fix: migrate RLE extension to use environment instance APIs

[farhann1]

Fixes #9425

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Migrates the RLE extension to refreshed environment-instance APIs and improves invocation, state compatibility, authentication, and guidance.

Changes:

• Replaces legacy sandbox APIs with instance groups and instances.
• Adds cursor pagination, direct lookup, authenticated runtime access, and URL validation.
• Updates persisted state, command guidance, metadata, documentation, and tests.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
version.txt	Bumps preview version.
README.md	Documents new APIs and invocation lifecycle.
internal/project/runtime.go	Adds per-request runtime authorization.
internal/project/runtime_test.go	Tests refreshed authorization.
internal/cmd/state.go	Migrates state to environmentName.
internal/cmd/state_test.go	Tests state compatibility.
internal/cmd/show.go	Uses saved endpoints and cursor pagination.
internal/cmd/run.go	Uses renamed state field.
internal/cmd/root_test.go	Tests initialization guidance.
internal/cmd/publish.go	Uses renamed state field.
internal/cmd/list.go	Implements cursor pagination.
internal/cmd/list_test.go	Updates list/show API tests.
internal/cmd/invoke.go	Implements instance lifecycle and authenticated proxying.
internal/cmd/invoke_test.go	Tests invocation, cleanup, routing, and validation.
internal/cmd/init.go	Adds platform-aware next steps.
internal/cmd/environment_lookup.go	Adds direct environment lookup.
internal/cmd/client.go	Implements refreshed control-plane contracts.
internal/cmd/client_test.go	Tests new client routes.
extension.yaml	Updates metadata and optional arguments.
CHANGELOG.md	Records the preview release changes.

Suppressed comments (1)

cli/azd/extensions/azure.ai.rle/internal/cmd/invoke.go:305

• [azd-code-reviewer] The group response version is used unconditionally. For saved state or --version, a response containing a different version silently switches the instance route away from the authoritative requested version. Reject this mismatch before creating the instance; the returned runtime will still be cleaned up.

	if strings.TrimSpace(group.EnvironmentVersion) == "" {
		return runtime, &azdext.LocalError{
			Message:    "Control plane did not return the resolved environment version.",
			Code:       "rle_instance_group_version_missing",
			Category:   azdext.LocalErrorCategoryInternal,
			Suggestion: "Check the RLE control plane instance group response, then retry.",
		}
	}

	instance, err := client.createInstance(ctx, state.EnvironmentName, group.EnvironmentVersion, group.Id)

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag Rick Winter (@RickWinter) and Kristen Womack (@kristenwomack) to let us know.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated no new comments.

Suppressed comments (5)

cli/azd/extensions/azure.ai.rle/internal/cmd/init.go:99

• azd-code-reviewer: The goos != "windows" short-circuit forces export syntax for every Linux/macOS session, including PowerShell (pwsh). That contradicts the shell-aware guidance requirement. Choose syntax from the detected shell first, using the OS only when no shell can be identified, and add a non-Windows PowerShell case.

	if goos != "windows" || isPOSIXShellExecutable(shell) {

cli/azd/extensions/azure.ai.rle/internal/cmd/invoke.go:231

• azd-code-reviewer: Explicit --version invocation still calls requireReadyEnvironment immediately above this block, so a pending image returns rle_disk_image_not_ready before instance-group creation. The new EnvironmentNotReady retry loop is therefore bypassed for explicit versions, despite the stated behavior that a selected image being prepared should retry group creation. Keep this GET for not-found/identity validation, but let group creation own readiness retries.

	if responseName := strings.TrimSpace(versionedEnvironment.Name); responseName != "" && responseName != environmentName {

cli/azd/extensions/azure.ai.rle/internal/cmd/invoke.go:331

• azd-code-reviewer: Only the returned version is validated here. If an explicit invocation receives an instance group whose non-empty EnvironmentName differs from state.EnvironmentName, the mismatch is ignored and subsequent create/cleanup calls use the requested-name route. The requirement says explicit name/version mismatches must be rejected; validate the group environment name before creating the instance.

	if requestedVersion := strings.TrimSpace(state.runtimeRouteVersion); requestedVersion != "" &&
		group.EnvironmentVersion != requestedVersion {

cli/azd/extensions/azure.ai.rle/internal/cmd/invoke.go:521

• The linked issue specifies the success text as “Resources provisioned for the remote test were cleaned up successfully.” This different message leaves that acceptance item unmet.

	_, _ = fmt.Fprintln(writer, "Remote runtime resources cleaned up successfully.")

cli/azd/extensions/azure.ai.rle/internal/cmd/invoke.go:734

• azd-code-reviewer: This validation accepts only the exact Foundry project origin, so it rejects hyena.infra.ai.azure.com and true subdomains such as rle.westus2.hyena.infra.ai.azure.com. Those hosts are explicitly required to be accepted while suffix-lookalikes remain rejected. Extend the HTTPS/no-port/no-userinfo allowlist for the exact Hyena host and .<host> suffix, then align the currently contradictory test and README.

	isTrustedProjectOrigin := strings.EqualFold(sandbox.Scheme, "https") &&
		sandbox.Port() == "" &&
		strings.EqualFold(sandbox.Scheme, projectUrl.Scheme) &&
		strings.EqualFold(sandbox.Host, projectUrl.Host)
	if sandbox.User != nil || !isTrustedProjectOrigin {

[azure-sdk-automation]

azure.ai.rle PR build

Note

This is an unsigned development build. Install it only if you trust this PR.

Install the extension:

azd ext install "https://azuresdkartifacts.z5.web.core.windows.net/azd/extensions/pr/9618/azure-ai-rle.zip"

• Version: 0.4.0-preview.pr.9618.6720011
• Merge commit: 79ef234