-platform compatibility** and reliable operation of the WebSurfer agent's script loading mechanism.

This commit introduces new **documentation** for **AgentChat's tracing and observability features**, specifically detailing how to implement runtime tracing with the `SingleThreaded Runtime` and custom event tracing for messages from `team.run_stream()`. This **documentation enhancement** includes practical examples, such as setting up OpenTelemetry and visualizing traces with Jaeger, making the **AgentChat** module's monitoring capabilities more accessible. The work provides users with essential guidance for debugging and understanding the flow of their multi-agent conversations, improving the overall user experience for developers leveraging these advanced features.

This commit introduces significant **new capabilities** to **AutoGen Studio**, enabling users to **test model clients directly within the UI** before deployment and providing a **side-by-side comparison of chat sessions** in the playground. Backend changes include a **new `validation` package** with a `ComponentTestService` for comprehensive component testing, alongside a **refactored `ValidationService`** to streamline validation logic and improve maintainability. On the frontend, the **`teambuilder` component editor** now integrates a test button to display `ComponentTestResult`s, while the **`playground` module** gains a `SessionDropdown` and comparison mode for analyzing multiple runs. Additionally, **`SecretStr` serialization** is enhanced across `database` and `datamodel` components for improved security, and the **Anthropic model client** is added to the default gallery. This work significantly improves the **developer experience** by offering better debugging tools and more robust component management.

This commit introduces an **experimental authentication system** to **AutoGen Studio**, enabling personalized multi-user experiences with initial support for GitHub OAuth. It adds a comprehensive `auth` module to the backend, including new API routes, middleware for securing HTTP and WebSocket connections, and a manager for handling JWT tokens and various authentication providers. The frontend is significantly **refactored** to integrate this new system, featuring dedicated login and callback pages, protected routes, and updated API clients. This **new capability** allows users to enable authentication via a `--auth-config` argument, fundamentally changing how user data is managed and how the application's **UI and API endpoints** are accessed.