From 6343cfa01a0e268f030e9ed59d9aba0d50c94945 Mon Sep 17 00:00:00 2001 From: Paul Lizer Date: Wed, 19 Aug 2026 16:42:23 -0400 Subject: [PATCH] Stage D part 5: AI Models and Agents & Actions The last two catch-all tabs. Both needed modal surgery rather than plain card moves, which is why they were held back. AI Models Model Endpoints multi-endpoint-configuration, and the legacy model settings modal that holds the Chat Model card and is opened from it Embeddings embeddings-configuration Image Generation image-generation-configuration Agents & Actions Agents agents-configuration, agent-template-approvals-section Actions document-action-capabilities-card, actions-configuration Inbound MCP inbound-mcp-configuration and its three dialogs Navigation is now 14 groups / 40 tabs / 88 sections. Three splitting problems, and how each was solved gpt-configuration is not a top-level card. It lives inside legacyModelSettingsModal. The modal was relocated to sit directly after multi-endpoint-configuration, the card holding its trigger, and both were then assigned to the same tab so the modal's opening lines, the nested card and the closing lines landed together and it reassembled intact. legacyModelDiscoveryIdentityGuideModal is opened from endpoints, embeddings and image generation, which now sit in three different tabs, so it could only ever have opened from one of them. It moved to the shell, outside every pane. Checked first that it carries no name= attribute, since moving a field outside the form would change the save payload. It carries none. The inbound MCP block is a {% if mcp_ui_enabled %} conditional spanning a card and three modals. It was lifted out whole into its own pane rather than split. Tab-level conditions The nav map now supports condition on a tab, not just a section, so a tab whose entire pane is behind a feature flag disappears instead of rendering empty. Both renderers honour it. Verified: 40 tabs with mcp_ui_enabled, 39 without. Also removed seven dangling section comments left at the tail of panes, each labelling a card that had moved to another tab. Two location tests asserted document order that only meant something while everything shared one tab. They now assert the real invariant: the embeddings and image cards are not inside the legacy modal, and the document action card leads the tab it actually lives in. Verified field contract 462 names / 110 card ids, unchanged regression set 32 failures, identical to baseline jinja compile 42/42 admin templates xss sinks pass modal placement all modals reachable, all ids unique Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- application/single_app/admin_settings_nav.py | 46 +- application/single_app/config.py | 2 +- .../static/js/admin/admin_sidebar_nav.js | 1 + .../single_app/templates/_sidebar_nav.html | 4 + .../templates/admin/_panes/actions.html | 205 +++++ .../templates/admin/_panes/agents.html | 738 ------------------ .../admin/_panes/chat-experience.html | 2 - .../admin/_panes/classification.html | 2 - .../templates/admin/_panes/cosmos.html | 2 - .../templates/admin/_panes/embeddings.html | 148 ++++ .../admin/_panes/image-generation.html | 165 ++++ .../templates/admin/_panes/inbound-mcp.html | 535 +++++++++++++ .../{ai-models.html => model-endpoints.html} | 394 +--------- .../templates/admin/_panes/retention.html | 2 - .../single_app/templates/admin_settings.html | 87 ++- .../ADMIN_SETTINGS_IA_REWORK_STATUS.md | 41 +- docs/explanation/release_notes.md | 25 + ...n_document_action_capabilities_location.py | 16 +- ..._ai_models_tab_embedding_image_location.py | 37 +- 19 files changed, 1285 insertions(+), 1167 deletions(-) create mode 100644 application/single_app/templates/admin/_panes/actions.html create mode 100644 application/single_app/templates/admin/_panes/embeddings.html create mode 100644 application/single_app/templates/admin/_panes/image-generation.html create mode 100644 application/single_app/templates/admin/_panes/inbound-mcp.html rename application/single_app/templates/admin/_panes/{ai-models.html => model-endpoints.html} (53%) diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py index b5c8b5e6f..48026e3ea 100644 --- a/application/single_app/admin_settings_nav.py +++ b/application/single_app/admin_settings_nav.py @@ -94,14 +94,31 @@ "icon": "bi-cpu", "tabs": [ { - "id": "ai-models", - "label": "AI Models", - "icon": "bi-cpu", + # The Chat Model card is reached through the legacy model + # settings dialog opened from here, so it is listed with the + # endpoints rather than as a tab of its own. + "id": "model-endpoints", + "label": "Model Endpoints", + "icon": "bi-hdd-network", "sections": [ {"id": "multi-endpoint-configuration", "label": "Model Endpoints", "icon": "bi-hdd-network"}, + {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"}, + ], + }, + { + "id": "embeddings", + "label": "Embeddings", + "icon": "bi-vector-pen", + "sections": [ {"id": "embeddings-config", "label": "Embeddings", "icon": "bi-vector-pen"}, + ], + }, + { + "id": "image-generation", + "label": "Image Generation", + "icon": "bi-image", + "sections": [ {"id": "image-config", "label": "Image Generation", "icon": "bi-image"}, - {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"}, ], }, ], @@ -113,13 +130,30 @@ "tabs": [ { "id": "agents", - "label": "Agents and Actions", + "label": "Agents", "icon": "bi-robot", "sections": [ - {"id": "document-action-capabilities-card", "label": "Document Action Capabilities", "icon": "bi-files"}, {"id": "agents-config", "label": "Agents Configuration", "icon": "bi-robot"}, {"id": "agent-template-approvals-section", "label": "Agent Template Approvals", "icon": "bi-layers", "condition": "enable_agent_template_gallery"}, + ], + }, + { + "id": "actions", + "label": "Actions", + "icon": "bi-plugin", + "sections": [ + {"id": "document-action-capabilities-card", "label": "Document Action Capabilities", "icon": "bi-files"}, {"id": "actions-config", "label": "Actions Configuration", "icon": "bi-plugin"}, + ], + }, + { + # The whole tab is behind mcp_ui_enabled, so the tab carries the + # condition rather than the single section inside it. + "id": "inbound-mcp", + "label": "Inbound MCP", + "icon": "bi-diagram-3", + "condition": "mcp_ui_enabled", + "sections": [ {"id": "inbound-mcp-configuration", "label": "Inbound MCP", "icon": "bi-diagram-3", "condition": "mcp_ui_enabled"}, ], }, diff --git a/application/single_app/config.py b/application/single_app/config.py index 992744396..27e50b825 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -96,7 +96,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.260.014" +VERSION = "0.260.015" IS_DEVELOPMENT = is_development_env_enabled() SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax') diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js index 7e9538f73..1bf0e5e53 100644 --- a/application/single_app/static/js/admin/admin_sidebar_nav.js +++ b/application/single_app/static/js/admin/admin_sidebar_nav.js @@ -296,6 +296,7 @@ const LEGACY_TAB_REDIRECTS = { 'security': 'secrets', 'workspaces': 'workspace-types', 'search-extract': 'web-research', + 'ai-models': 'model-endpoints', }; function resolveAdminTabId(tabId) { diff --git a/application/single_app/templates/_sidebar_nav.html b/application/single_app/templates/_sidebar_nav.html index 9c1cf3b79..8c2880678 100644 --- a/application/single_app/templates/_sidebar_nav.html +++ b/application/single_app/templates/_sidebar_nav.html @@ -517,6 +517,9 @@ {% endif %} {% else %} + {% if not admin_tab.condition + or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery) + or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
  • {{ admin_tab.label }} @@ -538,6 +541,7 @@ {% endif %}
    • {% endif %} + {% endif %} {% endfor %} diff --git a/application/single_app/templates/admin/_panes/actions.html b/application/single_app/templates/admin/_panes/actions.html new file mode 100644 index 000000000..221cfac5b --- /dev/null +++ b/application/single_app/templates/admin/_panes/actions.html @@ -0,0 +1,205 @@ +
    +
    +
    +
    +
    Document Action Capabilities
    +

    Configure the document actions shown in the Action dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.

    +
    + Chat: 2-300 | Workflow: 2-1000 +
    + +
    +
    +
    +
    + + + +
    +
    +
    + + {{ analyze_capability.chat_max_documents }} +
    +
    +
    + +
    +
    + +
    +
    +
    + 2 + 300 +
    +
    +
    +
    + + {{ analyze_capability.workflow_max_documents }} +
    +
    +
    + +
    +
    + +
    +
    +
    + 2 + 1000 +
    +
    +
    +
    +
    +
    +
    + + + +
    +
    +
    + + {{ comparison_capability.chat_max_documents }} +
    +
    +
    + +
    +
    + +
    +
    +
    + 2 + 300 +
    +
    +
    +
    + + {{ comparison_capability.workflow_max_documents }} +
    +
    +
    + +
    +
    + +
    +
    +
    + 2 + 1000 +
    +
    +
    +
    +
    +
    + + +
    +
    + Global Actions Configuration +
    +

    + Configure custom actions and tools to extend functionality with integrations and specialized capabilities. +

    + + {% if not settings.enable_semantic_kernel %} +
    + Actions are not available while agents are disabled. Enable agents above to configure actions. +
    + {% else %} +
    +
    +
    Global Actions
    + +
    +

    Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.

    + {% if settings.per_user_semantic_kernel %} + +
    +
    Workspace Action Feature Toggles
    +
    + + + + +
    +
    + + + + +
    +
    + {% endif %} + + +
    +
    Core Action Toggles
    +
    + + + +
    +
    + + + +
    +
    + + + +
    +
    + + + +
    +
    + + + +
    +
    + + + +
    +
    + + + +
    +
    +
    + Tabular Processing Action + +
    + Automatically enabled when Enhanced Citations is enabled +
    +
    + + + + + + + + + +
    Display NameDescriptionActions
    +
    + {% endif %} +
    +
    diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html index 622dde43d..889caa9cc 100644 --- a/application/single_app/templates/admin/_panes/agents.html +++ b/application/single_app/templates/admin/_panes/agents.html @@ -23,112 +23,6 @@ {% set analyze_capability = settings.document_action_capabilities.analyze %} {% set comparison_capability = settings.document_action_capabilities.comparison %} -
    -
    -
    -
    Document Action Capabilities
    -

    Configure the document actions shown in the Action dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.

    -
    - Chat: 2-300 | Workflow: 2-1000 -
    - -
    -
    -
    -
    - - - -
    -
    -
    - - {{ analyze_capability.chat_max_documents }} -
    -
    -
    - -
    -
    - -
    -
    -
    - 2 - 300 -
    -
    -
    -
    - - {{ analyze_capability.workflow_max_documents }} -
    -
    -
    - -
    -
    - -
    -
    -
    - 2 - 1000 -
    -
    -
    -
    -
    -
    -
    - - - -
    -
    -
    - - {{ comparison_capability.chat_max_documents }} -
    -
    -
    - -
    -
    - -
    -
    -
    - 2 - 300 -
    -
    -
    -
    - - {{ comparison_capability.workflow_max_documents }} -
    -
    -
    - -
    -
    - -
    -
    -
    - 2 - 1000 -
    -
    -
    -
    -
    -
    - -
    Agents Configuration @@ -386,636 +280,4 @@
    {% endif %} - - -
    -
    - Global Actions Configuration -
    -

    - Configure custom actions and tools to extend functionality with integrations and specialized capabilities. -

    - - {% if not settings.enable_semantic_kernel %} -
    - Actions are not available while agents are disabled. Enable agents above to configure actions. -
    - {% else %} -
    -
    -
    Global Actions
    - -
    -

    Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.

    - {% if settings.per_user_semantic_kernel %} - -
    -
    Workspace Action Feature Toggles
    -
    - - - - -
    -
    - - - - -
    -
    - {% endif %} - - -
    -
    Core Action Toggles
    -
    - - - -
    -
    - - - -
    -
    - - - -
    -
    - - - -
    -
    - - - -
    -
    - - - -
    -
    - - - -
    -
    -
    - Tabular Processing Action - -
    - Automatically enabled when Enhanced Citations is enabled -
    -
    - - - - - - - - - -
    Display NameDescriptionActions
    -
    - {% endif %} -
    - {% if mcp_ui_enabled %} -
    -
    -
    -
    - Inbound MCP Server -
    -

    - Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request. -

    -
    -
    - Preview - -
    -
    - - - -
    -
    -
    -
    Runtime Gate
    -
    - - - -
    -
    - - -
    Default: DelegatedMcpServerAccess. VS Code and other user clients must present this delegated scope.
    -
    -
    - - -
    Default: InboundMCPUserAccess. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.
    -
    -
    - - -
    Default: InboundMCPAppAccess. Reserved for future app-only MCP tools and still governed separately.
    -
    -
    -
    - -
    -
    -
    Endpoint Contract
    -
    -
    MCP endpoint
    -
    {{ inbound_mcp_resource_path }}
    -
    Protected resource metadata
    -
    {{ inbound_mcp_prm_path }}
    -
    Transport
    -
    Streamable HTTP JSON-RPC
    -
    Current tool surface
    -
    Personal delegated tools only.
    -
    Tool identity
    -
    Delegated user token required for personal data.
    -
    - -
    -
    - -
    -
    -
    -
    -
    Request Size & Throttling
    -
    Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.
    -
    -
    - - -
    -
    -
    -
    - - -
    Default: 65536. Range: 1 KB to 1 MB.
    -
    -
    - - -
    Default: 60. Applies to each throttle category.
    -
    -
    - - -
    Default: 120.
    -
    -
    - - -
    Default: 30.
    -
    -
    - - -
    Default: 10.
    -
    -
    - -
    -
    - -
    - - - -
    - -
    -
    -
    -
    -
    Allowed client app IDs
    -
    Required allowlist. Empty means no MCP clients can connect.
    -
    - -
    -
    - - - - - - - - - -
    Client app IDDescriptionActions
    -
    -
    -
    -
    - -
    -
    -
    - - -
    -
    - Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants. -
    -
    -
    -
    Allowed tenant IDs
    - -
    -
    - - - - - - - - - -
    Tenant IDDescriptionActions
    -
    -
    -
    -
    -
    - -
    -
    -
    - - -
    -
    - Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned. -
    -
    - - -
    Default: X-SimpleChat-MCP-Source.
    -
    - - - -
    -
    -
    Allowed source IDs
    - -
    -
    - - - - - - - - - -
    Source valueDescriptionActions
    -
    -
    -
    -
    -
    -
    -
    - - - - {% endif %} diff --git a/application/single_app/templates/admin/_panes/chat-experience.html b/application/single_app/templates/admin/_panes/chat-experience.html index 37d8033a6..be9826832 100644 --- a/application/single_app/templates/admin/_panes/chat-experience.html +++ b/application/single_app/templates/admin/_panes/chat-experience.html @@ -97,6 +97,4 @@
    - - \ No newline at end of file diff --git a/application/single_app/templates/admin/_panes/classification.html b/application/single_app/templates/admin/_panes/classification.html index 425eeedcf..8a4dc6e11 100644 --- a/application/single_app/templates/admin/_panes/classification.html +++ b/application/single_app/templates/admin/_panes/classification.html @@ -42,6 +42,4 @@
    Classification Categories
    - - \ No newline at end of file diff --git a/application/single_app/templates/admin/_panes/cosmos.html b/application/single_app/templates/admin/_panes/cosmos.html index 33cf6b0f3..6163be982 100644 --- a/application/single_app/templates/admin/_panes/cosmos.html +++ b/application/single_app/templates/admin/_panes/cosmos.html @@ -1138,6 +1138,4 @@
    Default Retention PoliciesImportant: Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions. - - \ No newline at end of file diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html index 0d1d9e4b1..a34e450cf 100644 --- a/application/single_app/templates/admin_settings.html +++ b/application/single_app/templates/admin_settings.html @@ -953,6 +953,9 @@

    12. Enhanced Citations and Image Generation

    {% set group_is_first = loop.first %} {% for admin_tab in admin_group.tabs %} {% set is_default_tab = group_is_first and loop.first %} + {% if not admin_tab.condition + or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery) + or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %} + {% endif %} {% endfor %} {% endfor %} @@ -987,6 +991,8 @@

    12. Enhanced Citations and Image Generation

    {% include "admin/_panes/agents.html" %} + {% include "admin/_panes/actions.html" %} + {% include "admin/_panes/inbound-mcp.html" %} @@ -1003,7 +1009,9 @@

    12. Enhanced Citations and Image Generation

    {% include "admin/_panes/custom-pages.html" %} - {% include "admin/_panes/ai-models.html" %} + {% include "admin/_panes/model-endpoints.html" %} + {% include "admin/_panes/embeddings.html" %} + {% include "admin/_panes/image-generation.html" %} {% include "admin/_panes/control-center-config.html" %} @@ -1088,6 +1096,83 @@