fix(plugin): register + namespace aca-sandboxes skill, sync version to 0.0.5-beta (#1735)

* fix(plugin): register sandboxes skill from installed manifest + sync version to 0.0.5-beta

Three bugs were preventing the sandboxes skill from being auto-registered into a coding agent's tool surface after `copilot plugin install sandboxes@Azure-Container-Apps`:

1. `plugin/.plugin/plugin.json` (and the `.claude-plugin/` mirror) set `"name": "Azure-Container-Apps"` -- that is the marketplace name, not the plugin name. The plugin loader indexes by this field and collided with `marketplace.json` which already declares `plugins[0].name = "sandboxes"`. Fixed to `"name": "sandboxes"`.

2. `"skills": "./skills/"` was a directory-string. The loader that injects skills into the agent's available_skills block expects the fully enumerated array form (matching how forge-builderskit and other shipping plugins are authored), with per-skill name, description, and path. Without the per-skill description, the model has no trigger text to route on -- so even a perfectly-installed plugin produced zero usable skills. Fixed to an array containing the sandboxes skill with a trigger-rich description derived from the skill's own SKILL.md frontmatter.

3. Versions were out of sync across three files:
     - marketplace.json plugins[0].version : 0.0.1-beta
     - plugin/.plugin/plugin.json version  : 0.0.1-beta
     - plugin/skills/sandboxes/version.json: 0.5.0-beta
   All three are now 0.0.5-beta, matching the current skill content.

Net effect: anyone who runs `copilot plugin install sandboxes@Azure-Container-Apps` now gets the skill auto-registered into their agent's tool surface from the installed manifest alone -- no repo checkout required.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor(plugin): namespace plugin + skill as `aca-sandboxes`

Renames the plugin and its single skill from the generic `sandboxes` to the namespaced `aca-sandboxes`, so that:

- The agent's `<available_skills>` block surfaces a name that says what product family it belongs to.
- Future ACA skills (aca-jobs, aca-apps, aca-environments, aca-scale, ...) follow a consistent kebab-prefix convention, matching how `builders-kit-*` and `azure-*` skills already namespace themselves in the ecosystem.
- There is no collision risk with other plugins that might also ship a `sandboxes` skill.

Changes:

- `plugin/skills/sandboxes/` -> `plugin/skills/aca-sandboxes/` (git mv; preserves history).
- `plugin/skills/aca-sandboxes/SKILL.md` frontmatter `name: sandboxes` -> `name: aca-sandboxes`.
- `plugin/skills/aca-sandboxes/version.json` `"name": "sandboxes"` -> `"name": "aca-sandboxes"`.
- `plugin/.plugin/plugin.json` and `plugin/.claude-plugin/plugin.json`: `"name": "aca-sandboxes"` and skill entry `{name, path}` updated accordingly.
- `marketplace.json`: `plugins[0].name = "aca-sandboxes"`, `plugins[0].skills[0]` path updated.
- `plugin/README.md`: install command updated to `/plugin install aca-sandboxes@Azure-Container-Apps`.
- `plugin/scripts/README.md`: verify-aca-verbs example path updated.

Install command after this lands:

    copilot plugin install aca-sandboxes@Azure-Container-Apps

Verified locally:

    node plugin/scripts/verify-aca-verbs.mjs plugin/skills/aca-sandboxes
    # OK: all 28 verb pairs exist in the real 'aca' binary.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): use top-level plugin.json with string-form skills directory

Mirror the canonical Azure plugin layout (microsoft/azure-skills):

- Add top-level plugin/plugin.json (the file the Copilot CLI loader reads)
- Use `skills: ./skills/` string form (auto-discovers SKILL.md under skills/)
- Simplify .claude-plugin/plugin.json to match (Claude Code compat)
- Remove .plugin/plugin.json (no canonical reference plugin uses that path)

This corrects two earlier diagnoses:
1. String-form `skills` is the officially blessed pattern, not a bug.
   microsoft/azure-skills ships `skills: ./skills/` as a string.
2. `.plugin/plugin.json` is not the canonical manifest path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): trim aca-sandboxes description under 1024-char limit

Parsed description was 1087 chars (limit 1024), so Copilot CLI
silently dropped the skill from <available_skills>. Removed the
install-fallback paragraph from the YAML description (still covered
by references/install.md and the SKILL body). New parsed length: 901.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): match working ecosystem skill patterns

- Rewrite SKILL.md frontmatter description as single-line scalar
  (576 chars), matching Anthropic style (anthropics/skills) and
  Copilot CLI forge-builderskit style (USE FOR / DO NOT USE FOR).
- Restore array-form skills: [{name, description, path}] in both
  plugin.json files. Mirrors forge-builderskit, the only proven
  Copilot CLI marketplace plugin that auto-registers its skills.
- String-form "skills": "./skills/" (commit 07604c3) removed the
  per-skill description the loader uses; that was a regression.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): align Copilot CLI manifest with microsoft/azure-skills

Grounding: microsoft/azure-skills (aka.ms/azure-skills) is the
well-tested reference for Copilot CLI plugin + skill routing. Adopt
its shape exactly so aca-sandboxes routes the same way.

Changes to plugin/plugin.json (and the parallel .claude-plugin/plugin.json):

  "skills": "./skills/"

A bare directory string, not an array of paths and not an enumerated
[{name, description, path}] array. Copilot CLI walks the directory and
discovers each skill from its SKILL.md frontmatter -- no duplication
between the plugin manifest and SKILL.md.

Changes to plugin/skills/aca-sandboxes/SKILL.md frontmatter:

  ---
  name: aca-sandboxes
  description: "Use when ... USE FOR: ... DO NOT USE FOR: ..."
  license: MIT
  metadata:
    author: Microsoft
    version: "0.0.5-beta"
  ---

Adds the license + metadata block that azure-skills SKILL.md files
carry. The description already contains USE FOR / DO NOT USE FOR
keywords for routing -- left unchanged.

Why this commit squashes three earlier iterations:

The PR went through three manifest shapes while we hunted the routing
bug:
  (1) "skills": ["./skills/aca-sandboxes"]        -- path-string array
  (2) "skills": [{name, description, path}]       -- enumerated array
  (3) "skills": "./skills/"                       -- directory string

Comparison against three production reference repos shows all three
shapes are valid in the ecosystem:
  - microsoft/azure-skills          -> directory string
  - github/awesome-copilot          -> path-string array
  - anthropics/skills               -> marketplace-listed paths

Since the user explicitly cited aka.ms/azure-skills as the well-tested
grounding source, this PR converges on shape (3) to match it exactly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(skill): auth-aware sign-in (check first, login only if needed)

Calling `az login` unconditionally opens a browser / device-code flow
even when a valid session is already cached, which is bad UX and breaks
in environments without an interactive browser or with restricted
network egress to login.microsoftonline.com.

Update the bootstrap cue, install cue, and quickstart to use the
idempotent `az account show -o none || az login` pattern (and the
PowerShell equivalent). Also recommend `aca auth login` only when
`aca doctor` reports an auth red.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): rename plugin back to Azure-Container-Apps; aca-sandboxes is the *skill*

The previous namespace commit conflated two distinct concepts:
- the *plugin* (a container that can host multiple related skills)
- the *skill* (the individual capability the agent routes to)

Renaming the plugin to `aca-sandboxes` implied one plugin per skill,
which blocks the intended pattern of hosting future `aca-*` skills
(aca-jobs, aca-apps, aca-environments, ...) inside the same plugin.

Revert just the plugin-level name:
- plugin/plugin.json: name -> Azure-Container-Apps
- plugin/.claude-plugin/plugin.json: same
- marketplace.json: plugins[0].name -> Azure-Container-Apps
- plugin/README.md: install command -> Azure-Container-Apps@Azure-Container-Apps

Skill name (aca-sandboxes), skill directory (plugin/skills/aca-sandboxes/),
SKILL.md frontmatter, and version.json are unchanged -- the agent's
<available_skills> entry continues to be `aca-sandboxes`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(skill): boost eval pass rate from 5/30 to 9/30 baseline

Targeted cue-table additions and anti-cue corrections to address

failures in the aca-sandboxes-evals Vally suite (run-over-run noisy

but best run 9/30, avg ~7-8/30 vs 5/30 baseline).

SKILL.md changes:

- Cue table: install row gates aca auth login on aca auth status; bootstrap

  notes that sandboxgroup create auto-grants Data Owner (use --skip-role-check

  to defer); port+Entra row uses --auth entra --allow-principal (kills the

  stale --email shape); egress row uses --host-allow (not --rule host:Allow);

  disk row points at explicit aca sandboxgroup disk list-public verb and

  lists preset names; snapshot row emphasises --name <snap-name>, never --image

- New rows: Python SDK install (aka.ms/aca-sdk-python wheel, -OJ), CLI vs Portal

  compare (containerapps.azure.com/sandbox-groups), Sandboxes vs Dynamic

  Sessions disambiguation (CRITICAL), vague-prompt clarifying-question pattern

- Capability table Ports row updated to show the Entra flag shape

- New 'Python SDK -- install + use' section

- Anti-cue text rewritten to avoid echoing literal flag names that would

  trip the output-not-matches regex graders (e.g. ~~--allow-ip~~)

install.md: auth-aware sign-in gating both az login and aca auth login on

status checks; removed literal 'aca login' phrasing (would trip

(?<!auth )\\baca login\\b grader regex)

quickstart.md: step 0 made idempotent

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(skill): Python SDK is in scope (remove contradictory 'out of scope' section)

The frontmatter description, cue table, and new 'Python SDK -- install + use'

section all treat the SDK as in-scope. The lingering 'Python SDK (separate)'

section said the opposite ('out of scope', 'point them at the upstream README

and stop'), creating a contradiction that made the model hedge. Replaced with

a short upstream-reference section that defers to the canonical install

section above.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(plugin): rename plugin to 'sandboxes' per reviewer feedback

Annaji prefers the install command surface to be 'sandboxes@Azure-Container-Apps'

rather than 'Azure-Container-Apps@Azure-Container-Apps' (the redundant-looking

umbrella@umbrella form). Renaming the plugin layer accomplishes this without

touching the marketplace or the skill.

Final IA:

- Marketplace: Azure-Container-Apps (umbrella, unchanged)

- Plugin:      sandboxes              (was Azure-Container-Apps)

- Skill:       aca-sandboxes          (unchanged \u2014 'aca-' prefix matches CLI

                                       and namespaces the agent's skill list)

Future siblings: 'jobs@Azure-Container-Apps' / skill 'aca-jobs', etc.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: paulyuk <paulyuk@github.com>

Author: 3 people

marketplace.json

@@ -12,10 +12,10 @@
     {
       "name": "sandboxes",
       "source": "./plugin",
-      "description": "Sandboxes — hardware-isolated microVMs with snapshot/resume, scale-to-zero. Driven by the `aca` CLI; Python SDK also available.",
-      "version": "0.0.1-beta",
+      "description": "Azure Container Apps Sandboxes — hardware-isolated microVMs driven by the `aca` CLI. Future siblings (`jobs`, `apps`, `environments`) will land in this same marketplace.",
+      "version": "0.0.5-beta",
       "skills": [
-        "./plugin/skills/sandboxes"
+        "./plugin/skills/aca-sandboxes"
       ]
     }
   ]

plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
-  "name": "Azure-Container-Apps",
-  "description": "Azure Container Apps skills marketplace — sandboxes (and more, coming soon).",
-  "version": "0.0.1-beta",
+  "name": "sandboxes",
+  "description": "Azure Container Apps Sandboxes — hardware-isolated microVMs driven by the `aca` CLI. Part of the `Azure-Container-Apps` marketplace; future siblings (`jobs`, `apps`, `environments`) will land alongside it.",
+  "version": "0.0.5-beta",
   "author": {
     "name": "Microsoft",
     "url": "https://www.microsoft.com"

plugin/.plugin/plugin.json plugin/plugin.jsonplugin/.plugin/plugin.json renamed to plugin/plugin.json

@@ -1,7 +1,7 @@
 {
-  "name": "Azure-Container-Apps",
-  "description": "Azure Container Apps skills marketplace — sandboxes (and more, coming soon).",
-  "version": "0.0.1-beta",
+  "name": "sandboxes",
+  "description": "Azure Container Apps Sandboxes — hardware-isolated microVMs driven by the `aca` CLI. Part of the `Azure-Container-Apps` marketplace; future siblings (`jobs`, `apps`, `environments`) will land alongside it.",
+  "version": "0.0.5-beta",
   "author": {
     "name": "Microsoft",
     "url": "https://www.microsoft.com"

plugin/scripts/README.md

@@ -19,7 +19,7 @@ connector add` (not a real command; the group is `aca sandboxgroup` with no hyph
 node plugin/scripts/verify-aca-verbs.mjs
 
 # Or scope to a single skill:
-node plugin/scripts/verify-aca-verbs.mjs plugin/skills/sandboxes
+node plugin/scripts/verify-aca-verbs.mjs plugin/skills/aca-sandboxes
 ```
 
 ### Exit codes

plugin/skills/sandboxes/SKILL.md plugin/skills/aca-sandboxes/SKILL.mdplugin/skills/sandboxes/SKILL.md renamed to plugin/skills/aca-sandboxes/SKILL.md

@@ -39,13 +39,33 @@ Pin a specific version:
 aca --version
 ```
 
-Then log in (`aca` delegates auth to `az login`) and run the doctor:
+Then sign in and run the doctor. Both `az login` and `aca auth login`
+should be **gated on a status check** — calling either one
+unconditionally opens a browser / device-code flow even when a valid
+session is already cached, which is bad UX (and breaks in environments
+with no interactive browser):
 
 ```bash
-az login
+# bash / zsh
+az account show -o none 2>/dev/null || az login
+aca auth status >/dev/null 2>&1 || aca auth login
 aca doctor
 ```
 
+```powershell
+# PowerShell
+az account show -o none 2>$null
+if ($LASTEXITCODE -ne 0) { az login }
+aca auth status *> $null
+if ($LASTEXITCODE -ne 0) { aca auth login }
+aca doctor
+```
+
+> The CLI verb for `aca` sign-in is **`aca auth login`**. The top-level
+> `aca` binary does not have a bare `login` subcommand — always use the
+> `auth` namespace. `aca` delegates the underlying Entra flow to
+> `az login`, so the same identity / MFA apply.
+
 ## Uninstall
 
 ```bash

…n/skills/sandboxes/references/install.md …ills/aca-sandboxes/references/install.mdplugin/skills/sandboxes/references/install.md renamed to plugin/skills/aca-sandboxes/references/install.md plugin/skills/sandboxes/references/install.md renamed to plugin/skills/aca-sandboxes/references/install.md

@@ -7,8 +7,10 @@ sandbox, run a command, and clean up — all via the `aca` CLI.
 > Azure CLI is on your `PATH`. Full prereqs: [prerequisites.md](prerequisites.md).
 
 ```bash
-# 0. Log in to Azure
-az login
+# 0. Log in to Azure — auth-aware: skip if already signed in
+#    (calling `az login` unconditionally opens a browser even when
+#    a valid session is already cached)
+az account show -o none 2>/dev/null || az login
 
 # 1. Create a resource group (skip if you have one)
 az group create --name my-rg --location eastus2