update #60

jacob-split · 2025-12-20T06:21:31Z

No description provided.

- Add hindsight_agent.py: Main agent using Foundry Responses API with client-side tool execution - Add hindsight_agent_api.py: FastAPI wrapper for remote HTTP access - Add hindsight_client.py: Optimized memory API client with connection pooling - Add config.py: Centralized configuration with Azure App Configuration support - Add Dockerfile.agent-api: Container definition for Azure Container Apps - Add deploy-bicep.ps1: Deployment script with Bicep infrastructure - Add infra/agent-api.bicep: Infrastructure as Code for Container Apps - Update AGENTS.md: Comprehensive operations manual with Azure deployment details

… temperature/top_p

…ipts - Replace curated hindsight-tools-openapi.json with full hindsight-tools-openapi-full.json - Consolidate agent creation to single create_agent_full_spec.py script - Remove old update_agent_openapi.py (superseded) - Update AGENTS.md with new file structure and changelog - Agent Hindsight-v3:4 now has complete API access including all admin functions

Copilot

Pull request overview

This PR adds comprehensive Azure AI Foundry agent infrastructure and deployment automation for the Hindsight memory system. The changes introduce a new FastAPI-based agent API that can be deployed to Azure Container Apps, along with supporting infrastructure, client libraries, and extensive documentation.

Key changes:

New remote agent API with FastAPI endpoints for chat and health checks
Complete Azure infrastructure as code using Bicep templates
Optimized Hindsight client with connection pooling and retry logic
PowerShell deployment automation script
Comprehensive operations documentation in AGENTS.md

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 26 comments.

Show a summary per file

File	Description
requirements-agent-api.txt	Python dependencies for the agent API service
infra/agent-api.bicep	Infrastructure as Code defining Container Apps, ACR, Log Analytics, and RBAC
hindsight_client.py	Optimized HTTP client for Hindsight Memory API with connection pooling
hindsight_agent_api.py	FastAPI wrapper providing remote HTTP access to the agent
hindsight_agent.py	Main agent implementation using Foundry Responses API
hindsight-tools-openapi-full.json	Complete OpenAPI specification (24 endpoints) for agent tools
deploy-bicep.ps1	PowerShell deployment automation script
create_agent_full_spec.py	Script to create/update agent with full OpenAPI spec
config.py	Centralized configuration with Azure App Configuration support
Dockerfile.agent-api	Multi-stage Docker build for agent API container
hindsight-api/hindsight_api/api/mcp.py	Added reflect tool to MCP server
AGENTS.md	Comprehensive 593-line operations manual covering deployment, auth, and troubleshooting
.env.example	Updated default model from o3-mini to gpt-5.2
.dockerignore	Added exclusions for PDFs and documentation files

Comments suppressed due to low confidence (1)

infra/agent-api.bicep:84

CORS is configured to allow all origins ('*'), methods, and headers which creates a security vulnerability in production. This permissive configuration allows any website to make requests to your API, potentially enabling CSRF attacks and unauthorized access. For production deployments, configure specific allowed origins based on your actual client applications, and restrict methods and headers to only what's necessary.

        corsPolicy: {
          allowedOrigins: ['*']
          allowedMethods: ['GET', 'POST', 'OPTIONS']
          allowedHeaders: ['*']
        }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-20T06:28:19Z

deploy-bicep.ps1

+# Assign RBAC to AI Project (cross-resource-group)
+Write-Host "`nAssigning RBAC to AI Project..." -ForegroundColor Yellow
+$subscriptionId = $account.id
+$aiResourceId = "/subscriptions/$subscriptionId/resourceGroups/jacob-1216-resource/providers/Microsoft.CognitiveServices/accounts/jacob-1216-resource"
+
+az role assignment create --assignee $principalId --role "Cognitive Services User" --scope $aiResourceId --output none 2>$null


Hardcoded Azure resource URLs and IDs in deployment script reduce reusability. The AI resource ID at line 82 is hardcoded with a specific subscription ID and resource group 'jacob-1216-resource'. This couples the deployment script to a specific environment. Consider making these values parameters or loading them from configuration, which would allow the script to be used across different subscriptions and resource groups.

Copilot · 2025-12-20T06:28:19Z

infra/agent-api.bicep

+        }
+      ]
+      scale: {
+        minReplicas: 0


Minimum replica count of 0 allows the container to scale to zero, which can cause cold start latency issues for the first request after being idle. When scaled to zero, the first user request will experience significant delay (10-30+ seconds) while the container starts up. For production workloads requiring consistent response times, consider setting minReplicas to 1 to maintain at least one warm instance.

Suggested change

minReplicas: 0

minReplicas: 1

Copilot · 2025-12-20T06:28:20Z

hindsight_client.py

+
+        # Default timeouts
+        self.default_timeout = 30
+        self.reflect_timeout = 60  # Reflect operations take longer


The reflect timeout is set to 60 seconds which may be insufficient for complex operations. The reflect operation is noted as taking longer (line 87), but 60 seconds might still timeout for complex queries involving large memory banks or extensive LLM processing. Consider making this timeout configurable or increasing it to 120-180 seconds based on observed behavior in production.

Copilot · 2025-12-20T06:28:20Z

.env.example

 HINDSIGHT_API_LLM_PROVIDER=openai
 HINDSIGHT_API_LLM_API_KEY=your-api-key-here
-HINDSIGHT_API_LLM_MODEL=o3-mini
+HINDSIGHT_API_LLM_MODEL=gpt-5.2


Model name updated to 'gpt-5.2' but documentation indicates 'gpt-5.2-chat'. The model name has been changed from 'o3-mini' to 'gpt-5.2', but according to AGENTS.md line 50, the actual deployment name is 'gpt-5.2-chat'. This inconsistency may cause configuration issues. Verify whether the deployment accepts 'gpt-5.2' or requires the full 'gpt-5.2-chat' name.

Suggested change

HINDSIGHT_API_LLM_MODEL=gpt-5.2

HINDSIGHT_API_LLM_MODEL=gpt-5.2-chat

Copilot · 2025-12-20T06:28:20Z

hindsight_agent_api.py

+    max_iterations = 10
+    iteration = 0


The maximum iteration limit of 10 for tool call loops may be insufficient for complex multi-step reasoning. If the agent needs to perform multiple recalls, retains, and reflects in sequence, it could hit this limit before completing the task. Consider either increasing this limit to 15-20 or making it configurable, and add logging when the limit is reached so you can detect if it's causing issues in production.

Copilot · 2025-12-20T06:28:24Z

config.py

+# Try to import Azure App Configuration provider
+try:
+    from azure.appconfiguration.provider import load
+    from azure.identity import DefaultAzureCredential


Import of 'DefaultAzureCredential' is not used.

Suggested change

from azure.identity import DefaultAzureCredential

Copilot · 2025-12-20T06:28:24Z

hindsight_agent.py

+from azure.ai.projects import AIProjectClient
+from azure.identity import AzureCliCredential, ManagedIdentityCredential, ChainedTokenCredential
+from config import get_config
+from hindsight_client import HindsightClient, MemoryBanks


Import of 'MemoryBanks' is not used.

Suggested change

from hindsight_client import HindsightClient, MemoryBanks

from hindsight_client import HindsightClient

Copilot · 2025-12-20T06:28:25Z

hindsight_agent_api.py

+from typing import Optional
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI, HTTPException, Depends


Import of 'Depends' is not used.

Suggested change

from fastapi import FastAPI, HTTPException, Depends

from fastapi import FastAPI, HTTPException

Copilot · 2025-12-20T06:28:25Z

hindsight_client.py

+
+import json
+import logging
+import time


Import of 'time' is not used.

Suggested change

import time

Copilot · 2025-12-20T06:28:25Z

infra/agent-api.bicep

+        external: true
+        targetPort: 8080
+        transport: 'http'
+        corsPolicy: {
+          allowedOrigins: ['*']


The container app is configured with ingress.external: true and a permissive corsPolicy while hindsight_agent_api.py exposes /chat and memory operations without any authentication or authorization. This effectively publishes the agent and its default memory bank (hindsight_agent_bank) to the public internet, allowing any unauthenticated caller to POST to /chat and read or mutate stored memories as documented in AGENTS.md. Protect this by enforcing strong authn/z on the agent endpoints (e.g., API keys or tokens with per-user bank isolation), or by restricting ingress to private networks and tightening corsPolicy.allowedOrigins to only trusted origins.

Suggested change

external: true

targetPort: 8080

transport: 'http'

corsPolicy: {

allowedOrigins: ['*']

external: false

targetPort: 8080

transport: 'http'

corsPolicy: {

allowedOrigins: [hindsightApiUrl]

nicoloboschi

Thanks for your contribution!

it's not clear to me what the all the new files in the root dir are meant for. we need tp move them in a dedicated directory/package anyway.

Can you add more details on this implementation?

nicoloboschi · 2025-12-22T09:40:14Z

hindsight-api/hindsight_api/api/mcp.py

            return json.dumps({"error": str(e), "results": []})

+    @mcp.tool()
+    async def reflect(query: str) -> str:


nicoloboschi · 2025-12-22T09:41:14Z

infra/agent-api.bicep

@@ -0,0 +1,192 @@
+// Hindsight Agent API - Azure Container Apps Infrastructure
+// Bicep template for deploying the agent API alongside existing hindsight-api


Examples should go in this repo: https://github.com/vectorize-io/hindsight-cookbook/
we can create a deployments directory

would you mind?

nicoloboschi · 2025-12-22T09:41:38Z

.env.example

 HINDSIGHT_API_LLM_PROVIDER=openai
 HINDSIGHT_API_LLM_API_KEY=your-api-key-here
-HINDSIGHT_API_LLM_MODEL=o3-mini
+HINDSIGHT_API_LLM_MODEL=gpt-5.2-chat


5.2 is very slow and we don't want poor first-user experience

nicoloboschi · 2025-12-22T09:41:52Z

AGENTS.md

@@ -1,151 +1,593 @@
-# AGENTS.md
+# Hindsight Agent: Azure AI Foundry Operations Manual


please revert changs to this file

jacob-split added 6 commits December 19, 2025 18:57

Fix Responses API usage - remove version from agent_reference, remove…

096b6aa

… temperature/top_p

Add OpenAPI tools support - agent now works from Foundry portal and code

9094c4e

Update AGENTS.md with OpenAPI tools documentation

8e4f512

Fix ACR name in AGENTS.md

b22bee1

Copilot AI review requested due to automatic review settings December 20, 2025 06:21

Copilot started reviewing on behalf of jacob-split December 20, 2025 06:21 View session

Copilot AI reviewed Dec 20, 2025

View reviewed changes

fix: resolve audit issues (security, config, perf)

a9984e3

nicoloboschi requested changes Dec 22, 2025

View reviewed changes

jacob-split closed this by deleting the head repository Dec 22, 2025

	HINDSIGHT_API_LLM_MODEL=gpt-5.2
	HINDSIGHT_API_LLM_MODEL=gpt-5.2-chat

	from hindsight_client import HindsightClient, MemoryBanks
	from hindsight_client import HindsightClient

	from fastapi import FastAPI, HTTPException, Depends
	from fastapi import FastAPI, HTTPException

		@@ -0,0 +1,192 @@
		// Hindsight Agent API - Azure Container Apps Infrastructure
		// Bicep template for deploying the agent API alongside existing hindsight-api

		@@ -1,151 +1,593 @@
		# AGENTS.md
		# Hindsight Agent: Azure AI Foundry Operations Manual

update #60

update #60

Uh oh!

Conversation

jacob-split commented Dec 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 20, 2025

Choose a reason for hiding this comment

Uh oh!

nicoloboschi left a comment

Choose a reason for hiding this comment

Uh oh!

nicoloboschi Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

nicoloboschi Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

nicoloboschi Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

nicoloboschi Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants