fix: add WebSocket proxy support for WAF mode

The frontend proxy only handled HTTP requests but MACAE uses WebSocket
connections for real-time agent streaming. Add a WebSocket proxy route
that forwards wss:// connections to the private backend Container App
over the VNet using the websockets library.

Also fix Dockerfile BuildKit --mount issue for ACR Task builds.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Prajwal-Microsoft

src/App/Dockerfile

@@ -34,8 +34,7 @@ WORKDIR /app
 COPY pyproject.toml requirements.txt* uv.lock* ./
 
 # Install Python dependencies using UV
-RUN --mount=type=cache,target=/root/.cache/uv \
-    if [ -f "requirements.txt" ]; then \
+RUN if [ -f "requirements.txt" ]; then \
       uv pip install --system -r requirements.txt && uv pip install --system "uvicorn[standard]";  \
     else \
       uv pip install --system pyproject.toml && uv pip install --system "uvicorn[standard]"; \

src/App/frontend_server.py

@@ -1,9 +1,11 @@
+import asyncio
 import os
 
 import httpx
 import uvicorn
+import websockets
 from dotenv import load_dotenv
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, StreamingResponse
 from fastapi.staticfiles import StaticFiles
@@ -93,6 +95,43 @@ async def proxy_api(request: Request, path: str):
             headers=dict(response.headers),
         )
 
+    @app.websocket("/api/{path:path}")
+    async def proxy_websocket(websocket: WebSocket, path: str):
+        """Proxy WebSocket connections to the private backend over VNet."""
+        await websocket.accept()
+
+        # Build the backend WebSocket URL
+        backend_ws_url = BACKEND_API_URL.replace("https://", "wss://").replace("http://", "ws://")
+        query_string = str(websocket.query_params)
+        target_url = f"{backend_ws_url}/api/{path}"
+        if query_string:
+            target_url = f"{target_url}?{query_string}"
+
+        try:
+            async with websockets.connect(target_url) as backend_ws:
+
+                async def forward_to_backend():
+                    try:
+                        while True:
+                            data = await websocket.receive_text()
+                            await backend_ws.send(data)
+                    except WebSocketDisconnect:
+                        await backend_ws.close()
+
+                async def forward_to_client():
+                    try:
+                        async for message in backend_ws:
+                            await websocket.send_text(message)
+                    except websockets.exceptions.ConnectionClosed:
+                        await websocket.close()
+
+                await asyncio.gather(forward_to_backend(), forward_to_client())
+        except Exception:
+            try:
+                await websocket.close()
+            except Exception:
+                pass
+
 
 @app.get("/{full_path:path}")
 async def serve_app(full_path: str):

src/App/requirements.txt

@@ -5,4 +5,5 @@ jinja2
 azure-identity
 python-dotenv
 python-multipart
-httpx
+httpx
+websockets