@aws/agentcore 1.0.0-preview.3 → 1.0.0-preview.31

package/scripts/extract-cli-model.test.mjs

@@ -0,0 +1,43 @@
+import { normalizeParameterDescription, parseHelp } from './extract-cli-model.mjs';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+test('parseHelp preserves wrapped argument and option descriptions', () => {
+  const parsed = parseHelp(`Usage: agentcore invoke [options] [prompt]
+
+Invoke an agent.
+
+Arguments:
+  prompt                 Prompt to send to the agent. Also accepts piped
+                         stdin when no prompt is provided
+
+Options:
+  --prompt-file <path>   Read the prompt from a file (for long or
+                         structured payloads that exceed shell limits)
+
+Output
+  --json                 Output as JSON
+`);
+
+  assert.equal(
+    parsed.args[0].description,
+    'Prompt to send to the agent. Also accepts piped stdin when no prompt is provided'
+  );
+  assert.equal(
+    parsed.options[0].description,
+    'Read the prompt from a file (for long or structured payloads that exceed shell limits)'
+  );
+  assert.equal(parsed.options[1].description, 'Output as JSON');
+});
+
+test('normalizeParameterDescription expands model provider and LiteLLM fragments', () => {
+  assert.equal(
+    normalizeParameterDescription('bedrock, open_ai, or gemini'),
+    'The model provider. Valid values: `bedrock`, `open_ai`, or `gemini`.'
+  );
+  assert.equal(
+    normalizeParameterDescription('Override LiteLLM API base URL (harness only, lite_llm) [non-interactive]'),
+    'The LiteLLM API base URL override for harness invocations. ' +
+      'Available only with `lite_llm` in non-interactive mode.'
+  );
+});

package/scripts/render_adoc.py

@@ -0,0 +1,350 @@
+#!/usr/bin/env python3
+# =============================================================================
+# render_adoc.py  —  shared doc-model -> AsciiDoc renderer
+# =============================================================================
+# Renders a normalized "doc-model" JSON (produced by any of the three
+# extractors) into .adoc files for the documentation repository.
+#
+# It is deliberately source-agnostic: the Python extractor, the TypeScript
+# TypeDoc extractor, and the CLI --help extractor all emit the SAME doc-model
+# schema, so this one renderer produces consistent output for all three.
+#
+# NOTE: if these workflows are later consolidated into a single shared reusable
+# workflow, this file is vendored there ONCE and every source repo's caller
+# invokes it. Keep it dependency-free (stdlib only) so it drops cleanly into any
+# runner.
+#
+# -----------------------------------------------------------------------------
+# doc-model schema (v1) — the contract every extractor must emit:
+#   {
+#     "source":   "python-sdk" | "ts-sdk" | "cli",
+#     "package":  "bedrock-agentcore",
+#     "version":  "1.16.0",
+#     "language": "python" | "typescript" | "cli",
+#     "groups": [                      # a group -> one .adoc file
+#       {
+#         "id":       "runtime",       # -> <prefix>-runtime.adoc, and anchor id
+#         "title":    "Runtime",
+#         "summary":  "Runtime management and application context.",
+#         "entries": [                 # classes / functions / commands
+#           {
+#             "kind":      "class" | "function" | "command",
+#             "name":      "BedrockAgentCoreApp",
+#             "signature": "BedrockAgentCoreApp(params)",
+#             "summary":   "one-line summary",
+#             "description": "longer prose (optional)",
+#             "params": [ {"name","type","required","description"} ],
+#             "returns":  {"type","description"} | null,
+#             "raises":   [ {"type","description"} ],
+#             "examples": [ {"lang","code"} ],
+#             "members":  [ <entry>, ... ]   # methods on a class (recursive)
+#           }
+#         ]
+#       }
+#     ]
+#   }
+# -----------------------------------------------------------------------------
+
+import argparse
+import json
+import os
+import re
+import sys
+import textwrap
+
+SCHEMA_VERSION = 1
+
+
+def normalize_style(text):
+    """Apply style-safe substitutions to generated prose."""
+    if not text:
+        return ""
+    text = re.sub(r"\be\.g\.(?:,)?", "for example,", text, flags=re.IGNORECASE)
+    text = re.sub(
+        r"\bAWS (?:Bedrock(?: AgentCore)? )?Code\s*Interpreter\b",
+        "Amazon Bedrock AgentCore Code Interpreter",
+        text,
+        flags=re.IGNORECASE,
+    )
+    text = re.sub(r"\bAWS Bedrock AgentCore\b", "Amazon Bedrock AgentCore", text)
+    text = re.sub(r"\bAWS Bedrock\b", "Amazon Bedrock", text)
+    text = re.sub(
+        r"(?<!Amazon )(?<!AWS )\bBedrock AgentCore\b",
+        "Amazon Bedrock AgentCore",
+        text,
+    )
+    text = re.sub(
+        r"(?<!Amazon Bedrock )\bAgentCore Code Interpreter\b",
+        "Amazon Bedrock AgentCore Code Interpreter",
+        text,
+    )
+    text = re.sub(
+        r"(?<!Amazon Bedrock )\bAgentCore runtime\b",
+        "Amazon Bedrock AgentCore runtime",
+        text,
+    )
+    text = re.sub(
+        r"(?<!Amazon Bedrock )\bAgentCore Identity\b",
+        "Amazon Bedrock AgentCore Identity",
+        text,
+    )
+    text = text.replace(", allowing applications to", " so applications can")
+    text = re.sub(r"\bAWS region\b", "AWS Region", text, flags=re.IGNORECASE)
+    text = re.sub(r"\bAgentCore Memory\b", "AgentCore memory", text)
+    text = re.sub(r"\bAgentCore Runtime\b", "AgentCore runtime", text)
+    text = text.replace(
+        "This feature is in preview and may change in future releases.",
+        "This feature is in preview and might change in future releases.",
+    )
+    text = text.replace("validation will ensure", "validation ensures")
+    return re.sub(r"\bAWS\b", "{aws}", text)
+
+
+def normalize_param_description(text):
+    """Normalize recurring parameter-description style issues."""
+    text = normalize_style(text).strip()
+    exact_substitutions = {
+        "bedrock, open_ai, or gemini": (
+            "The model provider. Valid values: `bedrock`, `open_ai`, or `gemini`."
+        ),
+        "Override LiteLLM API base URL (harness only, lite_llm) [non-interactive]": (
+            "The LiteLLM API base URL override for harness invocations. "
+            "Available only with `lite_llm` in non-interactive mode."
+        ),
+        "Override LiteLLM additional params as a JSON object (harness only, lite_llm) "
+        "[non-interactive]": (
+            "The additional LiteLLM parameters, as a JSON object, for harness invocations. "
+            "Available only with `lite_llm` in non-interactive mode."
+        ),
+    }
+    if text in exact_substitutions:
+        return exact_substitutions[text]
+    substitutions = (
+        (r"^Optional\b", "The optional"),
+        (r"^(?:\{aws\}|AWS)\s+region\b", "The {aws} Region"),
+        (r"^id of\b", "The ID of"),
+        (r"^Behaviour\b", "The behavior"),
+        (r"^Behavior\b", "The behavior"),
+        (r"^Memory resource ID\b", "The memory resource ID"),
+        (r"^Strategy name\b", "The name of the memory strategy"),
+        (r"^Strategy ID\b", "The ID of the memory strategy"),
+    )
+    for pattern, replacement in substitutions:
+        text = re.sub(pattern, replacement, text, count=1, flags=re.IGNORECASE)
+    return text
+def esc(text):
+    """Escape AsciiDoc-significant characters in inline text."""
+    if not text:
+        return ""
+    # Guard the couple of chars that start AsciiDoc markup in running prose.
+    marker = "\0AWS_ENTITY\0"
+    text = normalize_style(text).replace("{aws}", marker)
+    return text.replace("|", "\\|").replace("{", "\\{").replace(marker, "{aws}")
+
+
+# Match markdown code fences that may be indented (reST/Google docstrings often
+# indent example blocks). `re.MULTILINE` lets ^ match each line start; the
+# leading-whitespace groups are stripped from the captured code.
+_FENCE_RE = re.compile(r"^[ \t]*```(\w*)[ \t]*\n(.*?)\n[ \t]*```[ \t]*$", re.DOTALL | re.MULTILINE)
+
+
+def render_prose(text):
+    """Render description prose that may contain markdown ``` code fences.
+
+    Docstrings/TSDoc frequently embed fenced code blocks in the description
+    (not just in @example). Left alone they leak literal backticks into the
+    AsciiDoc. Split the prose on fences: escape the prose spans, and convert
+    each fenced block into an AsciiDoc [source] block (verbatim, not escaped).
+    """
+    if not text:
+        return []
+    out = []
+    pos = 0
+    for m in _FENCE_RE.finditer(text):
+        before = text[pos:m.start()].strip()
+        if before:
+            out.append(esc(before))
+            out.append("")
+        lang = m.group(1) or ""
+        out.append(f"[source,{lang}]" if lang else "[source]")
+        out.append("----")
+        # Dedent the captured code (fences are often indented in docstrings).
+        out.append(textwrap.dedent(m.group(2)).rstrip())
+        out.append("----")
+        out.append("")
+        pos = m.end()
+    tail = text[pos:].strip()
+    if tail:
+        out.append(esc(tail))
+    return out
+
+
+def block(lines):
+    return "\n".join(lines)
+
+
+def render_params(params, out):
+    if not params:
+        return
+    out.append("*Parameters*")
+    out.append("")
+    for p in params:
+        req = "" if p.get("required") else " _(optional)_"
+        typ = f"`{p['type']}`" if p.get("type") else ""
+        out.append(f"`{p['name']}`{req} {typ}::")
+        out.append(esc(normalize_param_description(p.get("description", ""))) or "_No description._")
+    out.append("")
+
+
+def render_returns(returns, out):
+    if not returns:
+        return
+    typ = f"`{returns['type']}` — " if returns.get("type") else ""
+    out.append("*Returns*")
+    out.append("")
+    out.append(f"{typ}{esc(returns.get('description', ''))}".strip())
+    out.append("")
+
+
+def render_raises(raises, out):
+    if not raises:
+        return
+    out.append("*Raises*")
+    out.append("")
+    for r in raises:
+        out.append(f"`{r.get('type', 'Error')}`:: {esc(r.get('description', ''))}")
+    out.append("")
+
+
+def clean_example_code(code):
+    """Strip stray markdown fence lines from example code.
+
+    Extractors try to remove ``` fences, but real docstrings put them mid-buffer
+    (e.g. a fence followed by extra "Notes:"/"Thread Safety:" prose swept into
+    the example). Since this text is already going inside an AsciiDoc [source]
+    block, any line that is just a fence is spurious — drop it, and drop trailing
+    non-code prose that follows a closing fence.
+    """
+    lines = code.split("\n")
+    kept = []
+    closed = False
+    for line in lines:
+        if re.match(r"^[ \t]*```", line):
+            # A closing fence marks the end of the real code; ignore the fence
+            # line itself and stop taking subsequent prose.
+            if kept:
+                closed = True
+            continue
+        if closed and line.strip() == "":
+            continue
+        if closed and line.strip():
+            break  # prose after the closing fence — not part of the example
+        kept.append(line)
+    return textwrap.dedent("\n".join(kept)).strip()
+
+
+def render_examples(examples, out):
+    for ex in examples or []:
+        lang = ex.get("lang", "text")
+        code = clean_example_code(ex.get("code", ""))
+        if not code:
+            continue
+        out.append(f"[source,{lang}]")
+        out.append("----")
+        out.append(code)
+        out.append("----")
+        out.append("")
+
+
+def render_entry(entry, level, out):
+    """Render a single class/function/command as an AsciiDoc section."""
+    heading = "=" * level
+    name = entry.get("name", "")
+    out.append(f"{heading} {name}")
+    out.append("")
+
+    sig = entry.get("signature")
+    if sig:
+        out.append("[source]")
+        out.append("----")
+        out.append(sig)
+        out.append("----")
+        out.append("")
+
+    if entry.get("summary"):
+        out.extend(render_prose(entry["summary"]))
+        out.append("")
+    if entry.get("description"):
+        out.extend(render_prose(entry["description"]))
+        out.append("")
+
+    render_params(entry.get("params"), out)
+    render_returns(entry.get("returns"), out)
+    render_raises(entry.get("raises"), out)
+    render_examples(entry.get("examples"), out)
+
+    # methods / subcommands nest one heading level deeper
+    for member in entry.get("members", []):
+        render_entry(member, level + 1, out)
+
+
+def render_group(group, model, prefix):
+    """Render one group -> one .adoc file body (string)."""
+    out = []
+    gid = group["id"]
+    # AsciiDoc anchor so the TOC / other pages can xref into it.
+    out.append(f"[[{prefix}-{gid}]]")
+    out.append(f"= {group['title']}")
+    out.append("")
+    out.append(
+        f"_Auto-generated from `{model['package']}` "
+        f"v{model['version']} — do not edit by hand._"
+    )
+    out.append("")
+    if group.get("summary"):
+        out.extend(render_prose(group["summary"]))
+        out.append("")
+
+    for entry in group.get("entries", []):
+        render_entry(entry, level=2, out=out)
+
+    return block(out).rstrip() + "\n"
+
+
+def main():
+    ap = argparse.ArgumentParser(description="Render doc-model JSON to .adoc")
+    ap.add_argument("--model", required=True, help="path to doc-model JSON")
+    ap.add_argument("--out-dir", required=True, help="output dir for .adoc files")
+    ap.add_argument(
+        "--prefix",
+        required=True,
+        help="filename + anchor prefix, e.g. 'python-sdk', 'ts-sdk', 'cli'",
+    )
+    args = ap.parse_args()
+
+    with open(args.model) as f:
+        model = json.load(f)
+
+    os.makedirs(args.out_dir, exist_ok=True)
+    written = []
+    for group in model.get("groups", []):
+        body = render_group(group, model, args.prefix)
+        fname = f"{args.prefix}-{group['id']}.adoc"
+        path = os.path.join(args.out_dir, fname)
+        with open(path, "w") as f:
+            f.write(body)
+        written.append(fname)
+
+    # Emit the list of includes the caller can splice into the docs TOC file.
+    manifest = os.path.join(args.out_dir, f"{args.prefix}-includes.txt")
+    with open(manifest, "w") as f:
+        for fname in written:
+            f.write(f"include::{args.prefix}/{fname}[leveloffset=+1]\n")
+
+    print(f"Rendered {len(written)} .adoc files to {args.out_dir}", file=sys.stderr)
+    for fname in written:
+        print(f"  - {fname}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/run-e2e-dev.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Run E2E tests against your dev account using local credentials.
+#
+# Usage:
+#   ./scripts/run-e2e-dev.sh                          # runs strands-bedrock.test.ts
+#   ./scripts/run-e2e-dev.sh --all                    # runs the full e2e suite
+#   ./scripts/run-e2e-dev.sh e2e-tests/foo.test.ts    # runs a specific test file
+
+set -euo pipefail
+
+REGION="${AWS_REGION:-us-east-1}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+# ── Build & install CLI from source ────────────────────────────────────────────
+cd "$REPO_ROOT"
+npm run build
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "=== Installed: $(agentcore --version) ==="
+
+# ── Set env vars for tests ─────────────────────────────────────────────────────
+export AWS_REGION="$REGION"
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+
+# ── Run tests ──────────────────────────────────────────────────────────────────
+cd "$REPO_ROOT"
+
+EXCLUDE_API_KEY_TESTS=(
+  --exclude 'e2e-tests/*-anthropic*'
+  --exclude 'e2e-tests/*-openai*'
+  --exclude 'e2e-tests/*-gemini*'
+)
+
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "=== Running full e2e suite ==="
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "=== Running: ${TEST_FILES[*]} ==="
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "=== Running all Bedrock/IAM tests (excluding API-key-dependent tests) ==="
+  npx vitest run --project e2e "${EXCLUDE_API_KEY_TESTS[@]}"
+fi

package/scripts/run-e2e-local.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Run E2E tests locally in the CI account, replicating the GitHub Actions e2e-tests.yml workflow.
+#
+# Required env vars:
+#   E2E_ROLE_ARN    — IAM role ARN to assume (grants access to the test account)
+#   E2E_SECRET_ARN  — Secrets Manager ARN containing ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY,
+#                     and (for payments tests) CDP_API_KEY_ID, CDP_API_KEY_SECRET, CDP_WALLET_SECRET
+#
+# Optional env vars:
+#   AWS_REGION      — defaults to us-east-1
+#   CDK_REPO_PATH   — local path to CDK constructs repo; if set, builds and uses it as CDK_TARBALL
+#
+# Usage:
+#   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role>
+#   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>
+#   ./scripts/run-e2e-local.sh                                  # runs strands-bedrock.test.ts (CI default)
+#   ./scripts/run-e2e-local.sh --all                            # runs the full e2e suite
+#   ./scripts/run-e2e-local.sh e2e-tests/foo.test.ts            # runs a specific test file
+#
+# Prerequisites: aws CLI, node >=20.19, npm, git, uv, jq
+
+set -euo pipefail
+
+ROLE_ARN="${E2E_ROLE_ARN:-}"
+SECRET_ARN="${E2E_SECRET_ARN:-}"
+AWS_REGION="${AWS_REGION:-us-east-1}"
+
+if [[ -z "$ROLE_ARN" ]]; then
+  echo "❌ E2E_ROLE_ARN is not set. Export it before running this script:"
+  echo "   export E2E_ROLE_ARN=arn:aws:iam::<account>:role/<role-name>"
+  exit 1
+fi
+
+if [[ -z "$SECRET_ARN" ]]; then
+  echo "❌ E2E_SECRET_ARN is not set. Export it before running this script:"
+  echo "   export E2E_SECRET_ARN=arn:aws:secretsmanager:<region>:<account>:secret:<name>"
+  exit 1
+fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ── Parse arguments ────────────────────────────────────────────────────────────
+RUN_ALL=false
+TEST_FILES=()
+for arg in "$@"; do
+  if [[ "$arg" == "--all" ]]; then
+    RUN_ALL=true
+  else
+    TEST_FILES+=("$arg")
+  fi
+done
+
+echo "=== Assuming IAM role ==="
+CREDS=$(aws sts assume-role \
+  --role-arn "$ROLE_ARN" \
+  --role-session-name "local-e2e-$(date +%s)" \
+  --duration-seconds 3600 \
+  --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
+  --output text)
+
+export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | awk '{print $1}')
+export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | awk '{print $2}')
+export AWS_SESSION_TOKEN=$(echo "$CREDS" | awk '{print $3}')
+export AWS_REGION
+
+echo "✅ Assumed role successfully"
+
+echo "=== Fetching API keys from Secrets Manager ==="
+SECRET_JSON=$(aws secretsmanager get-secret-value \
+  --secret-id "$SECRET_ARN" \
+  --region "$AWS_REGION" \
+  --query SecretString \
+  --output text)
+
+# Mirror the GitHub workflow: parse-json-secrets maps keys to E2E_<KEY> then
+# the workflow maps them to the bare names the tests expect.
+export ANTHROPIC_API_KEY=$(echo "$SECRET_JSON" | jq -r '.ANTHROPIC_API_KEY // empty')
+export OPENAI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.OPENAI_API_KEY // empty')
+export GEMINI_API_KEY=$(echo "$SECRET_JSON" | jq -r '.GEMINI_API_KEY // empty')
+
+# Filesystem (BYO EFS / S3 Files) test inputs — required by strands-bedrock-byo-filesystem.test.ts.
+export E2E_EFS_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.EFS_ACCESS_POINT_ARN // empty')
+export E2E_S3_ACCESS_POINT_ARN=$(echo "$SECRET_JSON" | jq -r '.S3_ACCESS_POINT_ARN // empty')
+export E2E_FILESYSTEM_SUBNET_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SUBNET_ID // empty')
+export E2E_FILESYSTEM_SECURITY_GROUP_ID=$(echo "$SECRET_JSON" | jq -r '.FILESYSTEM_SECURITY_GROUP_ID // empty')
+
+# Payments (CDP) test inputs — required by payment-strands-bedrock.test.ts.
+export CDP_API_KEY_ID=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_ID // empty')
+export CDP_API_KEY_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_API_KEY_SECRET // empty')
+export CDP_WALLET_SECRET=$(echo "$SECRET_JSON" | jq -r '.CDP_WALLET_SECRET // empty')
+
+echo "✅ Secrets loaded (keys present: $(echo "$SECRET_JSON" | jq -r 'keys | join(", ")')"
+
+echo "=== Setting AWS account env var ==="
+export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+echo "✅ AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID  AWS_REGION=$AWS_REGION"
+
+cd "$REPO_ROOT"
+
+echo "=== Verifying git is configured (required for agentcore create) ==="
+git_email="$(git config --global user.email || true)"
+git_name="$(git config --global user.name || true)"
+
+if [ -z "$git_email" ] || [ -z "$git_name" ]; then
+  echo "ERROR: git is not configured. 'agentcore create' requires a global git identity." >&2
+  echo "Set it with:" >&2
+  echo "  git config --global user.email \"you@example.com\"" >&2
+  echo "  git config --global user.name \"Your Name\"" >&2
+  exit 1
+fi
+
+echo "git configured as: $git_name <$git_email>"
+
+echo "=== Installing dependencies ==="
+npm ci
+
+echo "=== Building CLI ==="
+npm run build
+
+echo "=== Installing CLI globally ==="
+TARBALL=$(npm pack | tail -1)
+npm install -g "$TARBALL"
+echo "✅ Installed: $(agentcore --version)"
+
+echo "=== Running E2E tests ==="
+if [[ -n "${CDK_REPO_PATH:-}" ]]; then
+  echo "=== Building CDK constructs from $CDK_REPO_PATH ==="
+  pushd "$CDK_REPO_PATH" > /dev/null
+  npm ci
+  npm run build
+  CDK_TARBALL_NAME=$(npm pack | tail -1)
+  export CDK_TARBALL="$CDK_REPO_PATH/$CDK_TARBALL_NAME"
+  popd > /dev/null
+  echo "✅ CDK_TARBALL=$CDK_TARBALL"
+fi
+if [[ "$RUN_ALL" == "true" ]]; then
+  echo "Running full e2e suite"
+  npx vitest run --project e2e
+elif [[ ${#TEST_FILES[@]} -gt 0 ]]; then
+  echo "Running: ${TEST_FILES[*]}"
+  npx vitest run --project e2e "${TEST_FILES[@]}"
+else
+  echo "Running default: e2e-tests/strands-bedrock.test.ts"
+  npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts
+fi

package/scripts/safe-junit-reporter.ts

@@ -0,0 +1,7 @@
+import { JUnitReporter } from 'vitest/node';
+
+export default class SafeJUnitReporter extends JUnitReporter {
+  constructor() {
+    super({ includeConsoleOutput: false });
+  }
+}

package/scripts/sanitize-test-artifacts.ts

@@ -0,0 +1,65 @@
+import { redactTestOutput, sensitiveEnvironmentValues } from '../src/test-utils/test-output-redaction';
+import { lstat, readFile, readdir, writeFile } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+
+type Mode = 'check' | 'redact';
+
+async function collectFiles(inputPath: string): Promise<string[]> {
+  const absolutePath = resolve(inputPath);
+
+  try {
+    const fileStat = await lstat(absolutePath);
+    if (fileStat.isSymbolicLink()) {
+      throw new Error(`Symbolic links are not allowed in test artifacts: ${inputPath}`);
+    }
+    if (fileStat.isFile()) return [absolutePath];
+    if (!fileStat.isDirectory()) return [];
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+
+  const entries = await readdir(absolutePath, { withFileTypes: true });
+  const files = await Promise.all(entries.map(entry => collectFiles(resolve(absolutePath, entry.name))));
+  return files.flat();
+}
+
+async function main(): Promise<void> {
+  const [modeArgument, ...inputPaths] = process.argv.slice(2);
+  if ((modeArgument !== '--redact' && modeArgument !== '--check') || inputPaths.length === 0) {
+    throw new Error('Usage: tsx scripts/sanitize-test-artifacts.ts <--redact|--check> <path...>');
+  }
+
+  const mode = modeArgument.slice(2) as Mode;
+  const files = (await Promise.all(inputPaths.map(collectFiles))).flat();
+  const secretValues = sensitiveEnvironmentValues();
+  const affectedFiles: string[] = [];
+  let redactionCount = 0;
+
+  for (const file of files) {
+    const original = await readFile(file, 'utf8');
+    const result = redactTestOutput(original, secretValues);
+    if (result.redactions === 0) continue;
+
+    affectedFiles.push(relative(process.cwd(), file));
+    redactionCount += result.redactions;
+    if (mode === 'redact') await writeFile(file, result.text, 'utf8');
+  }
+
+  if (mode === 'check' && affectedFiles.length > 0) {
+    console.error(`Sensitive output detected in ${affectedFiles.length} artifact file(s): ${affectedFiles.join(', ')}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (mode === 'redact') {
+    console.log(`Redacted ${redactionCount} sensitive value(s) from ${affectedFiles.length} artifact file(s).`);
+  } else {
+    console.log(`No sensitive output detected in ${files.length} artifact file(s).`);
+  }
+}
+
+void main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});