@aws/agentcore 1.0.0-preview.1 → 1.0.0-preview.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/agentcore",
-  "version": "1.0.0-preview.1",
+  "version": "1.0.0-preview.11",
   "description": "CLI for Amazon Bedrock AgentCore",
   "license": "Apache-2.0",
   "repository": {
@@ -41,6 +41,7 @@
   "files": [
     "dist",
     "scripts",
+    "npm-shrinkwrap.json",
     "!dist/mcp-harness"
   ],
   "scripts": {
@@ -50,13 +51,14 @@
     "build:lib": "tsc -p tsconfig.build.json",
     "build:cli": "node esbuild.config.mjs",
     "build:assets": "node scripts/copy-assets.mjs",
+    "build:preview": "BUILD_PREVIEW=1 node esbuild.config.mjs",
     "build:harness": "BUILD_HARNESS=1 node esbuild.config.mjs",
     "cli": "npx tsx src/cli/index.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src/",
-    "lint:fix": "eslint src/ --fix",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "typecheck": "tsc --noEmit --incremental",
+    "lint": "eslint --cache src/",
+    "lint:fix": "eslint --cache src/ --fix",
+    "format": "prettier --cache --write .",
+    "format:check": "prettier --cache --check .",
     "secrets:check": "secretlint '**/*'",
     "security:audit": "npm audit --audit-level=high --omit=dev",
     "clean": "node -e \"require('fs').rmSync('dist', {recursive: true, force: true})\"",
@@ -64,11 +66,12 @@
     "test": "vitest run --project unit",
     "test:all": "vitest run",
     "test:watch": "vitest --project unit",
-    "test:integ": "vitest run --project integ",
+    "test:integ": "npm run build && vitest run --project integ",
     "test:unit": "vitest run --project unit --coverage",
     "test:e2e": "vitest run --project e2e",
     "test:update-snapshots": "vitest run --project unit --update",
     "test:tui": "npm run build:harness && vitest run --project tui",
+    "test:browser": "npx playwright test --config browser-tests/playwright.config.ts",
     "bundle": "node scripts/bundle.mjs"
   },
   "dependencies": {
@@ -77,22 +80,27 @@
     "@aws-sdk/client-bedrock": "^3.1012.0",
     "@aws-sdk/client-bedrock-agent": "^3.1012.0",
     "@aws-sdk/client-bedrock-agentcore": "^3.1020.0",
-    "@aws-sdk/client-bedrock-agentcore-control": "^3.1020.0",
+    "@aws-sdk/client-bedrock-agentcore-control": "^3.1048.0",
     "@aws-sdk/client-bedrock-runtime": "^3.893.0",
     "@aws-sdk/client-cloudformation": "^3.893.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.893.0",
     "@aws-sdk/client-resource-groups-tagging-api": "^3.893.0",
     "@aws-sdk/client-s3": "^3.1012.0",
     "@aws-sdk/client-sts": "^3.893.0",
+    "@aws-sdk/region-config-resolver": "^3.972.13",
     "@aws-sdk/client-xray": "^3.1003.0",
     "@aws-sdk/credential-providers": "^3.893.0",
-    "@aws/agent-inspector": "0.2.0",
+    "@aws/agent-inspector": "0.4.2",
     "@commander-js/extra-typings": "^14.0.0",
-    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
     "@opentelemetry/otlp-transformer": "^0.213.0",
+    "@opentelemetry/resources": "^2.6.1",
+    "@opentelemetry/sdk-metrics": "^2.6.1",
     "@smithy/shared-ini-file-loader": "^4.4.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",
+    "fast-json-stable-stringify": "^2.1.0",
     "fflate": "^0.8.2",
     "handlebars": "^4.7.8",
     "ink": "^6.6.0",
@@ -111,7 +119,8 @@
     "@aws-sdk/client-cognito-identity-provider": "^3.1018.0",
     "@eslint/js": "^9.39.2",
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@secretlint/secretlint-rule-preset-recommend": "^11.3.0",
+    "@playwright/test": "^1.59.1",
+    "@secretlint/secretlint-rule-preset-recommend": "^12.2.0",
     "@trivago/prettier-plugin-sort-imports": "^6.0.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.0.3",
@@ -122,7 +131,7 @@
     "@xterm/headless": "^6.0.0",
     "aws-cdk-lib": "^2.248.0",
     "constructs": "^10.4.4",
-    "esbuild": "^0.27.2",
+    "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
@@ -136,7 +145,8 @@
     "lint-staged": "^16.2.7",
     "node-pty": "^1.1.0",
     "prettier": "^3.7.4",
-    "secretlint": "^11.3.0",
+    "secretlint": "^12.2.0",
+    "strip-ansi": "^7.2.0",
     "tsx": "^4.21.0",
     "typescript": "^5",
     "typescript-eslint": "^8.50.1",
@@ -144,11 +154,13 @@
   },
   "overridesComments": {
     "minimatch": "GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch 10.0.0-10.2.2 has ReDoS vulnerabilities. Multiple transitive deps (eslint, typescript-eslint, eslint-plugin-import, eslint-plugin-react, prettier-plugin-sort-imports, aws-cdk-lib) pin older versions. Remove this override once upstream packages update their minimatch dependency to >=10.2.3.",
+    "glob": "glob <12 is deprecated and emits npm install warnings (https://github.com/isaacs/node-glob). Pulled in transitively via archiver-utils@5.0.2 (latest), which still pins glob@^10.0.0. archiver-utils only uses glob.sync(pattern, options), which remains compatible in glob@13. Remove this override once archiver-utils updates its glob dependency.",
     "fast-xml-parser": "GHSA-8gc5-j5rx-235r, GHSA-jp2q-39xq-3w4g: fast-xml-parser <=5.5.6 has entity expansion bypass (CVE-2026-33036, CVE-2026-33349). Transitive via @aws-sdk/xml-builder. Remove once @aws-sdk updates to fast-xml-parser >=5.5.7.",
     "@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14."
   },
   "overrides": {
     "minimatch": "10.2.4",
+    "glob": "^13.0.0",
     "fast-xml-parser": "5.5.7",
     "@aws-sdk/xml-builder": "3.972.15"
   },
@@ -157,10 +169,10 @@
   },
   "lint-staged": {
     "*.{ts,tsx}": [
-      "eslint --max-warnings=10"
+      "eslint --cache --max-warnings=10"
     ],
     "*.{ts,tsx,js,jsx,json,md,css,html,yml,yaml}": [
-      "prettier --check"
+      "prettier --cache --check"
     ],
     "*": [
       "secretlint"

package/scripts/bump-version.ts

@@ -183,7 +183,7 @@ function getGitLog(sinceTag?: string): string {
     } else {
       // Try to get the last tag
       try {
-        const lastTag = execSync('git describe --tags --abbrev=0', { encoding: 'utf-8' }).trim();
+        const lastTag = execSync("git describe --tags --abbrev=0 --match 'v*'", { encoding: 'utf-8' }).trim();
         cmd += ` ${lastTag}..HEAD`;
       } catch {
         // No tags exist, get last 20 commits
@@ -218,11 +218,11 @@ function categorizeCommits(gitLog: string): CategorizedChanges {
 
     const msg = trimmed.slice(2).trim();
 
-    if (msg.startsWith('feat:') || msg.startsWith('feature:')) {
+    if (/^(feat|feature)(\(.*?\))?:/.test(msg)) {
       result.features.push(msg);
-    } else if (msg.startsWith('fix:') || msg.startsWith('bugfix:')) {
+    } else if (/^(fix|bugfix)(\(.*?\))?:/.test(msg)) {
       result.fixes.push(msg);
-    } else if (msg.startsWith('docs:') || msg.startsWith('doc:')) {
+    } else if (/^docs?(\(.*?\))?:/.test(msg)) {
       result.docs.push(msg);
     } else {
       result.other.push(msg);

package/scripts/bundle.mjs

@@ -1,5 +1,5 @@
 /**
- * bundle.mjs — Single command to build CLI + CDK constructs + frontend into one tarball.
+ * bundle.mjs — Single command to build CLI + CDK constructs into one tarball.
  *
  * This is a testing-only workflow. It does NOT modify the default build or
  * deployment flow. The normal `npm run build` + `npm pack` pipeline is unchanged.
@@ -9,16 +9,17 @@
  * At `agentcore create` time, CDKRenderer detects this tarball and installs it
  * after the normal `npm install`, overriding the registry version.
  *
- * It also builds the @aws/agent-inspector frontend and copies its dist-assets
- * into the CLI's dist/agent-inspector/ directory, overriding the npm registry version.
- *
  * Usage:
  *   node scripts/bundle.mjs
  *   npm run bundle
  *
  * Environment variables:
- *   AGENTCORE_CDK_PATH       — absolute path to the agentcore-l3-cdk-constructs repo
- *   AGENT_INSPECTOR_PATH     — absolute path to the agent-inspector repo
+ *   AGENTCORE_CDK_PATH              — path to the agentcore-l3-cdk-constructs repo.
+ *                                     Falls back to ../agentcore-l3-cdk-constructs, then clones from GitHub.
+ *   AGENTCORE_TARBALL_OUTPUT        — output path (without .tgz) for the GA tarball.
+ *                                     Preview tarball gets '-preview' appended. Relative to cwd.
+ *   AGENTCORE_TARBALL_VERSION_SUFFIX — version prerelease suffix (e.g. "abc12-def34").
+ *                                     Defaults to a timestamp if not set.
  */
 import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
@@ -79,38 +80,20 @@ function resolveCdkPath() {
   return cloneDir;
 }
 
-/**
- * Resolve the agent-inspector repo path. Priority:
- * 1. AGENT_INSPECTOR_PATH env var
- * 2. Sibling directory ../agent-inspector
- */
-function resolveInspectorPath() {
-  if (process.env.AGENT_INSPECTOR_PATH) {
-    const p = path.resolve(process.env.AGENT_INSPECTOR_PATH);
-    if (fs.existsSync(path.join(p, 'package.json'))) {
-      log(`Using agent-inspector from AGENT_INSPECTOR_PATH: ${p}`);
-      return p;
-    }
-    console.warn(`  WARNING: AGENT_INSPECTOR_PATH=${p} does not contain package.json, ignoring.`);
-  }
-
-  const sibling = path.resolve(cliRoot, '..', 'agent-inspector');
-  if (fs.existsSync(path.join(sibling, 'package.json'))) {
-    log(`Using agent-inspector from sibling directory: ${sibling}`);
-    return sibling;
-  }
-
-  return null;
-}
-
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
 log('Starting bundle process...');
 
-const timestamp = Math.floor(Date.now() / 1000);
-log(`Bundle timestamp: ${timestamp}`);
+const now = new Date();
+const timestamp = now.toISOString().replace(/[-:T]/g, '').slice(0, 14);
+const versionSuffix = process.env.AGENTCORE_TARBALL_VERSION_SUFFIX || timestamp;
+if (!/^[\w.-]+$/.test(versionSuffix)) {
+  console.error(`ERROR: Invalid version suffix: ${versionSuffix}`);
+  process.exit(1);
+}
+log(`Bundle version suffix: ${versionSuffix}`);
 
 // Helper to bump a package version with a unique e2e timestamp tag.
 // Saves the original version so it can be restored after packing.
@@ -119,7 +102,9 @@ function bumpVersion(pkgDir) {
   const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
   const originalVersion = pkg.version;
   const baseVersion = originalVersion.split('-')[0];
-  pkg.version = `${baseVersion}-${timestamp}`;
+  const prerelease = originalVersion.includes('-') ? originalVersion.split('-').slice(1).join('-') : '';
+  const tag = prerelease ? `${prerelease}-${versionSuffix}` : versionSuffix;
+  pkg.version = `${baseVersion}-${tag}`;
   fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
   log(`Bumped ${pkg.name} version: ${originalVersion} -> ${pkg.version}`);
   return { pkgJsonPath, originalVersion, bumpedVersion: pkg.version };
@@ -131,6 +116,18 @@ function restoreVersion({ pkgJsonPath, originalVersion }) {
   fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
 }
 
+/**
+ * If AGENTCORE_TARBALL_OUTPUT is set, return a resolved path using it as base.
+ * Appends '-preview' suffix for preview builds. Always appends .tgz.
+ */
+function resolveTarballPath(tarballPath, { preview = false } = {}) {
+  const envPath = process.env.AGENTCORE_TARBALL_OUTPUT;
+  if (!envPath) return tarballPath;
+  const suffix = preview ? '-preview' : '';
+  const base = envPath.replace(/\.tgz$/, '');
+  return path.resolve(`${base}${suffix}.tgz`);
+}
+
 // Step 1: Resolve and build CDK constructs
 const cdkPath = resolveCdkPath();
 
@@ -169,33 +166,7 @@ const bundledTarballDest = path.join(cliRoot, 'dist', 'assets', 'bundled-agentco
 fs.copyFileSync(cdkTarballSrc, bundledTarballDest);
 log(`Placed CDK tarball at ${bundledTarballDest}`);
 
-// Step 5: Build and bundle agent-inspector frontend (overrides the npm version)
-const inspectorPath = resolveInspectorPath();
-if (inspectorPath) {
-  log('Installing agent-inspector dependencies...');
-  run('npm', ['install'], { cwd: inspectorPath });
-
-  log('Building agent-inspector...');
-  run('npm', ['run', 'build'], { cwd: inspectorPath });
-
-  const inspectorDistSrc = path.join(inspectorPath, 'dist-assets');
-  const inspectorDistDest = path.join(cliRoot, 'dist', 'agent-inspector');
-
-  if (fs.existsSync(inspectorDistSrc)) {
-    if (fs.existsSync(inspectorDistDest)) {
-      fs.rmSync(inspectorDistDest, { recursive: true });
-    }
-    fs.cpSync(inspectorDistSrc, inspectorDistDest, { recursive: true });
-    log(`Copied agent-inspector frontend to ${inspectorDistDest}`);
-  } else {
-    console.error(`ERROR: agent-inspector build did not produce dist-assets/ at ${inspectorDistSrc}`);
-    process.exit(1);
-  }
-} else {
-  log('No local agent-inspector found — using npm registry version.');
-}
-
-// Step 6: Bump CLI version and pack into final tarball (includes the bundled CDK tarball + frontend)
+// Step 5: Bump CLI version and pack into final tarball (includes the bundled CDK tarball)
 const cliVersionInfo = bumpVersion(cliRoot);
 try {
   log('Packing CLI tarball...');
@@ -207,10 +178,65 @@ try {
 const cliTarballName = `aws-agentcore-${cliVersionInfo.bumpedVersion}.tgz`;
 const cliTarballPath = path.join(cliRoot, cliTarballName);
 
-if (fs.existsSync(cliTarballPath)) {
-  log(`Done! Tarball: ${cliTarballPath}`);
-  log(`Install with: npm install ${cliTarballPath}`);
-  log('When you run agentcore create, the bundled CDK constructs will be installed automatically.');
-} else {
-  log(`Done! Check ${cliRoot} for the .tgz file.`);
+if (!fs.existsSync(cliTarballPath)) {
+  console.error(`ERROR: Expected GA tarball at ${cliTarballPath} but not found.`);
+  process.exit(1);
+}
+
+const gaTarballPath = resolveTarballPath(cliTarballPath);
+if (gaTarballPath !== cliTarballPath) {
+  fs.mkdirSync(path.dirname(gaTarballPath), { recursive: true });
+  fs.renameSync(cliTarballPath, gaTarballPath);
+  log(`Renamed tarball to: ${gaTarballPath}`);
+}
+log(`Done! GA Tarball: ${gaTarballPath}`);
+log(`Install with: npm install -g ${gaTarballPath}`);
+log('When you run agentcore create, the bundled CDK constructs will be installed automatically.');
+
+// Step 6: Rebuild CLI with BUILD_PREVIEW=1
+log('Rebuilding CLI with BUILD_PREVIEW=1 for preview tarball...');
+run('npm', ['run', 'build:cli'], { cwd: cliRoot, env: { ...process.env, BUILD_PREVIEW: '1' } });
+
+// Step 7: Bump version to preview variant
+function bumpPreviewVersion(pkgDir) {
+  const pkgJsonPath = path.join(pkgDir, 'package.json');
+  const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
+  const originalVersion = pkg.version;
+  const baseVersion = originalVersion.split('-')[0];
+  pkg.version = `${baseVersion}-preview-${versionSuffix}`;
+  fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
+  log(`Bumped ${pkg.name} version: ${originalVersion} -> ${pkg.version}`);
+  return { pkgJsonPath, originalVersion, bumpedVersion: pkg.version };
 }
+
+const previewVersionInfo = bumpPreviewVersion(cliRoot);
+
+// Step 8: Pack preview tarball
+try {
+  log('Packing CLI preview tarball...');
+  run('npm', ['pack'], { cwd: cliRoot });
+} finally {
+  restoreVersion(previewVersionInfo);
+}
+
+const previewTarballName = `aws-agentcore-${previewVersionInfo.bumpedVersion}.tgz`;
+const previewTarballPath = path.join(cliRoot, previewTarballName);
+
+if (!fs.existsSync(previewTarballPath)) {
+  console.error(`ERROR: Expected preview tarball at ${previewTarballPath} but not found.`);
+  process.exit(1);
+}
+
+const finalPreviewPath = resolveTarballPath(previewTarballPath, { preview: true });
+if (finalPreviewPath !== previewTarballPath) {
+  fs.mkdirSync(path.dirname(finalPreviewPath), { recursive: true });
+  fs.renameSync(previewTarballPath, finalPreviewPath);
+  log(`Renamed tarball to: ${finalPreviewPath}`);
+}
+
+// Final output
+log(`GA tarball:      ${gaTarballPath}`);
+log(`Preview tarball: ${finalPreviewPath}`);
+log(`Install GA:      npm install -g ${gaTarballPath}`);
+log(`Install Preview: npm install -g ${finalPreviewPath}`);
+log('When you run agentcore create, the bundled CDK constructs will be installed automatically.');

package/scripts/run-e2e-dev.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Run E2E tests against your dev account using local credentials.
+#
+# Usage:
+#   ./scripts/run-e2e-dev.sh                          # runs strands-bedrock.test.ts
+#   ./scripts/run-e2e-dev.sh --all                    # runs the full e2e suite
+#   ./scripts/run-e2e-dev.sh e2e-tests/foo.test.ts    # runs a specific test file
+
+set -euo pipefail
+
+REGION="${AWS_REGION:-us-east-1}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+# ── Build & install CLI from source ────────────────────────────────────────────
+cd "$REPO_ROOT"
+npm run build
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "=== Installed: $(agentcore --version) ==="
+
+# ── Set env vars for tests ─────────────────────────────────────────────────────
+export AWS_REGION="$REGION"
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+
+# ── Run tests ──────────────────────────────────────────────────────────────────
+cd "$REPO_ROOT"
+
+EXCLUDE_API_KEY_TESTS=(
+  --exclude 'e2e-tests/*-anthropic*'
+  --exclude 'e2e-tests/*-openai*'
+  --exclude 'e2e-tests/*-gemini*'
+)
+
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "=== Running full e2e suite ==="
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "=== Running: ${TEST_FILES[*]} ==="
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "=== Running all Bedrock/IAM tests (excluding API-key-dependent tests) ==="
+  npx vitest run --project e2e "${EXCLUDE_API_KEY_TESTS[@]}"
+fi

package/scripts/run-e2e-local.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Run E2E tests locally in the CI account, replicating the GitHub Actions e2e-tests.yml workflow.
+#
+# Required env vars:
+#   E2E_ROLE_ARN    — IAM role ARN to assume (grants access to the test account)
+#   E2E_SECRET_ARN  — Secrets Manager ARN containing ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY
+#
+# Optional env vars:
+#   AWS_REGION      — defaults to us-east-1
+#
+# Usage:
+#   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role>
+#   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>
+#   ./scripts/run-e2e-local.sh                          # runs strands-bedrock.test.ts (CI default)
+#   ./scripts/run-e2e-local.sh --all                    # runs the full e2e suite
+#   ./scripts/run-e2e-local.sh e2e-tests/foo.test.ts    # runs a specific test file
+#
+# Prerequisites: aws CLI, node >=20.19, npm, git, uv, jq
+
+set -euo pipefail
+
+ROLE_ARN="${E2E_ROLE_ARN:-}"
+SECRET_ARN="${E2E_SECRET_ARN:-}"
+AWS_REGION="${AWS_REGION:-us-east-1}"
+
+if [[ -z "$ROLE_ARN" ]]; then
+  echo "❌ E2E_ROLE_ARN is not set. Export it before running this script:"
+  echo "   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role-name>"
+  exit 1
+fi
+
+if [[ -z "$SECRET_ARN" ]]; then
+  echo "❌ E2E_SECRET_ARN is not set. Export it before running this script:"
+  echo "   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>"
+  exit 1
+fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+echo "=== Assuming IAM role ==="
+CREDS=$(aws sts assume-role \
+  --role-arn "$ROLE_ARN" \
+  --role-session-name "local-e2e-$(date +%s)" \
+  --duration-seconds 3600 \
+  --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
+  --output text)
+
+export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | awk '{print $1}')
+export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | awk '{print $2}')
+export AWS_SESSION_TOKEN=$(echo "$CREDS" | awk '{print $3}')
+export AWS_REGION
+
+echo "✅ Assumed role successfully"
+
+echo "=== Fetching API keys from Secrets Manager ==="
+SECRET_JSON=$(aws secretsmanager get-secret-value \
+  --secret-id "$SECRET_ARN" \
+  --region "$AWS_REGION" \
+  --query SecretString \
+  --output text)
+
+# Mirror the GitHub workflow: parse-json-secrets maps keys to E2E_<KEY> then
+# the workflow maps them to the bare names the tests expect.
+export ANTHROPIC_API_KEY=$(echo "$SECRET_JSON" | jq -r '.ANTHROPIC_API_KEY // empty')
+export OPENAI_API_KEY=$(echo "$SECRET_JSON"    | jq -r '.OPENAI_API_KEY // empty')
+export GEMINI_API_KEY=$(echo "$SECRET_JSON"    | jq -r '.GEMINI_API_KEY // empty')
+
+echo "✅ Secrets loaded (keys present: $(echo "$SECRET_JSON" | jq -r 'keys | join(", ")')"
+
+echo "=== Setting AWS account env var ==="
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+echo "✅ AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID  AWS_REGION=$AWS_REGION"
+
+echo "=== Configuring git (required for agentcore create) ==="
+git config --global user.email "ci@local" 2>/dev/null || true
+git config --global user.name "Local E2E"  2>/dev/null || true
+
+cd "$REPO_ROOT"
+
+echo "=== Installing dependencies ==="
+npm ci
+
+echo "=== Building CLI ==="
+npm run build
+
+echo "=== Installing CLI globally ==="
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "✅ Installed: $(agentcore --version)"
+
+echo "=== Running E2E tests ==="
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "Running full e2e suite"
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "Running: ${TEST_FILES[*]}"
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "Running default: e2e-tests/strands-bedrock.test.ts"
+  npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts
+fi