@deployfoundation/foundation-deploy 0.2.40 → 0.2.42

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-fwqmac5n.js";
+} from "../chunk-sgh3agpa.js";
 import {
   adminsFor,
   instanceNames,
@@ -18,9 +18,43 @@ import {
 import"../chunk-dz91avrb.js";
 
 // bin/app.ts
+import * as cdk from "aws-cdk-lib";
+
+// src/deploy/repo-path.ts
 import { execFileSync } from "node:child_process";
 import { basename, dirname, relative, resolve, sep } from "node:path";
-import * as cdk from "aws-cdk-lib";
+function inside(root, absolute) {
+  const rel = relative(root, absolute);
+  return rel !== "" && !rel.startsWith("..") ? rel.split(sep).join("/") : undefined;
+}
+function gitTopLevel(directory) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: directory,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+  } catch {
+    return;
+  }
+}
+function repoRelativePath(filePath, env = process.env, topLevel = gitTopLevel) {
+  const absolute = resolve(filePath);
+  const codebuildRoot = env.CODEBUILD_SRC_DIR;
+  if (codebuildRoot !== undefined && codebuildRoot !== "") {
+    const rel = inside(resolve(codebuildRoot), absolute);
+    if (rel !== undefined)
+      return rel;
+  }
+  const top = topLevel(dirname(absolute));
+  if (top !== undefined) {
+    const rel = inside(top, absolute);
+    if (rel !== undefined)
+      return rel;
+  }
+  return basename(absolute);
+}
+
+// bin/app.ts
 var app = new cdk.App;
 var instanceFilePath = app.node.tryGetContext("instanceFile");
 if (instanceFilePath === undefined || instanceFilePath === "")
@@ -109,19 +143,6 @@ if (instance.newsletter.enabled)
   });
 cdk.Tags.of(app).add("project", instance.naming.secretPrefix);
 app.synth();
-function repoRelativePath(filePath) {
-  const absolute = resolve(filePath);
-  try {
-    const top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: dirname(absolute),
-      stdio: ["ignore", "pipe", "ignore"]
-    }).toString().trim();
-    const rel = relative(top, absolute);
-    if (rel !== "" && !rel.startsWith(".."))
-      return rel.split(sep).join("/");
-  } catch {}
-  return basename(absolute);
-}
 export {
   env
 };

package/dist/bin/foundation-deploy.js

@@ -1043,6 +1043,21 @@ var SMOKE_EXPECT = ['"authenticated":true', '"config_source":"s3"'];
 function smokeSessionId(prefix) {
   return `${prefix}-${Math.floor(Date.now() / 1000)}`.padEnd(40, "0");
 }
+async function stopSmokeSession(runner, opts, log) {
+  try {
+    await runner.capture([
+      "bedrock-agentcore",
+      "stop-runtime-session",
+      "--agent-runtime-arn",
+      opts.arn,
+      ...opts.qualifier === undefined ? [] : ["--qualifier", opts.qualifier],
+      "--runtime-session-id",
+      opts.sessionId
+    ]);
+  } catch {
+    log("  (could not stop the smoke session; it ends at the idle timeout)");
+  }
+}
 async function smokeInvoke(runner, opts) {
   const log = opts.log ?? ((line) => console.log(line));
   const payload = opts.payload ?? '{"_smoke_test":true}';
@@ -1070,6 +1085,7 @@ async function smokeInvoke(runner, opts) {
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
+  await stopSmokeSession(runner, opts, log);
   log(`  ${out.replaceAll(`
 `, `
   `)}`);

package/dist/{chunk-fwqmac5n.js → chunk-sgh3agpa.js}

@@ -1104,6 +1104,14 @@ class FoundationApi extends cdk2.Stack {
         `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
       ]
     }));
+    invokerRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "StopSingleUseRuntimeSessions",
+      actions: ["bedrock-agentcore:StopRuntimeSession"],
+      resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
+      ]
+    }));
     invokerRole.addToPolicy(new iam2.PolicyStatement({
       sid: "ReadRuntimeEndpointVersion",
       actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
@@ -1937,6 +1945,7 @@ function deployStatements(stack, names, targets, instance) {
       sid: "SmokeTestRuntime",
       actions: [
         "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:StopRuntimeSession",
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-fwqmac5n.js";
+} from "../chunk-sgh3agpa.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.40",
+  "version": "0.2.42",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/endpoint.ts

@@ -214,6 +214,32 @@ export interface SmokeOptions {
   log?: (line: string) => void;
 }
 
+/**
+ * End a smoke session once it has answered. Its id is minted per invoke and
+ * never used again, so otherwise the microVM idles out its whole idle timeout
+ * billed for its memory (~2 GB-hours each; a deploy runs three). Best-effort:
+ * a deployer without the permission still deploys.
+ */
+async function stopSmokeSession(
+  runner: EndpointRunner,
+  opts: SmokeOptions,
+  log: (line: string) => void,
+): Promise<void> {
+  try {
+    await runner.capture([
+      "bedrock-agentcore",
+      "stop-runtime-session",
+      "--agent-runtime-arn",
+      opts.arn,
+      ...(opts.qualifier === undefined ? [] : ["--qualifier", opts.qualifier]),
+      "--runtime-session-id",
+      opts.sessionId,
+    ]);
+  } catch {
+    log("  (could not stop the smoke session; it ends at the idle timeout)");
+  }
+}
+
 /** Invoke the runtime and assert the response says what a healthy runtime says. */
 export async function smokeInvoke(runner: EndpointRunner, opts: SmokeOptions): Promise<void> {
   const log = opts.log ?? ((line: string) => console.log(line));
@@ -250,6 +276,7 @@ export async function smokeInvoke(runner: EndpointRunner, opts: SmokeOptions): P
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
+  await stopSmokeSession(runner, opts, log);
   log(`  ${out.replaceAll("\n", "\n  ")}`);
   for (const needle of opts.expect ?? SMOKE_EXPECT)
     if (!out.includes(needle)) throw new Error(`smoke test: response does not contain ${needle}`);

package/src/deploy/repo-path.ts

@@ -0,0 +1,54 @@
+/**
+ * The instance file's path INSIDE the instance repository, which is what the
+ * pipeline's CodeBuild project is told to deploy from.
+ *
+ * Two places run a deploy, and they find the repository root differently:
+ *
+ * - A person's checkout is a git work tree, so `git rev-parse` names the root.
+ * - CodeBuild unpacks CodePipeline's source artifact into `CODEBUILD_SRC_DIR`.
+ *   That is a zip of the repository, not a git work tree, so `git rev-parse`
+ *   fails there. Falling back to the bare file name made every pipeline deploy
+ *   rewrite its own `FOUNDATION_INSTANCE_FILE` to `instance.yaml`, and the
+ *   next run failed with "no instance file" (Sky and Olivia, 2026-10-11).
+ */
+import { execFileSync } from "node:child_process";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+
+/** `rel` when it names a file under the root, else undefined. */
+function inside(root: string, absolute: string): string | undefined {
+  const rel = relative(root, absolute);
+  return rel !== "" && !rel.startsWith("..") ? rel.split(sep).join("/") : undefined;
+}
+
+function gitTopLevel(directory: string): string | undefined {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd: directory,
+      stdio: ["ignore", "pipe", "ignore"],
+    })
+      .toString()
+      .trim();
+  } catch {
+    // Not inside a git work tree.
+    return undefined;
+  }
+}
+
+export function repoRelativePath(
+  filePath: string,
+  env: Record<string, string | undefined> = process.env,
+  topLevel: (directory: string) => string | undefined = gitTopLevel,
+): string {
+  const absolute = resolve(filePath);
+  const codebuildRoot = env.CODEBUILD_SRC_DIR;
+  if (codebuildRoot !== undefined && codebuildRoot !== "") {
+    const rel = inside(resolve(codebuildRoot), absolute);
+    if (rel !== undefined) return rel;
+  }
+  const top = topLevel(dirname(absolute));
+  if (top !== undefined) {
+    const rel = inside(top, absolute);
+    if (rel !== undefined) return rel;
+  }
+  return basename(absolute);
+}

package/src/deploy-permissions.ts

@@ -175,11 +175,13 @@ export function deployStatements(
     // `foundation-deploy post-deploy` (and `deploy`'s inline promotion): the
     // smoke test (`_smoke_test`, `_fs_probe`) against DEFAULT, then promotion
     // of the new version onto `live`, which CREATES `live` when an instance
-    // brought up by `deploy` alone has none yet (`promoteEndpoint`).
+    // brought up by `deploy` alone has none yet (`promoteEndpoint`). Each
+    // smoke session is stopped once it answers: nothing invokes it again.
     new iam.PolicyStatement({
       sid: "SmokeTestRuntime",
       actions: [
         "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:StopRuntimeSession",
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",

package/src/stacks/api-stack.ts

@@ -529,6 +529,19 @@ export class FoundationApi extends cdk.Stack {
         ],
       }),
     );
+    // A routine fire's session is single-use: the invoker ends it as soon as
+    // the fire answers instead of paying for its memory through the idle
+    // timeout (`isSingleUseSession` in gateway/src/invoker.ts).
+    invokerRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "StopSingleUseRuntimeSessions",
+        actions: ["bedrock-agentcore:StopRuntimeSession"],
+        resources: [
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`,
+        ],
+      }),
+    );
     // Which version the endpoint serves: the invoker names it in the session
     // id so a thread moves off a pre-deploy microVM on its next turn.
     invokerRole.addToPolicy(