Fix orchestration reasoning compatibility and capability context

application/single_app/config.py

@@ -97,7 +97,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.103"
+VERSION = "0.261.104"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')

application/single_app/functions_action_catalog.py

@@ -140,6 +140,19 @@ def _assert_group_access(user_id, group_id):
     )
 
 
+def resolve_current_user_groups(user_id, user_groups=None):
+    """Resolve ID/record selectors to fresh, role-checked membership records."""
+    user_id = _require_actor(user_id)
+    groups = []
+    for group in _current_groups(user_id, user_groups):
+        try:
+            _assert_group_access(user_id, group["id"])
+        except (PermissionError, LookupError):
+            continue
+        groups.append(group)
+    return groups
+
+
 def _container(scope_type):
     # Raw reads avoid the ordinary getters' workspace-identity credential hydration.
     return getattr(import_module("config"), f"cosmos_{scope_type}_actions_container")
@@ -263,12 +276,8 @@ def build_accessible_action_catalog(user_id, *, settings=None, user_groups=None)
     if _scope_enabled(settings, "global"):
         scopes.append(("global", "global", "Global"))
     if _scope_enabled(settings, "group"):
-        for group in _current_groups(user_id, user_groups):
+        for group in resolve_current_user_groups(user_id, user_groups):
             group_id = group["id"]
-            try:
-                _assert_group_access(user_id, group_id)
-            except (PermissionError, LookupError):
-                continue
             scopes.append(("group", group_id, group.get("name") or "Group"))
 
     catalog = {}

application/single_app/functions_agent_catalog.py

@@ -6,11 +6,12 @@
 from typing import Any, Dict, Iterable, List, Optional
 
 from config import cosmos_activity_logs_container
+from functions_action_catalog import resolve_current_user_groups
 from functions_appinsights import log_event
 from functions_assigned_knowledge import get_agent_assigned_knowledge
 from functions_global_actions import get_global_actions
 from functions_global_agents import get_global_agents
-from functions_group import get_group_model_endpoints, get_user_groups
+from functions_group import get_group_model_endpoints
 from functions_group_actions import get_group_actions
 from functions_group_agents import get_group_agents
 from functions_governance import filter_actions_by_action_type_access, filter_governed_global_actions_for_user
@@ -276,12 +277,15 @@ def build_accessible_agent_catalog(
     user_id: str,
     *,
     settings: Optional[Dict[str, Any]] = None,
-    user_groups: Optional[Iterable[Dict[str, Any]]] = None,
+    user_groups: Optional[Iterable[Dict[str, Any] | str]] = None,
 ) -> List[Dict[str, Any]]:
     """Return safe catalog records for agents the user can select in chat."""
     resolved_settings = settings or get_settings()
     catalog: List[Dict[str, Any]] = []
-    resolved_groups = list(user_groups) if user_groups is not None else get_user_groups(user_id)
+    resolved_groups = (
+        resolve_current_user_groups(user_id, user_groups)
+        if resolved_settings.get("enable_group_workspaces", False) else []
+    )
     model_labels = _build_model_label_map(user_id, resolved_settings, resolved_groups)
     action_labels = _build_action_label_map(user_id, resolved_settings, resolved_groups)