fix: resolve unified config edge cases

Author: huimiu

cli/azd/extensions/azure.ai.agents/internal/cmd/listen.go

@@ -769,8 +769,9 @@ func prepareContainerSettings(
 ) (*azdext.ServiceConfig, error) {
 	rawAdditional := svc.GetAdditionalProperties()
 	rawConfig := svc.GetConfig()
-	hasRootFileRef := rawAdditional.GetFields()["$ref"] != nil ||
-		rawConfig.GetFields()["$ref"] != nil
+	hasRootFileRef := rawAdditional != nil &&
+		rawAdditional.GetFields()["$ref"] != nil ||
+		rawConfig != nil && rawConfig.GetFields()["$ref"] != nil
 	if hasRootFileRef {
 		if err := project.ResolveServiceConfigInPlace(
 			svc,
@@ -781,6 +782,11 @@ func prepareContainerSettings(
 				err,
 			)
 		}
+	} else if err := project.NormalizeServiceConfigInPlace(svc); err != nil {
+		return nil, fmt.Errorf(
+			"failed to normalize agent config: %w",
+			err,
+		)
 	}
 	foundryAgentConfig, err := project.LoadServiceTargetAgentConfig(svc)
 	if err != nil {

cli/azd/extensions/azure.ai.agents/internal/cmd/listen_test.go

@@ -212,6 +212,47 @@ func TestPrepareContainerSettings_PreservesNestedFileRef(t *testing.T) {
 	require.Equal(t, project.DefaultMemory, cfg.Container.Resources.Memory)
 }
 
+func TestPrepareContainerSettings_NormalizesInlineEnvironment(t *testing.T) {
+	t.Parallel()
+
+	props, err := structpb.NewStruct(map[string]any{
+		"kind": "hosted",
+		"name": "echo",
+		"env": map[string]any{
+			"ENABLED": true,
+		},
+	})
+	require.NoError(t, err)
+	svc := &azdext.ServiceConfig{
+		Name:                 "echo",
+		Host:                 AiAgentHost,
+		AdditionalProperties: props,
+	}
+
+	persisted, err := prepareContainerSettings(svc, t.TempDir())
+
+	require.NoError(t, err)
+	require.Equal(
+		t,
+		"true",
+		persisted.GetAdditionalProperties().
+			GetFields()["env"].GetStructValue().
+			GetFields()["ENABLED"].GetStringValue(),
+	)
+}
+
+func TestPrepareContainerSettings_WithoutProperties(t *testing.T) {
+	t.Parallel()
+
+	persisted, err := prepareContainerSettings(
+		&azdext.ServiceConfig{Name: "echo", Host: AiAgentHost},
+		t.TempDir(),
+	)
+
+	require.NoError(t, err)
+	require.NotNil(t, persisted)
+}
+
 func TestKindEnvUpdateRejectsTraversal(t *testing.T) {
 	t.Parallel()
 

cli/azd/extensions/azure.ai.agents/internal/project/agent_definition.go

@@ -399,6 +399,28 @@ func ResolveServiceConfigInPlace(
 	return nil
 }
 
+// NormalizeServiceConfigInPlace converts environment scalars without
+// resolving nested file references.
+func NormalizeServiceConfigInPlace(svc *azdext.ServiceConfig) error {
+	if props := svc.GetAdditionalProperties(); props != nil &&
+		len(props.GetFields()) > 0 {
+		normalized, err := normalizeServiceProps(props, svc.GetName())
+		if err != nil {
+			return err
+		}
+		svc.AdditionalProperties = normalized
+	}
+	if config := svc.GetConfig(); config != nil &&
+		len(config.GetFields()) > 0 {
+		normalized, err := normalizeServiceProps(config, svc.GetName())
+		if err != nil {
+			return err
+		}
+		svc.Config = normalized
+	}
+	return nil
+}
+
 func hydrateResolvedServiceFields(
 	svc *azdext.ServiceConfig,
 	props *structpb.Struct,
@@ -450,6 +472,29 @@ func resolveServiceProps(
 	return out, nil
 }
 
+func normalizeServiceProps(
+	props *structpb.Struct,
+	serviceName string,
+) (*structpb.Struct, error) {
+	values := props.AsMap()
+	if err := projectconfig.NormalizeEnvironment(values); err != nil {
+		return nil, fmt.Errorf(
+			"normalizing service %q environment: %w",
+			serviceName,
+			err,
+		)
+	}
+	out, err := structpb.NewStruct(values)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"encoding normalized service %q config: %w",
+			serviceName,
+			err,
+		)
+	}
+	return out, nil
+}
+
 // UpsertAgentEnvVars adds or updates environment variables on the agent
 // definition carried inline on the service entry, preserving every other key.
 // It is used by commands that mutate the definition (e.g. `optimize apply`).

cli/azd/extensions/azure.ai.agents/internal/project/foundry_provisioning_provider.go

@@ -173,7 +173,17 @@ func (p *FoundryProvisioningProvider) Initialize(
 			)
 		}
 		if endpoint != "" {
-			warnNetworkIgnoredInBrownfield(rawYAML, svcName)
+			if err := warnNetworkIgnoredInBrownfield(
+				rawYAML,
+				projectPath,
+				svcName,
+			); err != nil {
+				return exterrors.Validation(
+					exterrors.CodeInvalidAzureYaml,
+					fmt.Sprintf("resolve Foundry service configuration: %s", err),
+					"fix the project service configuration in azure.yaml",
+				)
+			}
 			p.brownfieldEndpoint = endpoint
 			if err := p.captureBrownfieldDeployments(ctx, rawYAML, svcName); err != nil {
 				return err
@@ -194,7 +204,17 @@ func (p *FoundryProvisioningProvider) Initialize(
 	case errors.Is(err, synthesis.ErrEndpointBrownfield):
 		// endpoint: reuse — connect to the existing project, skip provisioning.
 		// network: has no effect in brownfield mode; warn if both are present.
-		warnNetworkIgnoredInBrownfield(rawYAML, svcName)
+		if err := warnNetworkIgnoredInBrownfield(
+			rawYAML,
+			projectPath,
+			svcName,
+		); err != nil {
+			return exterrors.Validation(
+				exterrors.CodeInvalidAzureYaml,
+				fmt.Sprintf("resolve Foundry service configuration: %s", err),
+				"fix the project service configuration in azure.yaml",
+			)
+		}
 		endpoint, endpointErr := foundryServiceEndpointAtRoot(
 			rawYAML,
 			projectPath,
@@ -286,23 +306,46 @@ func (p *FoundryProvisioningProvider) networkEnvMap(ctx context.Context) map[str
 // warnNetworkIgnoredInBrownfield logs a warning when a service declares both
 // endpoint: (brownfield) and network:. The account's network posture is fixed
 // by whoever created it, so the network: block has no effect.
-func warnNetworkIgnoredInBrownfield(rawYAML []byte, svcName string) {
+func warnNetworkIgnoredInBrownfield(
+	rawYAML []byte,
+	projectRoot string,
+	svcName string,
+) error {
 	type svc struct {
 		Endpoint string    `yaml:"endpoint,omitempty"`
 		Network  yaml.Node `yaml:"network,omitempty"`
 	}
 	type root struct {
-		Services map[string]svc `yaml:"services"`
+		Services map[string]map[string]any `yaml:"services"`
 	}
 	var r root
 	if err := yaml.Unmarshal(rawYAML, &r); err != nil {
-		return
+		return err
+	}
+	values := r.Services[svcName]
+	if values == nil {
+		return nil
+	}
+	if projectRoot != "" {
+		resolved, err := foundry.ResolveFileRefs(values, projectRoot)
+		if err != nil {
+			return err
+		}
+		values = resolved
 	}
-	s := r.Services[svcName]
-	if strings.TrimSpace(s.Endpoint) != "" && !s.Network.IsZero() {
+	data, err := yaml.Marshal(values)
+	if err != nil {
+		return err
+	}
+	var service svc
+	if err := yaml.Unmarshal(data, &service); err != nil {
+		return err
+	}
+	if strings.TrimSpace(service.Endpoint) != "" && !service.Network.IsZero() {
 		log.Printf("[warn] foundry provider: service %q sets both endpoint: and network:; "+
 			"network: is ignored in brownfield mode (the account's network posture is fixed)", svcName)
 	}
+	return nil
 }
 
 // or infra/main.bicep exists under p.projectPath. Stat-only.

cli/azd/extensions/azure.ai.agents/schemas/Agent.json

@@ -18,7 +18,9 @@
         "env": {
           "type": "object",
           "description": "Environment variables for the agent runtime. Values may use ${VAR} (azd env) or ${{...}} (Foundry server-side resolution).",
-          "additionalProperties": { "type": "string" }
+          "additionalProperties": {
+            "type": ["string", "boolean", "number", "null"]
+          }
         },
         "toolboxes": {
           "type": "array",

cli/azd/extensions/azure.ai.agents/schemas/azure.ai.agent.json

@@ -8,7 +8,7 @@
       "type": "object",
       "description": "Environment variables as key-value pairs",
       "additionalProperties": {
-        "type": "string"
+        "type": ["string", "boolean", "number", "null"]
       }
     },
     "container": {