@aws/agentcore 1.0.0-preview.12 → 1.0.0-preview.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/agentcore",
-  "version": "1.0.0-preview.12",
+  "version": "1.0.0-preview.14",
   "description": "CLI for Amazon Bedrock AgentCore",
   "license": "Apache-2.0",
   "repository": {
@@ -80,20 +80,20 @@
     "@aws-sdk/client-application-signals": "^3.1003.0",
     "@aws-sdk/client-bedrock": "^3.1012.0",
     "@aws-sdk/client-bedrock-agent": "^3.1012.0",
-    "@aws-sdk/client-bedrock-agentcore": "^3.1020.0",
-    "@aws-sdk/client-bedrock-agentcore-control": "^3.1054.0",
+    "@aws-sdk/client-bedrock-agentcore": "^3.1061.0",
+    "@aws-sdk/client-bedrock-agentcore-control": "^3.1061.0",
     "@aws-sdk/client-bedrock-runtime": "^3.893.0",
     "@aws-sdk/client-cloudformation": "^3.893.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.893.0",
-    "@aws-sdk/client-efs": "^3.1049.0",
+    "@aws-sdk/client-efs": "^3.1067.0",
     "@aws-sdk/client-resource-groups-tagging-api": "^3.893.0",
     "@aws-sdk/client-s3": "^3.1012.0",
-    "@aws-sdk/client-s3files": "^3.1049.0",
+    "@aws-sdk/client-s3files": "^3.1067.0",
     "@aws-sdk/client-sts": "^3.893.0",
     "@aws-sdk/client-xray": "^3.1003.0",
     "@aws-sdk/credential-providers": "^3.893.0",
     "@aws-sdk/region-config-resolver": "^3.972.13",
-    "@aws/agent-inspector": "0.5.0",
+    "@aws/agent-inspector": "0.6.0",
     "@commander-js/extra-typings": "^14.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
@@ -147,6 +147,7 @@
     "eslint-plugin-security": "^4.0.0",
     "husky": "^9.1.7",
     "ink-testing-library": "^4.0.0",
+    "jose": "^6.2.3",
     "lint-staged": "^16.2.7",
     "node-pty": "^1.1.0",
     "prettier": "^3.7.4",
@@ -161,13 +162,15 @@
     "minimatch": "GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch 10.0.0-10.2.2 has ReDoS vulnerabilities. Multiple transitive deps (eslint, typescript-eslint, eslint-plugin-import, eslint-plugin-react, prettier-plugin-sort-imports, aws-cdk-lib) pin older versions. Remove this override once upstream packages update their minimatch dependency to >=10.2.3.",
     "glob": "glob <12 is deprecated and emits npm install warnings (https://github.com/isaacs/node-glob). Pulled in transitively via archiver-utils@5.0.2 (latest), which still pins glob@^10.0.0. archiver-utils only uses glob.sync(pattern, options), which remains compatible in glob@13. Remove this override once archiver-utils updates its glob dependency.",
     "fast-xml-parser": "GHSA-8gc5-j5rx-235r, GHSA-jp2q-39xq-3w4g: fast-xml-parser <=5.5.6 has entity expansion bypass (CVE-2026-33036, CVE-2026-33349). Transitive via @aws-sdk/xml-builder. Remove once @aws-sdk updates to fast-xml-parser >=5.5.7.",
-    "@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14."
+    "@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14.",
+    "protobufjs": "GHSA-f38q-mgvj-vph7, GHSA-wcpc-wj8m-hjx6, GHSA-94rc-8x27-4472: protobufjs <=7.6.2 / 8.0.0-8.5.0 has property shadowing and DoS vulnerabilities. Transitive via @opentelemetry/otlp-transformer. Remove once @opentelemetry updates to protobufjs >=7.6.3 or >=8.5.1."
   },
   "overrides": {
     "minimatch": "10.2.4",
     "glob": "^13.0.0",
     "fast-xml-parser": "5.5.7",
-    "@aws-sdk/xml-builder": "3.972.15"
+    "@aws-sdk/xml-builder": "3.972.15",
+    "protobufjs": ">=7.6.3"
   },
   "engines": {
     "node": ">=20"

package/scripts/bundle.mjs

@@ -16,6 +16,9 @@
  * Environment variables:
  *   AGENTCORE_CDK_PATH              — path to the agentcore-l3-cdk-constructs repo.
  *                                     Falls back to ../agentcore-l3-cdk-constructs, then clones from GitHub.
+ *   AGENTCORE_INSPECTOR_PATH         — path to the agent-inspector repo.
+ *                                     Falls back to ../agent-inspector. If found, builds and bundles
+ *                                     the local version instead of the npm-installed one.
  *   AGENTCORE_TARBALL_OUTPUT        — output path (without .tgz) for the GA tarball.
  *                                     Preview tarball gets '-preview' appended. Relative to cwd.
  *   AGENTCORE_TARBALL_VERSION_SUFFIX — version prerelease suffix (e.g. "abc12-def34").
@@ -80,6 +83,31 @@ function resolveCdkPath() {
   return cloneDir;
 }
 
+/**
+ * Resolve a local agent-inspector repo path. Priority:
+ * 1. AGENTCORE_INSPECTOR_PATH env var
+ * 2. Sibling directory ../agent-inspector
+ * 3. null (use npm-installed version)
+ */
+function resolveInspectorPath() {
+  if (process.env.AGENTCORE_INSPECTOR_PATH) {
+    const p = path.resolve(process.env.AGENTCORE_INSPECTOR_PATH);
+    if (fs.existsSync(path.join(p, 'package.json'))) {
+      log(`Using agent-inspector from AGENTCORE_INSPECTOR_PATH: ${p}`);
+      return p;
+    }
+    console.warn(`  WARNING: AGENTCORE_INSPECTOR_PATH=${p} does not contain package.json, ignoring.`);
+  }
+
+  const sibling = path.resolve(cliRoot, '..', 'agent-inspector');
+  if (fs.existsSync(path.join(sibling, 'package.json'))) {
+    log(`Using agent-inspector from sibling directory: ${sibling}`);
+    return sibling;
+  }
+
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
@@ -161,6 +189,29 @@ run('npm', ['install'], { cwd: cliRoot });
 log('Building CLI...');
 run('npm', ['run', 'build'], { cwd: cliRoot });
 
+// Step 3.5: If local agent-inspector is available, build and overwrite dist/agent-inspector/
+const inspectorPath = resolveInspectorPath();
+if (inspectorPath) {
+  log('Installing agent-inspector dependencies...');
+  run('npm', ['install'], { cwd: inspectorPath });
+
+  log('Building agent-inspector...');
+  run('npm', ['run', 'build'], { cwd: inspectorPath });
+
+  const inspectorDistAssets = path.join(inspectorPath, 'dist-assets');
+  if (!fs.existsSync(inspectorDistAssets)) {
+    console.error(`ERROR: agent-inspector build did not produce dist-assets/ at ${inspectorDistAssets}`);
+    process.exit(1);
+  }
+
+  const inspectorDest = path.join(cliRoot, 'dist', 'agent-inspector');
+  if (fs.existsSync(inspectorDest)) {
+    fs.rmSync(inspectorDest, { recursive: true });
+  }
+  fs.cpSync(inspectorDistAssets, inspectorDest, { recursive: true });
+  log(`Replaced dist/agent-inspector/ with local build from ${inspectorPath}`);
+}
+
 // Step 4: Copy CDK tarball into dist/assets/ so CDKRenderer can detect it
 const bundledTarballDest = path.join(cliRoot, 'dist', 'assets', 'bundled-agentcore-cdk.tgz');
 fs.copyFileSync(cdkTarballSrc, bundledTarballDest);

package/scripts/run-e2e-local.sh

@@ -3,17 +3,24 @@
 #
 # Required env vars:
 #   E2E_ROLE_ARN    — IAM role ARN to assume (grants access to the test account)
-#   E2E_SECRET_ARN  — Secrets Manager ARN containing ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY
+#   E2E_SECRET_ARN  — Secrets Manager ARN containing ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY,
+#                     and (for payments tests) CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET
 #
 # Optional env vars:
 #   AWS_REGION      — defaults to us-east-1
+#   CDK_REPO_PATH   — local path to CDK constructs repo; if set, builds and uses it as CDK_TARBALL
+#   BUILD_PREVIEW   — set to 1 to build a preview CLI and run the harness e2e tests
+#                     (e2e-tests/harness-*.test.ts). Harness features are gated to preview
+#                     builds; without this they self-skip. The var is read at build time
+#                     (esbuild bakes __PREVIEW__=true) and at test runtime (skip gate).
 #
 # Usage:
 #   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role>
 #   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>
-#   ./scripts/run-e2e-local.sh                          # runs strands-bedrock.test.ts (CI default)
-#   ./scripts/run-e2e-local.sh --all                    # runs the full e2e suite
-#   ./scripts/run-e2e-local.sh e2e-tests/foo.test.ts    # runs a specific test file
+#   ./scripts/run-e2e-local.sh                                  # runs strands-bedrock.test.ts (CI default)
+#   ./scripts/run-e2e-local.sh --all                            # runs the full e2e suite
+#   ./scripts/run-e2e-local.sh e2e-tests/foo.test.ts            # runs a specific test file
+#   BUILD_PREVIEW=1 ./scripts/run-e2e-local.sh e2e-tests/harness-bedrock.test.ts  # runs harness tests
 #
 # Prerequisites: aws CLI, node >=20.19, npm, git, uv, jq
 
@@ -73,8 +80,19 @@ SECRET_JSON=$(aws secretsmanager get-secret-value \
 # Mirror the GitHub workflow: parse-json-secrets maps keys to E2E_<KEY> then
 # the workflow maps them to the bare names the tests expect.
 export ANTHROPIC_API_KEY=$(echo "$SECRET_JSON" | jq -r '.ANTHROPIC_API_KEY // empty')
-export OPENAI_API_KEY=$(echo "$SECRET_JSON"    | jq -r '.OPENAI_API_KEY // empty')
-export GEMINI_API_KEY=$(echo "$SECRET_JSON"    | jq -r '.GEMINI_API_KEY // empty')
+export OPENAI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.OPENAI_API_KEY // empty')
+export GEMINI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.GEMINI_API_KEY // empty')
+
+# Filesystem (BYO EFS / S3 Files) test inputs — required by strands-bedrock-byo-filesystem.test.ts.
+export E2E_EFS_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.EFS_ACCESS_POINT_ARN // empty')
+export E2E_S3_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.S3_ACCESS_POINT_ARN // empty')
+export E2E_FILESYSTEM_SUBNET_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SUBNET_ID // empty')
+export E2E_FILESYSTEM_SECURITY_GROUP_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SECURITY_GROUP_ID // empty')
+
+# Payments (CDP) test inputs — required by payment-strands-bedrock.test.ts.
+export CDP_API_KEY_ID=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_ID // empty')
+export CDP_API_KEY_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_SECRET // empty')
+export CDP_WALLET_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_WALLET_SECRET // empty')
 
 echo "✅ Secrets loaded (keys present: $(echo "$SECRET_JSON" | jq -r 'keys | join(", ")')"
 
@@ -82,12 +100,22 @@ echo "=== Setting AWS account env var ==="
 export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 echo "✅ AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID  AWS_REGION=$AWS_REGION"
 
-echo "=== Configuring git (required for agentcore create) ==="
-git config --global user.email "ci@local" 2>/dev/null || true
-git config --global user.name "Local E2E"  2>/dev/null || true
-
 cd "$REPO_ROOT"
 
+echo "=== Verifying git is configured (required for agentcore create) ==="
+git_email="$(git config --global user.email || true)"
+git_name="$(git config --global user.name || true)"
+
+if [ -z "$git_email" ] || [ -z "$git_name" ]; then
+  echo "ERROR: git is not configured. 'agentcore create' requires a global git identity." >&2
+  echo "Set it with:" >&2
+  echo "  git config --global user.email \"you@example.com\"" >&2
+  echo "  git config --global user.name \"Your Name\"" >&2
+  exit 1
+fi
+
+echo "git configured as: $git_name <$git_email>"
+
 echo "=== Installing dependencies ==="
 npm ci
 
@@ -100,6 +128,16 @@ npm install -g "$TARBALL"
 echo "✅ Installed: $(agentcore --version)"
 
 echo "=== Running E2E tests ==="
+if [[ -n "${CDK_REPO_PATH:-}" ]]; then
+  echo "=== Building CDK constructs from $CDK_REPO_PATH ==="
+  pushd "$CDK_REPO_PATH" > /dev/null
+  npm ci
+  npm run build
+  CDK_TARBALL_NAME=$(npm pack | tail -1)
+  export CDK_TARBALL="$CDK_REPO_PATH/$CDK_TARBALL_NAME"
+  popd > /dev/null
+  echo "✅ CDK_TARBALL=$CDK_TARBALL"
+fi
 if [[ "$RUN_ALL" == "true" ]]; then
   echo "Running full e2e suite"
   npx vitest run --project e2e

package/dist/schema/schemas/primitives/http-gateway.d.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod';
-export declare const HttpGatewayNameSchema: z.ZodString;
-export declare const HttpGatewayTargetSchema: z.ZodObject<{
-    name: z.ZodString;
-    runtimeRef: z.ZodString;
-    qualifier: z.ZodDefault<z.ZodString>;
-}, z.core.$strip>;
-export type HttpGatewayTarget = z.infer<typeof HttpGatewayTargetSchema>;
-export declare const HttpGatewaySchema: z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    runtimeRef: z.ZodString;
-    roleArn: z.ZodOptional<z.ZodString>;
-    targets: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        runtimeRef: z.ZodString;
-        qualifier: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip>>>;
-}, z.core.$strict>;
-export type HttpGateway = z.infer<typeof HttpGatewaySchema>;
-//# sourceMappingURL=http-gateway.d.ts.map

package/dist/schema/schemas/primitives/http-gateway.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-gateway.d.ts","sourceRoot":"","sources":["../../../../src/schema/schemas/primitives/http-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB,aAM/B,CAAC;AAEJ,eAAO,MAAM,uBAAuB;;;;iBAOlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;;;;;kBAanB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/schema/schemas/primitives/http-gateway.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpGatewaySchema = exports.HttpGatewayTargetSchema = exports.HttpGatewayNameSchema = void 0;
-const zod_1 = require("zod");
-// ============================================================================
-// HTTP Gateway Types
-// ============================================================================
-exports.HttpGatewayNameSchema = zod_1.z
-    .string()
-    .min(1, 'Name is required')
-    .regex(/^[a-zA-Z][a-zA-Z0-9-]*$/, 'Gateway name must start with a letter and contain only alphanumeric characters or hyphens (combined with project name must fit 48-char AWS limit)');
-exports.HttpGatewayTargetSchema = zod_1.z.object({
-    /** Gateway target name (referenced by AB test variants) */
-    name: zod_1.z.string().min(1).max(100),
-    /** Reference to a runtime name from spec.runtimes */
-    runtimeRef: zod_1.z.string().min(1),
-    /** Endpoint qualifier on the runtime (e.g., 'prod', 'staging'). Defaults to 'DEFAULT'. */
-    qualifier: zod_1.z.string().min(1).default('DEFAULT'),
-});
-exports.HttpGatewaySchema = zod_1.z
-    .object({
-    /** Unique name for the HTTP gateway */
-    name: exports.HttpGatewayNameSchema,
-    /** Optional description */
-    description: zod_1.z.string().min(1).max(200).optional(),
-    /** Reference to a runtime name from spec.runtimes. One target is created per gateway pointing to this runtime. */
-    runtimeRef: zod_1.z.string().min(1),
-    /** IAM role ARN for gateway execution. Auto-created if omitted. */
-    roleArn: zod_1.z.string().min(1).optional(),
-    /** Additional targets for the gateway (for target-based AB testing). */
-    targets: zod_1.z.array(exports.HttpGatewayTargetSchema).optional(),
-})
-    .strict();
-//# sourceMappingURL=http-gateway.js.map

package/dist/schema/schemas/primitives/http-gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-gateway.js","sourceRoot":"","sources":["../../../../src/schema/schemas/primitives/http-gateway.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAElE,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;KAC1B,KAAK,CACJ,yBAAyB,EACzB,mJAAmJ,CACpJ,CAAC;AAES,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,2DAA2D;IAC3D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,qDAAqD;IACrD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,0FAA0F;IAC1F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CAChD,CAAC,CAAC;AAIU,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,uCAAuC;IACvC,IAAI,EAAE,6BAAqB;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,kHAAkH;IAClH,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,mEAAmE;IACnE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,wEAAwE;IACxE,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,+BAAuB,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC"}