Skip to content

feat: full azd extension framework adoption - metadata, MCP server, lifecycle events#37

Merged
jongio merged 14 commits intomainfrom
azdextimprove
Feb 23, 2026
Merged

feat: full azd extension framework adoption - metadata, MCP server, lifecycle events#37
jongio merged 14 commits intomainfrom
azdextimprove

Conversation

@jongio
Copy link
Owner

@jongio jongio commented Feb 23, 2026

Summary

Fully adopts the azd extension framework capabilities: metadata, lifecycle-events, mcp-server, and distributed tracing. Adds an MCP server with 4 tools for script execution and environment introspection, with comprehensive security hardening.

Extension Framework Capabilities Added

  • metadata - azdext.GenerateExtensionMetadata() for IntelliSense and CLI help
  • lifecycle-events - Clean azdext.ExtensionHost (no stub handlers)
  • mcp-server - 4 MCP tools: exec_script, exec_inline, list_shells, get_environment
  • Distributed tracing - OTel W3C trace context propagation preserving cobra signal handling

Security Hardening

  • Path validation - security.ValidatePathWithinBases() for script path containment
  • Secret filtering - Env vars containing SECRET, PASSWORD, KEY, TOKEN, CREDENTIAL, CERTIFICATE, CONNECTION_STRING are excluded from get_environment
  • Shell normalization - Binary names lowercased for cross-platform compatibility
  • Rate limiting - Token bucket rate limiter on all MCP tools (10 burst, 1/sec refill)
  • Input validation - Shell name validation, timeout parsing

Test Coverage

  • 39.4% commands package coverage (7 new security-focused tests)
  • Tests cover: shell arg construction, secret filtering, rate limiting, helpers

Changes

  • 10 files changed, 1125 insertions(+), 15 deletions(-)

jongio and others added 9 commits February 22, 2026 08:06
Add the metadata capability to the azd-exec extension to enable:
- CLI help integration with rich usage information
- IntelliSense support for extension flags and arguments
- Configuration validation schemas

Changes:
- Add 'metadata' to capabilities in extension.yaml
- Create hidden metadata command that outputs JSON metadata
- Register metadata command in root command

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implement full azd extension framework integration:
- Real listen command with azdext.ExtensionHost for lifecycle events
- MCP server with exec_script, exec_inline, list_shells, get_environment tools
- Rate limiting (60 calls/min, burst 10) and security validation for MCP tools
- Update extension.yaml with lifecycle-events and mcp-server capabilities
- Add go.work entry for azure-dev dependency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Hydrate context with TRACEPARENT for distributed trace correlation
- Replace duplicated rate limiter with azdextutil.RateLimiter
- Use azdextutil security helpers for path/shell validation
- Use azdextutil.GetProjectDir for safe directory resolution

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Switch from azdextutil.SetupTracingFromEnv to azdext.NewContext() for proper OTel tracing
- Replace hand-written metadata with azdext.GenerateExtensionMetadata() for framework-conforming schema

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Filter get_environment to only return AZD_*/AZURE_*/ARM_* prefixed vars (security)
- Remove meaningless lifecycle event handler stubs from listen command

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace azdext.NewContext() (starts from context.Background()) with
propagation.TraceContext{}.Extract() on the existing cobra context,
preserving Ctrl+C handling and other context values.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Filter secret-bearing env vars (SECRET, PASSWORD, KEY, TOKEN, etc.)
- Switch from deprecated ValidatePath to security.ValidatePathWithinBases
- Normalize shell binary names to lowercase for cross-platform compat

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions
Copy link
Contributor

github-actions bot commented Feb 23, 2026

🚀 Website Preview

Your PR preview was available here.

Preview has been cleaned up as the PR was closed.

github-actions bot added a commit that referenced this pull request Feb 23, 2026
Pin go.mod to azd-core v0.5.2-0.20260223042348-df3319c65059 which includes
lint fixes, macOS symlink test fix, and gofmt formatting.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions bot added a commit that referenced this pull request Feb 23, 2026
- Check error return of fmt.Fprintln in metadata command
- Fix gofmt formatting (CRLF -> LF line endings)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions bot added a commit that referenced this pull request Feb 23, 2026
- Use t.Setenv in tests instead of unchecked os.Setenv
- Simplify lambda wrappers (gocritic unlambda)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions bot added a commit that referenced this pull request Feb 23, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Feb 23, 2026

🚀 Test This PR

A preview build (0.3.7-pr37) is ready for testing!

🌐 Website Preview

Live Preview: https://jongio.github.io/azd-exec/pr/37/

One-Line Install (Recommended)

PowerShell (Windows):

iex "& { $(irm https://raw.githubusercontent.com/jongio/azd-exec/main/cli/scripts/install-pr.ps1) } -PrNumber 37 -Version 0.3.7-pr37"

Bash (macOS/Linux):

curl -fsSL https://raw.githubusercontent.com/jongio/azd-exec/main/cli/scripts/install-pr.sh | bash -s 37 0.3.7-pr37

Uninstall

When you're done testing:

PowerShell (Windows):

iex "& { $(irm https://raw.githubusercontent.com/jongio/azd-exec/main/cli/scripts/uninstall-pr.ps1) } -PrNumber 37"

Bash (macOS/Linux):

curl -fsSL https://raw.githubusercontent.com/jongio/azd-exec/main/cli/scripts/uninstall-pr.sh | bash -s 37

Build Info:

What to Test:
Please review the PR description and test the changes described there.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions bot added a commit that referenced this pull request Feb 23, 2026
Replace pseudo-version with official tagged release.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions bot added a commit that referenced this pull request Feb 23, 2026
@jongio jongio merged commit 1620019 into main Feb 23, 2026
15 checks passed
@jongio jongio deleted the azdextimprove branch February 23, 2026 15:55
github-actions bot added a commit that referenced this pull request Feb 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant