From 9da958b5623ebcd511f1704ff12937f191c06e47 Mon Sep 17 00:00:00 2001
From: Yimin Jin <yiminjin@microsoft.com>
Date: Tue, 2 Jun 2026 10:52:22 +0800
Subject: [PATCH 1/6] ci(catalog): default commit_sha to latest
 foundry-samples@main

Make the workflow_dispatch `commit_sha` input optional. When the user leaves it blank, a new `Resolve commit SHA` step queries the GitHub API for the current tip of `microsoft-foundry/foundry-samples@main` and pins the catalog generation to that SHA.

- `commit_sha`: required=false, default empty.

- New step uses `gh api` (default GITHUB_TOKEN, contents:read is enough for a public repo) and validates the result looks like a SHA before using it.

- The pinned SHA + its source (user input vs. resolved-from-main) is echoed to the step summary so reviewers can see what the run targeted.

- `Generate sample catalog` now reads from `steps.resolve-sha.outputs.sha` instead of `inputs.commit_sha` directly.
---
 .github/workflows/sync-sample-catalog.yml | 32 ++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/sync-sample-catalog.yml b/.github/workflows/sync-sample-catalog.yml
index 3fecaaf..0055a41 100644
--- a/.github/workflows/sync-sample-catalog.yml
+++ b/.github/workflows/sync-sample-catalog.yml
@@ -4,9 +4,10 @@ on:
   workflow_dispatch:
     inputs:
       commit_sha:
-        description: "Commit SHA from microsoft-foundry/foundry-samples to pin to"
-        required: true
+        description: "Commit SHA from microsoft-foundry/foundry-samples to pin to (leave blank to use the latest main commit)"
+        required: false
         type: string
+        default: ""
 
 # Least-privilege for the default GITHUB_TOKEN: only what `actions/checkout`
 # needs. All writes (push branch + create PR) are performed via the GitHub
@@ -47,6 +48,31 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Resolve commit SHA
+        id: resolve-sha
+        shell: bash
+        env:
+          INPUT_SHA: ${{ inputs.commit_sha }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if [[ -n "$INPUT_SHA" ]]; then
+            sha="$INPUT_SHA"
+            source="user-supplied input"
+          else
+            # No SHA provided: pin to the current tip of foundry-samples@main
+            # so the dispatcher doesn't have to look it up by hand.
+            sha=$(gh api repos/microsoft-foundry/foundry-samples/commits/main --jq .sha)
+            source="latest microsoft-foundry/foundry-samples@main"
+          fi
+          if [[ ! "$sha" =~ ^[0-9a-f]{7,40}$ ]]; then
+            echo "Resolved SHA is not a valid git object: $sha" >&2
+            exit 1
+          fi
+          echo "Using SHA $sha (source: $source)"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "- Pinned SHA: \`$sha\` ($source)" >> "$GITHUB_STEP_SUMMARY"
+
       - name: Generate sample catalog
         env:
           REPO_ROOT: ${{ github.workspace }}
@@ -54,7 +80,7 @@ jobs:
           AZURE_OPENAI_ENDPOINT: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
           AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
           AZURE_OPENAI_DEPLOYMENT: ${{ secrets.AZURE_OPENAI_DEPLOYMENT }}
-        run: node .github/scripts/generate_sample_catalog.mjs "${{ inputs.commit_sha }}"
+        run: node .github/scripts/generate_sample_catalog.mjs "${{ steps.resolve-sha.outputs.sha }}"
 
       - name: Detect catalog changes
         id: diff

From 525e3dca2e893306c44ebb4fc9c3770afc2e7f71 Mon Sep 17 00:00:00 2001
From: Yimin-Jin <139844715+Yimin-Jin@users.noreply.github.com>
Date: Tue, 16 Jun 2026 07:29:53 +0000
Subject: [PATCH 2/6] ci: sync sample catalog from foundry-samples
 (template/dev)

---
 samples/hosted-agent/sample-catalog.json | 103 ++++++++++++++++++-----
 1 file changed, 83 insertions(+), 20 deletions(-)

diff --git a/samples/hosted-agent/sample-catalog.json b/samples/hosted-agent/sample-catalog.json
index 62af205..7908c20 100644
--- a/samples/hosted-agent/sample-catalog.json
+++ b/samples/hosted-agent/sample-catalog.json
@@ -1,7 +1,7 @@
 {
-    "commitSha": "ef510c47b3ec768596577ba65ca6b2c2ab015855",
+    "commitSha": "d3bb92638f131ce0fff1fe67862130d5b190383f",
     "repo": "https://github.com/microsoft-foundry/foundry-samples/",
-    "generatedAt": "2026-06-01T10:21:01Z",
+    "generatedAt": "2026-06-16T07:29:52Z",
     "dimensions": {
         "language": {
             "title": "Select a Language",
@@ -158,15 +158,6 @@
             "path": "samples/python/hosted-agents/agent-framework/responses/09-declarative-customer-support",
             "requiresModel": true
         },
-        {
-            "language": "python",
-            "framework": "agent-framework",
-            "protocol": "responses",
-            "displayName": "Downstream Azure",
-            "description": "Agent performs data operations on Blob Storage and Service Bus using its own identity.",
-            "path": "samples/python/hosted-agents/agent-framework/responses/10-downstream-azure",
-            "requiresModel": true
-        },
         {
             "language": "python",
             "framework": "agent-framework",
@@ -203,6 +194,15 @@
             "path": "samples/python/hosted-agents/agent-framework/responses/14-browser-automation-agent",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Optimization Travel Approver",
+            "description": "Approves or rejects travel requests based on provided details and approval criteria.",
+            "path": "samples/python/hosted-agents/agent-framework/responses/15-optimization-travel-approver",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "bring-your-own",
@@ -221,15 +221,6 @@
             "path": "samples/python/hosted-agents/bring-your-own/invocations/claude-agent-sdk",
             "requiresModel": false
         },
-        {
-            "language": "python",
-            "framework": "bring-your-own",
-            "protocol": "invocations",
-            "displayName": "Event Grid Trigger",
-            "description": "Agent triggered by Azure Storage events that summarizes uploaded blobs and saves results separately.",
-            "path": "samples/python/hosted-agents/bring-your-own/invocations/event-grid-trigger",
-            "requiresModel": true
-        },
         {
             "language": "python",
             "framework": "copilot-sdk",
@@ -374,6 +365,33 @@
             "path": "samples/python/hosted-agents/bring-your-own/responses/openai-agents-sdk",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "responses",
+            "displayName": "Optimization Customer Support",
+            "description": "Customer support agent for troubleshooting and product assistance.",
+            "path": "samples/python/hosted-agents/bring-your-own/responses/optimization-customer-support",
+            "requiresModel": true
+        },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "responses",
+            "displayName": "Optimization Hello World",
+            "description": "Minimal hosted agent that responds to greetings using a custom optimization service.",
+            "path": "samples/python/hosted-agents/bring-your-own/responses/optimization-hello-world",
+            "requiresModel": true
+        },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "responses",
+            "displayName": "Foreground Background Agents Responses Voicelive",
+            "description": "Agent architecture that delegates long-running tasks to a background worker for async results.",
+            "path": "samples/python/hosted-agents/bring-your-own/voicelive/foreground-background-agents-responses-voicelive",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "bring-your-own",
@@ -392,6 +410,15 @@
             "path": "samples/python/hosted-agents/bring-your-own/voicelive/hello-world-invocations-voicelive",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "invocations",
+            "displayName": "Hotel Booking Invocations Voicelive",
+            "description": "Hotel booking agent with voice and UI actions, streaming responses and session state.",
+            "path": "samples/python/hosted-agents/bring-your-own/voicelive/hotel-booking-invocations-voicelive",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "langgraph",
@@ -410,6 +437,15 @@
             "path": "samples/python/hosted-agents/langgraph/responses/01-langgraph-chat",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "langgraph",
+            "protocol": "responses",
+            "displayName": "Langgraph Toolbox",
+            "description": "Agent accesses web search and GitHub Copilot tools via a credential-managed toolbox.",
+            "path": "samples/python/hosted-agents/langgraph/responses/02-langgraph-toolbox",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "langgraph",
@@ -455,6 +491,24 @@
             "path": "samples/python/hosted-agents/langgraph/responses/08-observability",
             "requiresModel": true
         },
+        {
+            "language": "csharp",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Caller",
+            "description": "Concierge agent that delegates questions to a remote specialist and summarizes answers.",
+            "path": "samples/csharp/hosted-agents/agent-framework/a2a/01-delegation/caller",
+            "requiresModel": true
+        },
+        {
+            "language": "csharp",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Executor",
+            "description": "Answers arithmetic and math questions as an expert agent.",
+            "path": "samples/csharp/hosted-agents/agent-framework/a2a/01-delegation/executor",
+            "requiresModel": true
+        },
         {
             "language": "csharp",
             "framework": "agent-framework",
@@ -491,6 +545,15 @@
             "path": "samples/csharp/hosted-agents/agent-framework/foundry-memory-rag",
             "requiresModel": true
         },
+        {
+            "language": "csharp",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Foundry Toolbox MCP Skills",
+            "description": "Agent that dynamically discovers and uses skills from a remote toolbox endpoint.",
+            "path": "samples/csharp/hosted-agents/agent-framework/foundry-toolbox-mcp-skills",
+            "requiresModel": true
+        },
         {
             "language": "csharp",
             "framework": "agent-framework",

From d5eb860ef373e3bce3507dc16daa8ea259c1923a Mon Sep 17 00:00:00 2001
From: Yimin Jin <yiminjin@microsoft.com>
Date: Tue, 23 Jun 2026 16:54:58 +0800
Subject: [PATCH 3/6] ci(catalog): replace path blacklist with category
 allow-list

Switch sample discovery from a fail-open blacklist (BLOCKED_PATH_SEGMENTS) to a fail-closed category allow-list (ALLOWED_CATEGORY_SEGMENTS = responses, invocations, voicelive).

Flat templates directly under a framework (csharp agent-framework layout) are always kept; nested templates must live under an allow-listed category, so new upstream groupings like a2a and invocations_ws stay out of the picker until explicitly opted in.

Validated against foundry-samples@main: 76 templates kept; a2a and invocations_ws excluded; 4 voicelive and 17 flat csharp agent-framework templates retained.
---
 .github/scripts/generate_sample_catalog.mjs | 46 +++++++++++++++++----
 1 file changed, 38 insertions(+), 8 deletions(-)

diff --git a/.github/scripts/generate_sample_catalog.mjs b/.github/scripts/generate_sample_catalog.mjs
index ba6eb18..8be4433 100644
--- a/.github/scripts/generate_sample_catalog.mjs
+++ b/.github/scripts/generate_sample_catalog.mjs
@@ -77,10 +77,20 @@ const TEMPLATE_SELECTION = {
 // Path segments must be alphanumeric, hyphens, underscores, or dots
 const SAFE_PATH_SEGMENT = /^[a-zA-Z0-9._-]+$/;
 
-// Path segments that should never surface as catalog templates, even when
-// they contain a valid `agent.yaml`. Use this to drop upstream folders we
-// don't want in the picker yet (e.g. `invocations_ws` LiveKit samples).
-const BLOCKED_PATH_SEGMENTS = new Set(['invocations_ws']);
+// Category segments allowed at the position immediately under a framework
+// (`<framework>/<category>/...`). Upstream groups nested templates under these
+// folders. This is an ALLOW-LIST: any other category (e.g. `a2a`,
+// `invocations_ws`) is treated as not-yet-supported and dropped, so new
+// upstream folders never auto-leak into the picker — opt them in here. Flat
+// templates that sit directly under a framework (e.g. csharp
+// `agent-framework/hello-world`) have no category segment and are always
+// surfaced (see findTemplateDirsUnder).
+const ALLOWED_CATEGORY_SEGMENTS = new Set(['responses', 'invocations', 'voicelive']);
+
+// De-dupes the per-category "skipped" log line so an excluded category that
+// spans many templates (e.g. `a2a`) is reported once, not once per template.
+/** @type {Set<string>} */
+const skippedCategoriesLogged = new Set();
 
 /**
  * Collected anomaly messages surfaced in CI step summary so reviewers do not
@@ -192,6 +202,12 @@ async function fetchRepoTree(ref) {
  * `.`, e.g. `.claude/skills`) are skipped, as are segments that fail the
  * `SAFE_PATH_SEGMENT` check.
  *
+ * Nested templates must live under an allow-listed category segment
+ * (`ALLOWED_CATEGORY_SEGMENTS`); flat templates directly under the framework
+ * (csharp's `agent-framework/<template>` layout) have no category and are
+ * always kept. This fail-closed rule keeps unsupported upstream groupings
+ * (e.g. `a2a`, `invocations_ws`) out of the catalog until they are opted in.
+ *
  * @param {Array<{path: string, type: string}>} tree
  * @param {string} prefix Path prefix ending in `/`, e.g. `samples/python/hosted-agents/agent-framework/`.
  * @returns {string[]} Repo-relative template directory paths, outermost only.
@@ -209,10 +225,24 @@ function findTemplateDirsUnder(tree, prefix) {
             if (!segments.every((seg) => isSafePathSegment(seg))) {
                 return false;
             }
-            // Drop templates that live under a blocked segment (e.g.
-            // `invocations_ws`) so upstream additions don't auto-leak into
-            // the catalog before we explicitly opt them in.
-            return !segments.some((seg) => BLOCKED_PATH_SEGMENTS.has(seg));
+            // Flat templates sit directly under the framework
+            // (`<framework>/<template>`, e.g. csharp `agent-framework/hello-world`)
+            // and have no category segment — always surface them.
+            if (segments.length === 1) {
+                return true;
+            }
+            // Nested templates (`<framework>/<category>/...`) must live under an
+            // allow-listed category. Anything else (e.g. `a2a`, `invocations_ws`)
+            // is dropped so new upstream groupings don't auto-leak into the picker.
+            const category = segments[0];
+            if (ALLOWED_CATEGORY_SEGMENTS.has(category)) {
+                return true;
+            }
+            if (!skippedCategoriesLogged.has(category)) {
+                skippedCategoriesLogged.add(category);
+                console.log(`Skipping category "${category}" (not in ALLOWED_CATEGORY_SEGMENTS); e.g. ${dir}`);
+            }
+            return false;
         })
         // Lexicographic sort serves two purposes: (1) a parent path always
         // sorts before its descendants, so the `startsWith` check below

From 44ae669a3260739daee36817ab53624d188ab859 Mon Sep 17 00:00:00 2001
From: Yimin-Jin <139844715+Yimin-Jin@users.noreply.github.com>
Date: Tue, 23 Jun 2026 09:05:35 +0000
Subject: [PATCH 4/6] ci: sync sample catalog from foundry-samples
 (template/dev)

---
 samples/hosted-agent/sample-catalog.json | 76 +++++++++++++++++-------
 1 file changed, 56 insertions(+), 20 deletions(-)

diff --git a/samples/hosted-agent/sample-catalog.json b/samples/hosted-agent/sample-catalog.json
index 7908c20..4f956dd 100644
--- a/samples/hosted-agent/sample-catalog.json
+++ b/samples/hosted-agent/sample-catalog.json
@@ -1,7 +1,7 @@
 {
-    "commitSha": "d3bb92638f131ce0fff1fe67862130d5b190383f",
+    "commitSha": "ae60814c3ef01078f43619c27249e914d5de5fb6",
     "repo": "https://github.com/microsoft-foundry/foundry-samples/",
-    "generatedAt": "2026-06-16T07:29:52Z",
+    "generatedAt": "2026-06-23T09:05:34Z",
     "dimensions": {
         "language": {
             "title": "Select a Language",
@@ -158,6 +158,15 @@
             "path": "samples/python/hosted-agents/agent-framework/responses/09-declarative-customer-support",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Downstream Azure",
+            "description": "Agent performs operations on Blob Storage and Service Bus using its own cloud identity.",
+            "path": "samples/python/hosted-agents/agent-framework/responses/10-downstream-azure",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "agent-framework",
@@ -203,6 +212,15 @@
             "path": "samples/python/hosted-agents/agent-framework/responses/15-optimization-travel-approver",
             "requiresModel": true
         },
+        {
+            "language": "python",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Content Safety Guardrail",
+            "description": "Agent that filters prompts and responses for harmful content using a safety policy.",
+            "path": "samples/python/hosted-agents/agent-framework/responses/16-content-safety-guardrail",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "bring-your-own",
@@ -221,6 +239,24 @@
             "path": "samples/python/hosted-agents/bring-your-own/invocations/claude-agent-sdk",
             "requiresModel": false
         },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "invocations",
+            "displayName": "Diagnostic Agent",
+            "description": "Performs network probes and returns a JSON report on hostname reachability.",
+            "path": "samples/python/hosted-agents/bring-your-own/invocations/diagnostic-agent",
+            "requiresModel": false
+        },
+        {
+            "language": "python",
+            "framework": "bring-your-own",
+            "protocol": "invocations",
+            "displayName": "Event Grid Trigger",
+            "description": "Processes new blobs in Azure Storage by summarizing their contents and saving results separately.",
+            "path": "samples/python/hosted-agents/bring-your-own/invocations/event-grid-trigger",
+            "requiresModel": true
+        },
         {
             "language": "python",
             "framework": "copilot-sdk",
@@ -491,24 +527,6 @@
             "path": "samples/python/hosted-agents/langgraph/responses/08-observability",
             "requiresModel": true
         },
-        {
-            "language": "csharp",
-            "framework": "agent-framework",
-            "protocol": "responses",
-            "displayName": "Caller",
-            "description": "Concierge agent that delegates questions to a remote specialist and summarizes answers.",
-            "path": "samples/csharp/hosted-agents/agent-framework/a2a/01-delegation/caller",
-            "requiresModel": true
-        },
-        {
-            "language": "csharp",
-            "framework": "agent-framework",
-            "protocol": "responses",
-            "displayName": "Executor",
-            "description": "Answers arithmetic and math questions as an expert agent.",
-            "path": "samples/csharp/hosted-agents/agent-framework/a2a/01-delegation/executor",
-            "requiresModel": true
-        },
         {
             "language": "csharp",
             "framework": "agent-framework",
@@ -527,6 +545,15 @@
             "path": "samples/csharp/hosted-agents/agent-framework/azure-search-rag",
             "requiresModel": true
         },
+        {
+            "language": "csharp",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Browser Automation",
+            "description": "Automates browsing, web scraping, and form filling in a remote Chromium browser.",
+            "path": "samples/csharp/hosted-agents/agent-framework/browser-automation",
+            "requiresModel": true
+        },
         {
             "language": "csharp",
             "framework": "agent-framework",
@@ -635,6 +662,15 @@
             "path": "samples/csharp/hosted-agents/agent-framework/text-search-rag",
             "requiresModel": true
         },
+        {
+            "language": "csharp",
+            "framework": "agent-framework",
+            "protocol": "responses",
+            "displayName": "Toolbox Auth Paths",
+            "description": "Agent toolbox demonstrates different authentication paths for accessing upstream tools.",
+            "path": "samples/csharp/hosted-agents/agent-framework/toolbox-auth-paths",
+            "requiresModel": true
+        },
         {
             "language": "csharp",
             "framework": "agent-framework",

From 9bfc62b0ad5b222a5f98b90cd12e8281c28f7087 Mon Sep 17 00:00:00 2001
From: Yimin Jin <yiminjin@microsoft.com>
Date: Wed, 1 Jul 2026 17:19:10 +0800
Subject: [PATCH 5/6] refactor(sample-catalog): discover languages/frameworks
 dynamically

Replace the hard-coded LANGUAGES/FRAMEWORKS allowlists and the responses/invocations protocol allowlist with dynamic discovery from the samples git tree, filtered through empty-by-default BLOCKED_LANGUAGES/BLOCKED_FRAMEWORKS/BLOCKED_PROTOCOLS blacklists.

New upstream languages, frameworks, and protocols are now picked up automatically; the blacklists remain an explicit opt-out. Security validation (isSafePathSegment, commit-SHA regex, hidden-dir blocking) is unchanged.
---
 .github/scripts/generate_sample_catalog.mjs | 84 +++++++++++++++++----
 1 file changed, 70 insertions(+), 14 deletions(-)

diff --git a/.github/scripts/generate_sample_catalog.mjs b/.github/scripts/generate_sample_catalog.mjs
index 8be4433..f1a8c9f 100644
--- a/.github/scripts/generate_sample_catalog.mjs
+++ b/.github/scripts/generate_sample_catalog.mjs
@@ -34,8 +34,17 @@ const OVERRIDES_PATH = join(REPO_ROOT, 'samples', 'hosted-agent', 'sample-overri
 
 const GITHUB_TOKEN = process.env.GITHUB_TOKEN || '';
 
-const LANGUAGES = ['python', 'csharp'];
-const FRAMEWORKS = ['agent-framework', 'bring-your-own', 'langgraph'];
+// Languages, frameworks, and protocols are discovered dynamically from the
+// samples repo tree (see discoverLanguagesAndFrameworks / parseAgentYaml)
+// instead of being restricted by an allowlist. These blacklists are the
+// explicit escape hatch to exclude a specific discovered value; empty by
+// default means "no restriction" — everything discovered is kept.
+/** @type {string[]} */
+const BLOCKED_LANGUAGES = [];
+/** @type {string[]} */
+const BLOCKED_FRAMEWORKS = [];
+/** @type {string[]} */
+const BLOCKED_PROTOCOLS = [];
 
 /** @type {Record<string, {title: string, placeholder: string, options: Record<string, string>}>} */
 const DIMENSION_DEFAULTS = {
@@ -193,6 +202,47 @@ async function fetchRepoTree(ref) {
     return { tree, truncated: Boolean(data?.truncated) };
 }
 
+/**
+ * Discover the languages and frameworks present in the samples repo tree,
+ * then drop any listed in the (empty by default) BLOCKED_LANGUAGES /
+ * BLOCKED_FRAMEWORKS blacklists. A "language" is the path segment directly
+ * under `samples/` that owns a `hosted-agents/` folder; a "framework" is the
+ * segment directly under `hosted-agents/`. Discovering these dynamically —
+ * instead of hard-coding an allowlist — means new upstream languages or
+ * frameworks are picked up automatically, while the blacklists remain an
+ * explicit way to exclude a specific value. Hidden or unsafe segments (those
+ * failing isSafePathSegment, e.g. `.github`) are ignored.
+ *
+ * @param {Array<{path: string, type: string}>} tree
+ * @returns {{ languages: string[], frameworks: string[] }}
+ */
+function discoverLanguagesAndFrameworks(tree) {
+    /** @type {Set<string>} */
+    const languages = new Set();
+    /** @type {Set<string>} */
+    const frameworks = new Set();
+    const pattern = /^samples\/([^/]+)\/hosted-agents\/([^/]+)(?:\/|$)/;
+
+    for (const entry of tree) {
+        const match = entry.path.match(pattern);
+        if (!match) {
+            continue;
+        }
+        const [, language, framework] = match;
+        if (isSafePathSegment(language) && !BLOCKED_LANGUAGES.includes(language)) {
+            languages.add(language);
+        }
+        if (isSafePathSegment(framework) && !BLOCKED_FRAMEWORKS.includes(framework)) {
+            frameworks.add(framework);
+        }
+    }
+
+    return {
+        languages: [...languages].sort(),
+        frameworks: [...frameworks].sort(),
+    };
+}
+
 /**
  * Find sample template directories under a `hosted-agents/<framework>/` prefix.
  * A template is identified by the presence of an `agent.yaml`. When nested
@@ -293,19 +343,21 @@ function inferProtocolFromPath(templatePath) {
  * Minimal parser for agent.yaml. Extracts the declared protocol(s) and
  * whether the sample exposes the AZURE_AI_MODEL_DEPLOYMENT_NAME env var
  * (used as a heuristic for `requiresModel`). Does NOT use eval or a real
- * YAML library — a regex-y scan is sufficient for our two fields.
+ * YAML library — a regex-y scan is sufficient for our two fields. Any
+ * declared protocol is accepted except those listed in BLOCKED_PROTOCOLS
+ * (empty by default).
  * @param {string} content
- * @returns {{ protocols: Array<'responses' | 'invocations'>, hasModelEnv: boolean }}
+ * @returns {{ protocols: string[], hasModelEnv: boolean }}
  */
 function parseAgentYaml(content) {
-    /** @type {{ protocols: Array<'responses' | 'invocations'>, hasModelEnv: boolean }} */
+    /** @type {{ protocols: string[], hasModelEnv: boolean }} */
     const result = { protocols: [], hasModelEnv: false };
 
     for (const line of content.split('\n')) {
         const stripped = line.trim();
         if (stripped.startsWith('- protocol:')) {
             const value = stripped.split(':')[1]?.trim();
-            if (value === 'responses' || value === 'invocations') {
+            if (value && !BLOCKED_PROTOCOLS.includes(value)) {
                 result.protocols.push(value);
             }
         }
@@ -321,7 +373,7 @@ function parseAgentYaml(content) {
  * Fetch and parse agent.yaml for a sample directory.
  * @param {string} samplePath
  * @param {string} ref
- * @returns {Promise<{ protocols: Array<'responses' | 'invocations'>, hasModelEnv: boolean } | null>}
+ * @returns {Promise<{ protocols: string[], hasModelEnv: boolean } | null>}
  */
 async function fetchAgentYaml(samplePath, ref) {
     const rawUrl = `https://raw.githubusercontent.com/microsoft-foundry/foundry-samples/${ref}/${samplePath}/agent.yaml`;
@@ -537,10 +589,12 @@ function displayNameFromPath(samplePath) {
  * Scan the foundry-samples repo and build the flat template list. Uses one
  * recursive git-tree call to enumerate every `agent.yaml` under each
  * `<language>/hosted-agents/<framework>/` prefix, regardless of intermediate
- * directories. This supports both the canonical layout
- * (`<framework>/<protocol>/<template>`), the flat layout
- * (`<framework>/<template>`), and category-grouped layouts such as
- * `bring-your-own/voicelive/hello-world-invocations-voicelive`.
+ * directories. Languages and frameworks are discovered dynamically from the
+ * tree (see discoverLanguagesAndFrameworks) rather than hard-coded, then
+ * filtered through the BLOCKED_LANGUAGES/BLOCKED_FRAMEWORKS blacklists. This
+ * supports both the canonical layout (`<framework>/<protocol>/<template>`),
+ * the flat layout (`<framework>/<template>`), and category-grouped layouts
+ * such as `bring-your-own/voicelive/hello-world-invocations-voicelive`.
  *
  * @param {string} commitSha
  * @returns {Promise<Array<{language: string, framework: string, protocol: string, displayName: string, description: string, path: string, requiresModel: boolean}>>}
@@ -554,8 +608,10 @@ async function scanTemplates(commitSha) {
         warn(`GitHub git-tree API returned truncated=true for ${commitSha}; some samples may be missing from the catalog. Consider pinning to a smaller subtree or re-running.`);
     }
 
-    for (const language of LANGUAGES) {
-        for (const framework of FRAMEWORKS) {
+    const { languages, frameworks } = discoverLanguagesAndFrameworks(tree);
+
+    for (const language of languages) {
+        for (const framework of frameworks) {
             const prefix = `samples/${language}/hosted-agents/${framework}/`;
             const templateDirs = findTemplateDirsUnder(tree, prefix);
 
@@ -566,7 +622,7 @@ async function scanTemplates(commitSha) {
                     continue;
                 }
 
-                /** @type {'responses' | 'invocations'} */
+                /** @type {string} */
                 const protocol = agentInfo.protocols.length > 0
                     ? agentInfo.protocols[0]
                     : inferProtocolFromPath(templatePath);

From d38231fbb44c2bdb0e4501c21e7f1dacabbc0d60 Mon Sep 17 00:00:00 2001
From: Yimin Jin <yiminjin@microsoft.com>
Date: Wed, 1 Jul 2026 17:26:48 +0800
Subject: [PATCH 6/6] refactor(sample-catalog): convert category allow-list to
 empty blacklist

Replace ALLOWED_CATEGORY_SEGMENTS (fail-closed allow-list) with an empty BLOCKED_CATEGORY_SEGMENTS (fail-open blacklist) so category filtering matches the language/framework/protocol blacklist model. Every discovered category now surfaces by default; add a segment to the blacklist to drop it.
---
 .github/scripts/generate_sample_catalog.mjs | 39 ++++++++++-----------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/.github/scripts/generate_sample_catalog.mjs b/.github/scripts/generate_sample_catalog.mjs
index f1a8c9f..28c9f40 100644
--- a/.github/scripts/generate_sample_catalog.mjs
+++ b/.github/scripts/generate_sample_catalog.mjs
@@ -86,18 +86,17 @@ const TEMPLATE_SELECTION = {
 // Path segments must be alphanumeric, hyphens, underscores, or dots
 const SAFE_PATH_SEGMENT = /^[a-zA-Z0-9._-]+$/;
 
-// Category segments allowed at the position immediately under a framework
-// (`<framework>/<category>/...`). Upstream groups nested templates under these
-// folders. This is an ALLOW-LIST: any other category (e.g. `a2a`,
-// `invocations_ws`) is treated as not-yet-supported and dropped, so new
-// upstream folders never auto-leak into the picker — opt them in here. Flat
-// templates that sit directly under a framework (e.g. csharp
-// `agent-framework/hello-world`) have no category segment and are always
-// surfaced (see findTemplateDirsUnder).
-const ALLOWED_CATEGORY_SEGMENTS = new Set(['responses', 'invocations', 'voicelive']);
+// Category segments to EXCLUDE at the position immediately under a framework
+// (`<framework>/<category>/...`). This is a BLACK-LIST: empty by default means
+// every discovered category is surfaced; add a segment here to drop an upstream
+// grouping you don't want in the picker yet. Flat templates that sit directly
+// under a framework (e.g. csharp `agent-framework/hello-world`) have no category
+// segment and are always surfaced (see findTemplateDirsUnder).
+/** @type {Set<string>} */
+const BLOCKED_CATEGORY_SEGMENTS = new Set();
 
 // De-dupes the per-category "skipped" log line so an excluded category that
-// spans many templates (e.g. `a2a`) is reported once, not once per template.
+// spans many templates is reported once, not once per template.
 /** @type {Set<string>} */
 const skippedCategoriesLogged = new Set();
 
@@ -252,11 +251,11 @@ function discoverLanguagesAndFrameworks(tree) {
  * `.`, e.g. `.claude/skills`) are skipped, as are segments that fail the
  * `SAFE_PATH_SEGMENT` check.
  *
- * Nested templates must live under an allow-listed category segment
- * (`ALLOWED_CATEGORY_SEGMENTS`); flat templates directly under the framework
- * (csharp's `agent-framework/<template>` layout) have no category and are
- * always kept. This fail-closed rule keeps unsupported upstream groupings
- * (e.g. `a2a`, `invocations_ws`) out of the catalog until they are opted in.
+ * Nested templates are kept unless their category segment is listed in
+ * `BLOCKED_CATEGORY_SEGMENTS` (empty by default, so everything is surfaced);
+ * flat templates directly under the framework (csharp's
+ * `agent-framework/<template>` layout) have no category and are always kept.
+ * Add a segment to the blacklist to drop an unwanted upstream grouping.
  *
  * @param {Array<{path: string, type: string}>} tree
  * @param {string} prefix Path prefix ending in `/`, e.g. `samples/python/hosted-agents/agent-framework/`.
@@ -281,16 +280,16 @@ function findTemplateDirsUnder(tree, prefix) {
             if (segments.length === 1) {
                 return true;
             }
-            // Nested templates (`<framework>/<category>/...`) must live under an
-            // allow-listed category. Anything else (e.g. `a2a`, `invocations_ws`)
-            // is dropped so new upstream groupings don't auto-leak into the picker.
+            // Nested templates (`<framework>/<category>/...`) are kept unless the
+            // category is explicitly blacklisted. Empty blacklist => everything is
+            // surfaced (fail-open), matching the language/framework/protocol lists.
             const category = segments[0];
-            if (ALLOWED_CATEGORY_SEGMENTS.has(category)) {
+            if (!BLOCKED_CATEGORY_SEGMENTS.has(category)) {
                 return true;
             }
             if (!skippedCategoriesLogged.has(category)) {
                 skippedCategoriesLogged.add(category);
-                console.log(`Skipping category "${category}" (not in ALLOWED_CATEGORY_SEGMENTS); e.g. ${dir}`);
+                console.log(`Skipping category "${category}" (in BLOCKED_CATEGORY_SEGMENTS); e.g. ${dir}`);
             }
             return false;
         })