bedrock-agentcore-starter-toolkit 0.1.24__tar.gz → 0.2.2__tar.gz

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/deploy-docs.yml

@@ -42,7 +42,7 @@ jobs:
           uv venv
           source .venv/bin/activate
           uv pip install mkdocs-material mkdocstrings-python pymdown-extensions
-          uv pip install mike mkdocs-macros-plugin mkdocs-llmstxt
+          uv pip install mike mkdocs-macros-plugin mkdocs-llmstxt mkdocs-include-markdown-plugin
 
           # Install the SDK package from PyPI
           uv pip install bedrock-agentcore

bedrock_agentcore_starter_toolkit-0.2.2/.github/workflows/integration_testing.yml

@@ -0,0 +1,168 @@
+name: Secure Integration test
+
+on:
+  push:
+    branches: [ main ]
+    tags:
+      - 'v*'
+  pull_request_target:  # Changed from pull_request
+    branches: [ main ]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  authorization-check:
+    permissions: read-all
+    runs-on: ubuntu-latest
+    outputs:
+      approval-env: ${{ steps.collab-check.outputs.result }}
+      should-run: ${{ steps.safety-check.outputs.result }}
+    steps:
+      - name: Checkout base branch for safety check
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+
+      - name: Safety Check - Prevent Workflow Modification Attacks
+        id: safety-check
+        uses: actions/github-script@v7
+        with:
+          result-encoding: string
+          script: |
+            if (!context.payload.pull_request) {
+              console.log('Not a pull request, proceeding');
+              return 'true';
+            }
+
+            // Get list of changed files
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            // Check if any workflow files or sensitive files are modified
+            const dangerousPatterns = [
+              /^\.github\/workflows\//,
+              /^\.github\/actions\//,
+              /conftest\.py$/,
+              /pytest\.ini$/,
+              /^tests\/conftest_mock\.py$/,
+            ];
+
+            const dangerousFiles = files.filter(file =>
+              dangerousPatterns.some(pattern => pattern.test(file.filename))
+            );
+
+            if (dangerousFiles.length > 0) {
+              console.log('⚠️ SECURITY: PR modifies sensitive files:');
+              dangerousFiles.forEach(f => console.log(`  - ${f.filename}`));
+              console.log('Manual review required before running integration tests');
+              return 'false';
+            }
+
+            console.log('✓ Safety check passed - no sensitive files modified');
+            return 'true';
+
+      - name: Collaborator Check
+        uses: actions/github-script@v7
+        id: collab-check
+        with:
+          result-encoding: string
+          script: |
+            try {
+              let username;
+              if (context.payload.pull_request) {
+                username = context.payload.pull_request.user.login;
+              } else {
+                username = context.actor;
+                console.log(`No pull request context found, checking permissions for actor: ${username}`);
+              }
+
+              const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: username,
+              });
+              const permission = permissionResponse.data.permission;
+              const hasWriteAccess = ['write', 'admin'].includes(permission);
+              if (!hasWriteAccess) {
+                console.log(`User ${username} does not have write access to the repository (permission: ${permission})`);
+                return "manual-approval"
+              } else {
+                console.log(`Verified ${username} has write access. Auto Approving PR Checks.`)
+                return "auto-approve"
+              }
+            } catch (error) {
+              console.log(`${username} does not have write access. Requiring Manual Approval to run PR Checks.`)
+              return "manual-approval"
+            }
+
+  check-access-and-checkout:
+    runs-on: ubuntu-latest
+    needs: authorization-check
+    if: needs.authorization-check.outputs.should-run == 'true'
+    environment: ${{ needs.authorization-check.outputs.approval-env }}
+    permissions:
+      id-token: write
+      pull-requests: read
+      contents: read
+    steps:
+      - name: Configure Credentials
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+         role-to-assume: ${{ secrets.AGENTCORE_INTEG_TEST_ROLE }}
+         aws-region: us-west-2
+         mask-aws-account-id: true
+
+      - name: Checkout PR head commit
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+
+      - name: Install dependencies
+        run: |
+          pip install -e .
+          pip install --no-cache-dir pytest click
+
+      - name: Run integration tests
+        env:
+          AWS_REGION: us-west-2
+          AGENTCORE_TEST_ROLE: AgentExecutionRole
+        id: tests
+        timeout-minutes: 10
+        run: |
+          pytest tests_integ/cli -s --log-cli-level=INFO
+
+  safety-gate:
+    runs-on: ubuntu-latest
+    needs: authorization-check
+    if: needs.authorization-check.outputs.should-run == 'false'
+    permissions: {}
+    steps:
+      - name: Security Block
+        run: |
+          echo "🚨 SECURITY BLOCK: This PR modifies sensitive files"
+          echo ""
+          echo "The following types of files trigger manual review:"
+          echo "  - Workflow files (.github/workflows/)"
+          echo "  - Action files (.github/actions/)"
+          echo "  - Test setup files (conftest.py, pytest.ini)"
+          echo ""
+          echo "⚠️  Integration tests will NOT run automatically"
+          echo "👀 A maintainer must review the changes and manually trigger tests"
+          echo ""
+          echo "This is a security measure to prevent:"
+          echo "  - Workflow modification attacks"
+          echo "  - Secret exfiltration"
+          echo "  - Test manipulation"
+          exit 1

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/.github/workflows/pr-automerge.yml

@@ -33,7 +33,7 @@ jobs:
 
             // Include ALL required checks
             const requiredChecks = [
-              'Lint',
+              'Lint and Format',
               'Test Python 3.10',
               'Test Python 3.11',
               'Test Python 3.12',

bedrock_agentcore_starter_toolkit-0.2.2/.github/workflows/test.yml

@@ -0,0 +1,108 @@
+name: Test
+
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  lint:
+    name: Lint and Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Create virtual environment
+        run: uv venv
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run pre-commit
+        run: uv run pre-commit run --all-files
+
+  test:
+    name: Test Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false  # Important: don't stop on first failure
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Create virtual environment
+        run: uv venv
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run tests with coverage
+        run: |
+          uv run pytest tests/ --cov=src --cov-report=xml --cov-report=term --cov-fail-under=80 \
+            -k "not test_launch_help_text_updated"
+
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.10'
+        uses: codecov/codecov-action@v5
+        with:
+          file: ./coverage.xml
+          flags: unittests
+          name: codecov-umbrella
+          fail_ci_if_error: false
+
+  build:
+    name: Build Package
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Build package
+        run: uv build
+
+      - name: Check package
+        run: uv tool run twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/.gitignore

@@ -27,3 +27,8 @@ specs/
 .specify/
 coverage.json
 CLAUDE.md
+mise.toml
+.idea/
+!tests/create/fixtures/scenarios/
+!tests/create/fixtures/scenarios/**
+.kiro/

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/.pre-commit-config.yaml

@@ -1,45 +1,66 @@
 repos:
-  # uv hooks
+  # ========================================
+  # PRE-COMMIT STAGE (Fast, Auto-fixing)
+  # Runs on every commit
+  # ========================================
+
+  # uv lock file management
   - repo: https://github.com/astral-sh/uv-pre-commit
-    # uv version
     rev: 0.7.13
     hooks:
-      # Keep uv.lock in sync with pyproject.toml
       - id: uv-lock
+        stages: [pre-commit]
 
-  # Code formatting and linting
+  # Code formatting and linting (FAST + AUTO-FIX)
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    # Ruff version
     rev: v0.12.0
     hooks:
-      # Run the linter
       - id: ruff
-        args: [--fix]
-      # Run the formatter
+        args: [--fix, --exit-non-zero-on-fix]
+        stages: [pre-commit]
       - id: ruff-format
+        stages: [pre-commit]
 
-  # Basic file hygiene
+  # Basic file hygiene (FAST + AUTO-FIX)
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
+        exclude: ^tests/create/__snapshots__/.*\.ambr$
+        stages: [pre-commit]
       - id: end-of-file-fixer
+        stages: [pre-commit]
       - id: check-toml
+        stages: [pre-commit]
       - id: check-json
+        stages: [pre-commit]
+      - id: check-yaml
+        exclude: ^documentation/mkdocs\.yaml$
+        stages: [pre-commit]
       - id: check-merge-conflict
+        stages: [pre-commit]
       - id: check-added-large-files
+        args: ['--maxkb=1000']
+        stages: [pre-commit]
       - id: debug-statements
+        stages: [pre-commit]
+
+  # ========================================
+  # PRE-PUSH STAGE (Heavier checks)
+  # Runs before push
+  # ========================================
 
-  # Security checks
+  # Security scanning
   - repo: https://github.com/PyCQA/bandit
     rev: '1.7.9'
     hooks:
       - id: bandit
-        args: ['-r', 'src/']
+        args: ['-r', 'src/', '-ll']
         pass_filenames: false
         types: [python]
+        stages: [pre-push]
 
-  # Unit tests with coverage
+  # Full test suite with coverage (same as you had before)
   - repo: local
     hooks:
       - id: pytest-cov
@@ -49,6 +70,7 @@ repos:
         types: [python]
         pass_filenames: false
         always_run: true
+        stages: [pre-push]  # Moved from pre-commit to pre-push
         args: [
           --cov=src,
           --cov-report=term-missing,
@@ -58,6 +80,10 @@ repos:
           tests/
         ]
 
+# ========================================
+# Configuration
+# ========================================
+
 default_language_version:
   python: python3.10
 
@@ -74,4 +100,4 @@ ci:
   submodules: false
 
 default_install_hook_types: [pre-commit, pre-push]
-default_stages: [pre-commit, pre-push]
+default_stages: [pre-commit]

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/CHANGELOG.md

@@ -1,5 +1,153 @@
 # Changelog
 
+## [0.2.2] - 2025-12-04
+
+### Changes
+
+- feat(identity): Add AWS JWT federation support for  M2M auth (#382) (2b492c6)
+- docs: add WebSocket bi-directional streaming to runtime overview (#392) (b8fa78c)
+- Add require aws creds decorator to policy cli commands (#391) (cd3758b)
+- add aws docs link in quickstart guides for Runtime, Identity, Policy, Observability, Memory (#389) (52cf2ed)
+- chore: bump version to 0.2.1 (#390) (c4d573e)
+
+## [0.2.1] - 2025-12-02
+
+### Changes
+
+- fix: catch the expired creds exception and throw it using the method in utils (#388) (9826b08)
+- re:Invent 2025 Feature Launch: AgentCore Policy Engine, Evals and Identity Custom Claims (#387) (70e3078)
+- fix: Fail early if deployment package size exceeds 250MB (#386) (916f81d)
+- fix: agent_config.name bug when running configure after create with production template mode (#384) (824316c)
+- docs: update middleware integration in Runtime Overview (#381) (48968f4)
+- fix: add missing basic template README. Also fix erroneous print statment in IAC path (#377) (63970da)
+- feat: CLI UX improvements (#380) (da80cf5)
+- chore: bump version to 0.2.0 (#376) (31a37ff)
+
+## [0.2.0] - 2025-11-27
+
+### Changes
+
+- nit: spellcheck changes (#375) (ab82659)
+- fix: remove unused imports; fix documentation pages (#374) (b6628a7)
+- feat: change 'launch' command to 'deploy' command with backwards compatibility (#370) (4d66714)
+- Update readme copy (#373) (7e7f089)
+- Auto-enable CloudWatch observability  (#372) (f46e8e8)
+- feat: implement agentcore create command. Related updates are made to… (#364) (ec1ce0f)
+- docs: update async processing documentation to use manual task management (#371) (e47a5a0)
+- feat: add multi-platform ARM64 support for dependency packaging (9932a85)
+- update transaction search enablement instructions (#367) (b802d79)
+- chore(doc): add memory and gateway to cli documentation (#363) (06c3282)
+- feat: Add comprehensive observability CLI for agent telemetry (#360) (86c2390)
+- chore: bump version to 0.1.34 (#355) (76dda3a)
+
+## [0.1.34] - 2025-11-19
+
+### Changes
+
+- docs: add identity CLI quickstart and fix claude SDK path (#353) (1415eb3)
+- feat: Add Memory/Gateway CLI support (#338) (70c4dee)
+- feat: add Identity CLI commands for managing OAuth authentication and external service access (#332) (1dcc546)
+- Add AWS Marketplace subscription permissions to execution role (#349) (0707685)
+- chore: bump version to 0.1.33 (#347) (bc978cc)
+
+## [0.1.33] - 2025-11-15
+
+### Changes
+
+- Update aws-opentelemetry-distro version in Dockerfile (#346) (d878ff8)
+- chore: bump version to 0.1.32 (#335) (65e7ff2)
+
+## [0.1.32] - 2025-11-06
+
+### Changes
+
+- Minor bug fix: Plumb --region command through into ConfigurationManager (#333) (8c2aee5)
+- fix: Remove ExpectedBucketOwner parameter from create_bucket method (0c57292)
+- ci: add Python version matrix testing to PRs (#329) (9714c81)
+- chore: bump version to 0.1.31 (#328) (120639b)
+
+## [0.1.31] - 2025-11-04
+
+### Changes
+
+- fix: Use itertools.cycle for time.time() mock to fix Python 3.12 compatibility (#327) (b180c33)
+- chore: bump version to 0.1.30 (#326) (00778cd)
+- feat: Add user-agent header 'agentcore-st/{version}' to runtime invocations (#325) (cdd5189)
+- chore: bump version to 0.1.29 (#324) (faf2108)
+- Update Direct Code Deploy message to clarify Python-only support (#323) (44b9b7a)
+- fix: Multiple UI/UX improvements (#321) (47e25b2)
+- docs: Remove duplicate --non-interactive option in CLI reference (#319) (f0a33a9)
+- feat: Add code_zip deployment to the starter toolkit (#317) (3de907a)
+- Update the Identity user guide with the latest OAuth2 3LO callback guidance (#292) (b989aab)
+- chore: bump version to 0.1.28 (#315) (d4b6b37)
+
+## [0.1.30] - 2025-11-04
+
+### Changes
+
+- feat: Add user-agent header 'agentcore-st/{version}' to runtime invocations (#325) (cdd5189)
+- chore: bump version to 0.1.29 (#324) (faf2108)
+- Update Direct Code Deploy message to clarify Python-only support (#323) (44b9b7a)
+- fix: Multiple UI/UX improvements (#321) (47e25b2)
+- docs: Remove duplicate --non-interactive option in CLI reference (#319) (f0a33a9)
+- feat: Add code_zip deployment to the starter toolkit (#317) (3de907a)
+- Update the Identity user guide with the latest OAuth2 3LO callback guidance (#292) (b989aab)
+- chore: bump version to 0.1.28 (#315) (d4b6b37)
+
+## [0.1.29] - 2025-11-04
+
+### Changes
+
+- Update Direct Code Deploy message to clarify Python-only support (#323) (44b9b7a)
+- fix: Multiple UI/UX improvements (#321) (47e25b2)
+- docs: Remove duplicate --non-interactive option in CLI reference (#319) (f0a33a9)
+- feat: Add code_zip deployment to the starter toolkit (#317) (3de907a)
+- Update the Identity user guide with the latest OAuth2 3LO callback guidance (#292) (b989aab)
+- chore: bump version to 0.1.28 (#315) (d4b6b37)
+
+## [0.1.28] - 2025-10-31
+
+### Changes
+
+- fix: prevent incorrect entrypoint inference when multiple candidates exist (#313) (c011ebf)
+- docs: update quickstart example for agentcore-strands CI integration (#311) (ba056fb)
+- fix: correct workflow output reference for external PR tests (#307) (a6d0bc1)
+- chore: bump version to 0.1.27 (#309) (a501bcf)
+
+## [0.1.27] - 2025-10-29
+
+### Changes
+
+- feat: Add destroy() method to Runtime notebook interface with comprehensive tests (#305) (c158d9c)
+- Chore/workflow improvements (#301) (196500a)
+- feat: Add VPC networking support for AgentCore Runtime (#294) (787f2c6)
+- docs: update quickstart links to AWS documentation. test: fix memory test and improve commands coverage (#303) (d07fa8d)
+- feat: add skip memory option in interactive configure flow (#298) (f9455bf)
+- feat: Add runtime session lifecycle management with stop-session command (#287) (fb82e37)
+- feat: adding strongly typed Self Managed strategy model (#300) (4806fe2)
+- added ref to install jq (#296) (9855cb7)
+- docs: update latest docs/samples from sampes repo (#297) (f61191a)
+- docs: Add a2a and vpc documentation on agentcore (#288) (d76fcc1)
+- chore: bump version to 0.1.26 (#291) (9dcf58e)
+
+## [0.1.26] - 2025-10-17
+
+### Changes
+
+- Add direct dependency on Starlette as it is used in the OAuth2 callback local server (#290) (288e443)
+- Implement 3LO Server on localhost:8081 to handle generating OAuth2 tokens (#282) (f2d33a5)
+- fix(deps): restrict pydantic to versions below 2.41.3 (#280) (ec7880e)
+- docs: enhance quickstart guides with improved structure and troubleshooting (#279) (19203e9)
+- chore: bump version to 0.1.25 (#278) (57f1d40)
+
+## [0.1.25] - 2025-10-13
+
+### Changes
+
+- docs: remove preview verbiage following Bedrock AgentCore GA release (#277) (232f172)
+- chore: Add InvokeAgentRuntimeForUser permissions (#275) (9c8a50e)
+- chore: bump version to 0.1.24 (#276) (316fc02)
+
 ## [0.1.24] - 2025-10-13
 
 ### Changes

{bedrock_agentcore_starter_toolkit-0.1.24 → bedrock_agentcore_starter_toolkit-0.2.2}/CONTRIBUTING.md

@@ -67,7 +67,9 @@ See our [Security Policy](SECURITY.md) for more details.
 - For AWS Bedrock service questions, visit [AWS re:Post](https://repost.aws/)
 - For urgent AWS support, use your [AWS Support](https://aws.amazon.com/support/) plan
 
-## About Package Management
+## Development Setup (For AWS Team Members)
+
+### About Package Management
 
 This project uses [`uv`](https://docs.astral.sh/uv/) for dependency management, providing:
 
@@ -81,22 +83,95 @@ The repository includes:
 - `pyproject.toml` - Project metadata and dependencies
 - `uv.lock` - Locked dependency versions for reproducibility
 
-### Development Setup
+### Initial Setup
 
 ```bash
-# Create and activate virtual environment with dependencies
+# Clone and create virtual environment with dependencies
+git clone https://github.com/aws/bedrock-agentcore-starter-toolkit.git
+cd bedrock-agentcore-starter-toolkit
+
+uv venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
 uv sync
 
-# Run commands using uv
+# Install pre-commit hooks (one-time)
+pre-commit install
+```
+
+That's it! You're ready to develop.
+
+### Daily Development Workflow
+
+Pre-commit hooks will now run automatically:
+
+```bash
+# Make your changes
+vim src/bedrock_agentcore_starter_toolkit/cli/commands.py
+
+# Commit (hooks run automatically)
+git commit -m "feat: add new command"
+# ↑ Formatting and linting run here (~10-20 seconds)
+
+# Push (tests run automatically)
+git push origin my-branch
+# ↑ Security scanning and tests run here (~2-5 minutes)
+```
+
+### What the Hooks Check
+
+**On every commit** (~10-20 seconds):
+- ✅ Code formatting (auto-fixes with ruff)
+- ✅ Import sorting (auto-fixes)
+- ✅ Linting (with ruff)
+- ✅ File hygiene (trailing whitespace, etc.)
+
+**Before every push** (~2-5 minutes):
+- ✅ Security scanning (bandit)
+- ✅ Full test suite with coverage
+
+### Skipping Hooks (WIP Commits)
+
+For work-in-progress commits, you can skip checks:
+
+```bash
+git commit --no-verify -m "wip: incomplete work"
+```
+
+**Please run all checks before opening a PR!**
+
+### Running Checks Manually
+
+```bash
+# Run all pre-commit checks
+pre-commit run --all-files
+
+# Run only pre-commit stage (fast)
+pre-commit run --hook-stage pre-commit --all-files
+
+# Run only pre-push stage (includes tests)
+pre-commit run --hook-stage pre-push --all-files
+
+# Run tests manually
+uv run pytest tests/ --cov=src
+
+# Run the CLI
 uv run agentcore --help
 
 # Add new dependencies
 uv add requests
 
 # Add development dependencies
-uv add --dev pytest
+uv add --dev pytest-mock
 ```
 
+### Updating snapshots
+
+`agentcore create` has snapshot tests to keep track of generated outputs. If you make a change that affects the template output, the test will fail.
+
+The expectation is to run `uv run pytest tests/create --snapshot-update`
+
+That will update the snapshot with the new output. The purpose of this system is to see the diff to the templates in commit/PR diff.
+
 ## Code of Conduct
 
 This project adheres to the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). By participating, you're expected to uphold this code.