@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/py/agent/__snapshots__/{generator.spec.ts.snap → generator.protocols.spec.ts.snap}

@@ -1,165 +1,5 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-Dockerfile 1`] = `
-"FROM public.ecr.aws/docker/library/python:3.14-slim
-
-WORKDIR /app
-
-# Copy bundled package
-COPY . /app
-
-EXPOSE 8080
-
-ENV PYTHONPATH=/app
-ENV PATH="/app/bin:\${PATH}"
-
-# Auto-instrument with AWS Distro for OpenTelemetry
-# https://aws-otel.github.io/docs/getting-started/python-sdk/auto-instr
-CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_test_project.snapshot_bedrock_agent.main"]
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-construct.ts 1`] = `
-"import { Lazy, Names } from 'aws-cdk-lib';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
-import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
-import { Construct } from 'constructs';
-import * as path from 'path';
-import * as url from 'url';
-import {
-  AgentRuntimeArtifact,
-  ProtocolType,
-  Runtime,
-  RuntimeProps,
-} from 'aws-cdk-lib/aws-bedrockagentcore';
-import {
-  PolicyStatement,
-  IGrantable,
-  IPrincipal,
-  Grant,
-} from 'aws-cdk-lib/aws-iam';
-import { RuntimeConfig } from '../../../core/runtime-config.js';
-import { findWorkspaceRoot } from '../../../core/workspace.js';
-
-export type SnapshotBedrockAgentProps = Omit<
-  RuntimeProps,
-  | 'runtimeName'
-  | 'protocolConfiguration'
-  | 'agentRuntimeArtifact'
-  | 'authorizerConfiguration'
->;
-
-export class SnapshotBedrockAgent
-  extends Construct
-  implements IGrantable, IConnectable
-{
-  public readonly dockerImage: AgentRuntimeArtifact;
-  public readonly agentCoreRuntime: Runtime;
-
-  constructor(scope: Construct, id: string, props?: SnapshotBedrockAgentProps) {
-    super(scope, id);
-
-    const rc = RuntimeConfig.ensure(this);
-
-    // Resolve the bundle output directory containing the Dockerfile and built artifacts
-    const bundleDir = path.join(
-      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-      'dist/apps/test-project/docker/snapshot-bedrock-agent',
-    );
-
-    this.dockerImage = AgentRuntimeArtifact.fromAsset(bundleDir, {
-      platform: Platform.LINUX_ARM64,
-    });
-
-    this.agentCoreRuntime = new Runtime(this, 'SnapshotBedrockAgent', {
-      runtimeName: Lazy.string({
-        produce: () =>
-          Names.uniqueResourceName(this.agentCoreRuntime, { maxLength: 40 }),
-      }),
-      protocolConfiguration: ProtocolType.HTTP,
-      agentRuntimeArtifact: this.dockerImage,
-      ...props,
-      environmentVariables: {
-        RUNTIME_CONFIG_APP_ID: rc.appConfigApplicationId,
-        ...props?.environmentVariables,
-      },
-    });
-
-    // Grant access for the agent to invoke bedrock models
-    this.agentCoreRuntime.addToRolePolicy(
-      new PolicyStatement({
-        actions: [
-          'bedrock:InvokeModel',
-          'bedrock:InvokeModelWithResponseStream',
-        ],
-        resources: [
-          'arn:aws:bedrock:*:*:foundation-model/*',
-          'arn:aws:bedrock:*:*:inference-profile/*',
-        ],
-      }),
-    );
-
-    rc.grantReadAppConfig(this.agentCoreRuntime);
-
-    rc.set('agentcore', 'agentRuntimes', {
-      ...rc.get('agentcore').agentRuntimes,
-      SnapshotBedrockAgent: this.agentCoreRuntime.agentRuntimeArn,
-    });
-  }
-
-  /**
-   * The principal to grant permissions to.
-   */
-  public get grantPrincipal(): IPrincipal {
-    return this.agentCoreRuntime.grantPrincipal;
-  }
-
-  /**
-   * Network connections for this agent runtime.
-   */
-  public get connections(): Connections {
-    return this.agentCoreRuntime.connections;
-  }
-
-  /**
-   * Grants IAM permissions to invoke this agent runtime.
-   *
-   * @param grantee - The IAM principal to grant permissions to
-   */
-  public grantInvokeAccess(grantee: IGrantable) {
-    this.agentCoreRuntime.grantInvoke(grantee);
-
-    Grant.addToPrincipal({
-      grantee,
-      actions: ['bedrock-agentcore:InvokeAgentRuntimeWithWebSocketStream'],
-      resourceArns: [
-        this.agentCoreRuntime.agentRuntimeArn,
-        \`\${this.agentCoreRuntime.agentRuntimeArn}/*\`,
-      ],
-    });
-  }
-}
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agents-index.ts 1`] = `
-"export * from './snapshot-bedrock-agent/snapshot-bedrock-agent.js';
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > app-index.ts 1`] = `
-"export * from './agents/index.js';
-"
-`;
-
-exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > core-index.ts 1`] = `
-"export * from './app.js';
-export * from './checkov.js';
-export * from './runtime-config.js';
-export * from './workspace.js';
-"
-`;
-
 exports[`py#agent generator > should match snapshot for Terraform generated files > terraform-agent.tf 1`] = `
 "variable "env" {
   description = "Environment variables to pass to the agent core runtime"
@@ -262,15 +102,15 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 6.23"
+      version = "6.52.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -353,8 +193,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -528,25 +367,37 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       # Get ECR login token
-      aws ecr get-login-password --region \${local.aws_region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
+      # Tag the image with the immutable content-based tag
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      docker push \${self.triggers.repository_url}:latest
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = local.aws_region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
@@ -560,7 +411,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
     }
   }
 
@@ -593,6 +444,63 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   ]
 }
 
+# MCP consumers (e.g. gateway targets, which fetch tools at creation) can race
+# the runtime's first cold start, so probe it until it serves MCP. The ARN
+# output is routed through this resource so consumers wait for readiness.
+resource "null_resource" "runtime_ready" {
+  count = var.server_protocol == "MCP" ? 1 : 0
+
+  triggers = {
+    runtime_arn = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      uv run --with boto3==1.43.37 python -c "
+import boto3
+import json
+import os
+import time
+import uuid
+
+runtime_arn = os.environ['RUNTIME_ARN']
+client = boto3.client('bedrock-agentcore')
+initialize_request = json.dumps({
+    'jsonrpc': '2.0',
+    'id': 1,
+    'method': 'initialize',
+    'params': {
+        'protocolVersion': '2025-03-26',
+        'capabilities': {},
+        'clientInfo': {'name': 'readiness-probe', 'version': '1.0'},
+    },
+})
+
+deadline = time.time() + 5 * 60
+while True:
+    try:
+        client.invoke_agent_runtime(
+            agentRuntimeArn=runtime_arn,
+            runtimeSessionId=f'readiness-probe-{uuid.uuid4()}',
+            contentType='application/json',
+            accept='application/json, text/event-stream',
+            payload=initialize_request,
+        )
+        break
+    except Exception:
+        if time.time() >= deadline:
+            raise
+        time.sleep(5)
+
+print(f'Runtime {runtime_arn} is serving MCP')
+"
+    EOT
+    environment = {
+      RUNTIME_ARN = self.triggers.runtime_arn
+    }
+  }
+}
+
 # Outputs
 output "agent_core_runtime_role_arn" {
   description = "ARN of the Agent Core Runtime IAM role"
@@ -610,8 +518,8 @@ output "agent_runtime_name" {
 }
 
 output "agent_core_runtime_arn" {
-  description = "ARN of the Bedrock Agent Core runtime"
-  value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
+  description = "ARN of the Bedrock Agent Core runtime. For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = var.server_protocol == "MCP" ? null_resource.runtime_ready[0].triggers.runtime_arn : aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
 }
 
 output "agent_runtime_id" {
@@ -625,145 +533,3 @@ output "agent_runtime_version" {
 }
 "
 `;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-__init__.py 1`] = `""`;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-agent.py 1`] = `
-"from contextlib import contextmanager
-
-from strands import Agent, tool
-from strands_tools import current_time
-
-
-@tool
-def subtract(a: int, b: int) -> int:
-    return a - b
-
-
-@contextmanager
-def get_agent():
-    yield Agent(
-        name="SnapshotAgent",
-        description="SnapshotAgent Strands Agent",
-        system_prompt="""
-You are a mathematical wizard.
-Use your tools for mathematical tasks.
-Refer to tools as your 'spellbook'.
-""",
-        tools=[subtract, current_time],
-    )
-"
-`;
-
-exports[`py#agent generator > should match snapshot for generated files > agent-main.py 1`] = `
-"import uuid
-
-import uvicorn
-from bedrock_agentcore.runtime.models import PingStatus
-from fastapi import Request
-from pydantic import BaseModel
-from starlette.middleware.base import BaseHTTPMiddleware
-from proj_agent_connection import session_id_context, with_session_id
-
-from .agent import get_agent
-from .init import JsonStreamingResponse, app
-
-SESSION_ID_HEADER = "x-amzn-bedrock-agentcore-runtime-session-id"
-
-_agent_ctx = with_session_id(
-    get_agent,
-    name="SnapshotAgent",
-    description="A Strands Agent exposed via HTTP streaming.",
-)
-_agent = _agent_ctx.__enter__()
-
-
-class InvokeInput(BaseModel):
-    message: str
-
-
-class StreamChunk(BaseModel):
-    content: str
-
-
-async def handle_invoke(input: InvokeInput):
-    """Streaming handler for agent invocation"""
-    stream = _agent.stream_async(input.message)
-    async for event in stream:
-        print(event)
-        text = (
-            event.get("event", {})
-            .get("contentBlockDelta", {})
-            .get("delta", {})
-            .get("text")
-        )
-        if text is not None:
-            yield StreamChunk(content=text)
-        elif event.get("event", {}).get("messageStop") is not None:
-            yield StreamChunk(content="\\n")
-
-
-@app.post(
-    "/invocations",
-    response_class=JsonStreamingResponse,
-    responses={
-        200: JsonStreamingResponse.openapi_response(
-            StreamChunk, "Stream of agent response chunks"
-        )
-    },
-)
-async def invoke(input: InvokeInput) -> JsonStreamingResponse:
-    """Entry point for agent invocation"""
-    return JsonStreamingResponse(handle_invoke(input))
-
-
-class _SessionIdMiddleware(BaseHTTPMiddleware):
-    """Bind the inbound session (or a fresh UUID) to async context."""
-
-    async def dispatch(self, request: Request, call_next):
-        session_id = request.headers.get(SESSION_ID_HEADER) or str(uuid.uuid4())
-        with session_id_context(session_id):
-            return await call_next(request)
-
-
-app.add_middleware(_SessionIdMiddleware)
-
-
-@app.get("/ping")
-def ping() -> str:
-    # TODO: if running an async task, return PingStatus.HEALTHY_BUSY
-    return PingStatus.HEALTHY
-
-
-if __name__ == "__main__":
-    uvicorn.run("proj_test_project.snapshot_agent.main:app", port=8080)
-"
-`;
-
-exports[`py#agent generator > should match snapshot for generated files > updated-pyproject.toml 1`] = `
-"[project]
-name = "proj.test_project"
-version = "0.1.0"
-dependencies = [
-  "proj.agent_connection",
-  "aws-lambda-powertools==3.29.0",
-  "aws-opentelemetry-distro==0.17.1",
-  "bedrock-agentcore==1.13.0",
-  "boto3==1.43.20",
-  "fastapi==0.136.3",
-  "mcp==1.27.2",
-  "strands-agents==1.42.0",
-  "strands-agents-tools==0.7.0",
-  "uvicorn==0.48.0"
-]
-
-[dependency-groups]
-dev = [ "fastapi[standard]==0.136.3" ]
-
-[tool.uv]
-dev-dependencies = [ ]
-
-[tool.uv.sources."proj.agent_connection"]
-workspace = true
-"
-`;

package/src/py/agent/a2a-connection/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,189 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`py#agent#a2a-connection generator > should match snapshot for agent-connection core files > agentcore_a2a_client_config.py 1`] = `
+"from collections.abc import Callable
+
+import boto3
+import httpx
+from a2a.client import ClientConfig
+
+from .agentcore_endpoints import a2a_url_from_arn, region_from_arn
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+
+def _config(url: str, auth: httpx.Auth) -> tuple[str, ClientConfig]:
+    httpx_client = httpx.AsyncClient(auth=auth, timeout=120)
+    return url, ClientConfig(httpx_client=httpx_client, streaming=False)
+
+
+class AgentCoreA2aClientConfig:
+    """Factory for A2A client configs that connect to a Bedrock AgentCore
+    runtime. Each forwards the current async-context session via the AgentCore
+    session header. Framework-agnostic — wrap the result in a framework's
+    A2A client."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> tuple[str, ClientConfig]:
+        """SigV4-authenticated A2A client config for a Bedrock AgentCore runtime."""
+        region = region_from_arn(agent_runtime_arn)
+        credentials = boto3.Session(region_name=region).get_credentials()
+        return _config(a2a_url_from_arn(agent_runtime_arn), sigv4_auth(credentials, region))
+
+    @staticmethod
+    def with_jwt_auth(agent_runtime_arn: str, access_token_provider: Callable[[], str]) -> tuple[str, ClientConfig]:
+        """Bearer-authenticated A2A client config for a Bedrock AgentCore runtime."""
+        return _config(a2a_url_from_arn(agent_runtime_arn), jwt_auth(access_token_provider))
+
+    @staticmethod
+    def without_auth(url: str) -> tuple[str, ClientConfig]:
+        """Plain-HTTP A2A client config — for local dev."""
+        return _config(url, plain_auth())
+"
+`;
+
+exports[`py#agent#a2a-connection generator > should match snapshot for agent-connection core files > agentcore_a2a_client_strands.py 1`] = `
+"from collections.abc import Callable
+
+from strands.agent.a2a_agent import A2AAgent
+
+from .agentcore_a2a_client_config import AgentCoreA2aClientConfig
+
+
+def _build(config: tuple, *, name: str | None, description: str | None) -> A2AAgent:
+    url, client_config = config
+    kwargs: dict = {"endpoint": url, "client_config": client_config}
+    if name:
+        kwargs["name"] = name
+    if description:
+        kwargs["description"] = description
+    return A2AAgent(**kwargs)
+
+
+class AgentCoreA2aClientStrands:
+    """Factory for Strands A2A clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(
+        agent_runtime_arn: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_iam_auth(agent_runtime_arn),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str,
+        access_token_provider: Callable[[], str],
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_jwt_auth(agent_runtime_arn, access_token_provider),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def without_auth(
+        url: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Plain-HTTP client — for local dev."""
+        return _build(
+            AgentCoreA2aClientConfig.without_auth(url),
+            name=name,
+            description=description,
+        )
+"
+`;
+
+exports[`py#agent#a2a-connection generator > should match snapshot for agent-connection core files > remote_client_strands.py 1`] = `
+"import os
+
+from strands.agent.a2a_agent import A2AAgent
+
+from test_agent_connection.core.agentcore_a2a_client_strands import (
+    AgentCoreA2aClientStrands,
+)
+from test_agent_connection.core.runtime_config import (
+    get_agentcore_runtime_config,
+)
+
+
+class RemoteClientStrands:
+    """Strands client for the Remote A2A agent."""
+
+    @staticmethod
+    def create() -> A2AAgent:
+        if os.environ.get("LOCAL_DEV") == "true":
+            return AgentCoreA2aClientStrands.without_auth("http://localhost:9001/")
+        config = get_agentcore_runtime_config()
+        agent_runtime_arn = config.get("agentRuntimes", {}).get("Remote")
+        if not agent_runtime_arn:
+            raise RuntimeError("No connected agent runtime named 'Remote' found in runtime configuration.")
+        return AgentCoreA2aClientStrands.with_iam_auth(agent_runtime_arn)
+"
+`;
+
+exports[`py#agent#a2a-connection generator > should match snapshot for agent-connection core files > session.py 1`] = `
+"from collections.abc import Callable
+
+import httpx
+
+from ..session_context import get_current_session_id
+from .sigv4 import SigV4HTTPXAuth
+
+SESSION_HEADER = "X-Amzn-Bedrock-AgentCore-Runtime-Session-Id"
+
+
+class SessionHeaderAuth(httpx.Auth):
+    """Stamps the AgentCore session header from the current async context,
+    then delegates to an optional inner auth (e.g. SigV4)."""
+
+    requires_request_body = True
+    requires_response_body = True
+
+    def __init__(self, inner: httpx.Auth | None = None):
+        self._inner = inner
+
+    def auth_flow(self, request: httpx.Request):  # type: ignore[override]
+        sid = get_current_session_id()
+        if sid:
+            request.headers[SESSION_HEADER] = sid
+        if self._inner is None:
+            yield request
+            return
+        yield from self._inner.auth_flow(request)
+
+
+def sigv4_auth(credentials, region: str, service: str = "bedrock-agentcore") -> httpx.Auth:
+    """Session-forwarding SigV4 auth (per-request, body-aware)."""
+    return SessionHeaderAuth(SigV4HTTPXAuth(credentials, service, region))
+
+
+def jwt_auth(access_token_provider: Callable[[], str]) -> httpx.Auth:
+    """Session-forwarding bearer-token auth."""
+
+    class _Bearer(httpx.Auth):
+        def auth_flow(self, request: httpx.Request):
+            request.headers["Authorization"] = f"Bearer {access_token_provider()}"
+            yield request
+
+    return SessionHeaderAuth(_Bearer())
+
+
+def plain_auth() -> httpx.Auth:
+    """Session-forwarding plain auth — for local dev."""
+    return SessionHeaderAuth()
+"
+`;

package/src/py/agent/a2a-connection/files/agent-connection/app/__targetAgentSnakeCase___client_strands.py.template

@@ -0,0 +1,30 @@
+import os
+
+from strands.agent.a2a_agent import A2AAgent
+
+from <%- agentConnectionModuleName %>.core.agentcore_a2a_client_strands import (
+    AgentCoreA2aClientStrands,
+)
+from <%- agentConnectionModuleName %>.core.runtime_config import (
+    get_agentcore_runtime_config,
+)
+
+
+class <%- targetAgentClassName %>ClientStrands:
+    """Strands client for the <%- targetAgentClassName %> A2A agent."""
+
+    @staticmethod
+    def create() -> A2AAgent:
+        if os.environ.get("LOCAL_DEV") == "true":
+            return AgentCoreA2aClientStrands.without_auth(
+                "http://localhost:<%- targetAgentPort %>/"
+            )
+        config = get_agentcore_runtime_config()
+        agent_runtime_arn = config.get("agentRuntimes", {}).get(
+            "<%- targetAgentClassName %>"
+        )
+        if not agent_runtime_arn:
+            raise RuntimeError(
+                "No connected agent runtime named '<%- targetAgentClassName %>' found in runtime configuration."
+            )
+        return AgentCoreA2aClientStrands.with_iam_auth(agent_runtime_arn)