feat(agents): support private non-ACR registry connections

cli/azd/docs/environment-variables.md

@@ -158,7 +158,7 @@ specific version of the tool installed on the machine.
 | `AZURE_AI_PROJECT_ACR_CONNECTION_NAME` | The Azure Container Registry connection name used by the extension for hosted agents. |
 | `AI_PROJECT_DEPLOYMENTS` | JSON-encoded deployment metadata populated by the extension for agent workflows. |
 | `AI_PROJECT_DEPENDENT_RESOURCES` | JSON-encoded dependent resource metadata populated by the extension for agent workflows. |
-| `AZD_AGENT_SKIP_ACR` | If `true`, signals the Bicep template to skip Azure Container Registry creation during provisioning. Automatically set by `azd agent init` for code-deploy scenarios (where no container image is built). |
+| `AZD_AGENT_SKIP_ACR` | If `true`, signals legacy agent Bicep templates to skip Azure Container Registry creation during provisioning. Automatically set by `azd ai agent init` for code deploy and pre-built-image scenarios. It does not select the container build or deployment mode for new configurations; the agents extension recognizes it only as a compatibility marker for pre-image-passthrough projects. |
 | `ENABLE_HOSTED_AGENTS` | If set, indicates that hosted agents are enabled for the current azd environment. |
 | `ENABLE_CONTAINER_AGENTS` | If set, indicates that container agents are enabled for the current azd environment. |
 | `AGENT_DEFINITION_PATH` | Path to an agent definition file for AI agent workflows. |

cli/azd/extensions/azure.ai.agents/cspell.yaml

@@ -55,6 +55,7 @@ words:
   - azuresdk
   - bicepless
   - CLIENTSECRET
+  - containerref
   - curr
   - dataagent
   - envkey

cli/azd/extensions/azure.ai.agents/extension.yaml

@@ -6,7 +6,7 @@ description: Ship agents with Microsoft Foundry from your terminal. (Beta)
 usage: azd ai agent <command> [options]
 # NOTE: Make sure version.txt is in sync with this version.
 version: 1.0.0-beta.10
-requiredAzdVersion: ">=1.31.1"
+requiredAzdVersion: ">=1.32.0-beta.1"
 dependencies:
   - id: azure.ai.inspector
     version: "~1.0.0-beta.1"

cli/azd/extensions/azure.ai.agents/go.mod

@@ -12,8 +12,9 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerregistry/armcontainerregistry v1.3.0-beta.3
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0
-	github.com/azure/azure-dev/cli/azd v1.28.0
+	github.com/azure/azure-dev/cli/azd v1.32.0-beta.1
 	github.com/braydonk/yaml v0.9.0
+	github.com/distribution/reference v0.6.0
 	github.com/drone/envsubst v1.0.3 // indirect
 	github.com/fatih/color v1.18.0
 	github.com/google/uuid v1.6.0
@@ -96,6 +97,7 @@ require (
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/nathan-fiscaletti/consolesize-go v0.0.0-20220204101620-317176b6684d // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect

cli/azd/extensions/azure.ai.agents/go.sum

@@ -115,6 +115,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denormal/go-gitignore v0.0.0-20180930084346-ae8ad1d07817 h1:0nsrg//Dc7xC74H/TZ5sYR8uk4UQRNjsw8zejqH5a4Q=
 github.com/denormal/go-gitignore v0.0.0-20180930084346-ae8ad1d07817/go.mod h1:C/+sI4IFnEpCn6VQ3GIPEp+FrQnQw+YQP3+n+GdGq7o=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/drone/envsubst v1.0.3 h1:PCIBwNDYjs50AsLZPYdfhSATKaRg/FJmDc2D6+C2x8g=
@@ -205,6 +207,8 @@ github.com/nathan-fiscaletti/consolesize-go v0.0.0-20220204101620-317176b6684d/g
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

cli/azd/extensions/azure.ai.agents/internal/cmd/helpers.go

@@ -477,7 +477,7 @@ func resolveConversationID(
 // setACREnvVar sets the AZD_AGENT_SKIP_ACR environment variable based on whether ACR
 // should be skipped. ACR is skipped when:
 // - Code deploy mode (no container registry needed)
-// - Pre-built image provided via --image flag (user manages their own registry)
+// - Pre-built image provided by a flag, manifest, or detected source definition
 //
 // This env var is consumed by the Bicep template in Azure-Samples/azd-ai-starter-basic
 // (infra/main.bicep) as `param skipAcr bool` to conditionally skip ACR resource creation.

cli/azd/extensions/azure.ai.agents/internal/cmd/hosted_container_config.go

@@ -0,0 +1,40 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package cmd
+
+import (
+	"strings"
+
+	"github.com/azure/azure-dev/cli/azd/pkg/azdext"
+)
+
+type hostedContainerDockerConfig struct {
+	imagePassthrough bool
+	remoteBuild      bool
+}
+
+func resolveHostedContainerDockerConfig(image string, networkInjected bool) hostedContainerDockerConfig {
+	if strings.TrimSpace(image) != "" {
+		return hostedContainerDockerConfig{imagePassthrough: true}
+	}
+
+	return hostedContainerDockerConfig{remoteBuild: !networkInjected}
+}
+
+func dockerProjectOptionsForHostedContainer(image string, networkInjected bool) *azdext.DockerProjectOptions {
+	config := resolveHostedContainerDockerConfig(image, networkInjected)
+	options := &azdext.DockerProjectOptions{RemoteBuild: config.remoteBuild}
+	if config.imagePassthrough {
+		options.ImagePassthrough = true
+	}
+	return options
+}
+
+func dockerProjectMapForHostedContainer(image string, networkInjected bool) map[string]any {
+	config := resolveHostedContainerDockerConfig(image, networkInjected)
+	if config.imagePassthrough {
+		return map[string]any{"imagePassthrough": true}
+	}
+	return map[string]any{"remoteBuild": config.remoteBuild}
+}

cli/azd/extensions/azure.ai.agents/internal/cmd/hosted_container_config_test.go

@@ -0,0 +1,52 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDockerProjectOptionsForHostedContainer(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name            string
+		image           string
+		networkInjected bool
+		wantPassthrough bool
+		wantRemoteBuild bool
+	}{
+		{name: "source build", wantRemoteBuild: true},
+		{name: "network injected source build", networkInjected: true},
+		{name: "pre-built image", image: "registry.example.com/team/agent:v1", wantPassthrough: true},
+		{
+			name:            "network injected pre-built image",
+			image:           "registry.example.com/team/agent:v1",
+			networkInjected: true,
+			wantPassthrough: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			options := dockerProjectOptionsForHostedContainer(test.image, test.networkInjected)
+			require.Equal(t, test.wantPassthrough, options.GetImagePassthrough())
+			require.Equal(t, test.wantRemoteBuild, options.GetRemoteBuild())
+		})
+	}
+}
+
+func TestDockerProjectMapForHostedContainer(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, map[string]any{"imagePassthrough": true},
+		dockerProjectMapForHostedContainer("registry.example.com/team/agent:v1", false))
+	require.Equal(t, map[string]any{"remoteBuild": true},
+		dockerProjectMapForHostedContainer("", false))
+	require.Equal(t, map[string]any{"remoteBuild": false},
+		dockerProjectMapForHostedContainer("", true))
+}