Skip to content

Commit 9b833b1

Browse files
MichaelBMCMichaelBMC
committed
merge: incorporate main updates, keep policy feature changes
2 parents 2d16f8c + a4748be commit 9b833b1

91 files changed

Lines changed: 4737 additions & 485 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ash-security-comment.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,18 @@ jobs:
1616
if: github.event.workflow_run.event == 'pull_request'
1717
steps:
1818
- name: Download artifacts
19-
uses: actions/download-artifact@v4
19+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
2020
with:
2121
name: ash-security-results
2222
path: /tmp/ash-results
2323
run-id: ${{ github.event.workflow_run.id }}
2424
github-token: ${{ secrets.GITHUB_TOKEN }}
2525

26+
- name: Debug artifact contents
27+
run: |
28+
echo "Artifact contents:"
29+
find /tmp/ash-results -type f | head -20
30+
2631
- name: Get PR information
2732
id: pr-info
2833
run: |
@@ -49,6 +54,8 @@ jobs:
4954
script: |
5055
const fs = require('fs');
5156
const commentPath = '/tmp/ash-results/pr_comment.md';
57+
console.log('Looking for comment file at:', commentPath);
58+
console.log('File exists:', fs.existsSync(commentPath));
5259
5360
if (!fs.existsSync(commentPath)) {
5461
console.log('No comment file found in artifacts');

‎.github/workflows/ash-security-scan.yml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: ASH Security Scan
22

33
on:
4+
push:
5+
branches: [ main ]
46
pull_request:
57
branches: [ main ]
68

@@ -17,7 +19,7 @@ jobs:
1719

1820
- name: Get changed files
1921
id: changed-files
20-
uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46
22+
uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
2123
with:
2224
files: |
2325
**/*.py
@@ -200,25 +202,24 @@ jobs:
200202
echo "has_findings=false" >> "$GITHUB_OUTPUT"
201203
fi
202204
203-
- name: Save PR metadata
205+
- name: Prepare artifacts
204206
if: steps.changed-files.outputs.any_changed == 'true'
205207
env:
206208
PR_NUMBER: ${{ github.event.pull_request.number }}
207209
PR_SHA: ${{ github.event.pull_request.head.sha }}
208210
run: |
209-
echo "${PR_NUMBER}" > /tmp/pr_number.txt
210-
echo "${PR_SHA}" > /tmp/pr_sha.txt
211+
mkdir -p /tmp/ash-artifacts
212+
echo "${PR_NUMBER}" > /tmp/ash-artifacts/pr_number.txt
213+
echo "${PR_SHA}" > /tmp/ash-artifacts/pr_sha.txt
214+
cp /tmp/pr_comment.md /tmp/ash-artifacts/pr_comment.md
215+
cp -r /tmp/ash-scan/.ash/ /tmp/ash-artifacts/.ash/ 2>/dev/null || true
211216
212217
- name: Upload ASH results and PR metadata
213218
if: steps.changed-files.outputs.any_changed == 'true' && always()
214219
uses: actions/upload-artifact@v4
215220
with:
216221
name: ash-security-results
217-
path: |
218-
/tmp/ash-scan/.ash/
219-
/tmp/pr_comment.md
220-
/tmp/pr_number.txt
221-
/tmp/pr_sha.txt
222+
path: /tmp/ash-artifacts/
222223
retention-days: 30
223224

224225
- name: Security scan summary

‎.github/workflows/dependabot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
name: Dependabot auto-merge
22

33
on:
4-
pull_request:
5-
types: [opened, synchronize]
4+
pull_request_target:
5+
types: [opened, synchronize, reopened]
66

77
permissions:
88
pull-requests: write
@@ -11,7 +11,7 @@ permissions:
1111
jobs:
1212
dependabot:
1313
runs-on: ubuntu-latest
14-
if: github.event.pull_request.user.login == 'dependabot[bot]'
14+
if: github.actor == 'dependabot[bot]'
1515
steps:
1616
- name: Dependabot metadata
1717
id: metadata

‎.github/workflows/js-lint.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: JavaScript/TypeScript Code Quality
22

33
on:
4+
push:
5+
branches: [ main ]
46
pull_request:
57
branches: [ main ]
68

‎.github/workflows/label.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: Labeler
22

33
on: [pull_request_target]
44

5+
permissions:
6+
contents: read
7+
pull-requests: write
8+
59
jobs:
610
label:
711
runs-on: ubuntu-latest

‎.github/workflows/python-lint.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: Python Code Quality
22

33
on:
4+
push:
5+
branches: [ main ]
46
pull_request:
57
branches: [ main ]
68

‎.github/workflows/repo-stats.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ on:
1010
- cron: "0 11 * * *"
1111
workflow_dispatch: # Allow manual triggering from the Actions tab.
1212

13+
permissions:
14+
contents: write
15+
1316
jobs:
1417
collect-stats:
1518
name: collect-repo-stats

‎.gitlab-ci.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ developer_tests:
2828
- apt-get update -y
2929
- apt-get install make -y
3030
- pip install ruff
31+
- curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
32+
- apt-get install -y nodejs
33+
- cd frontend && npm ci && cd ..
3134

3235
script:
3336
- make lint-cicd

‎CHANGELOG.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Changed
11+
12+
- Updated architecture diagram with latest logos (`docs/architecture-diagram/FAST-architecture-20260403.png`)
13+
14+
## [0.4.1] - 2026-03-25
15+
16+
### Added
17+
18+
- AG-UI agent patterns for both Strands and LangGraph (`patterns/agui-strands-agent/`, `patterns/agui-langgraph-agent/`) with tool support (Gateway, Code Interpreter)
19+
- AG-UI streaming parser in frontend (`frontend/src/lib/agentcore-client/parsers/agui.ts`)
20+
- AG-UI integration documentation (`docs/AGUI_INTEGRATION.md`)
21+
- AgentCore Evaluations integration guide (`docs/AGENTCORE_EVALUATIONS_GUIDE.md`)
22+
- X-Ray VPC endpoint to private VPC deployment documentation
23+
24+
### Changed
25+
26+
- Restructured existing Strands and LangGraph agent patterns with modular `tools/` directories for Gateway and Code Interpreter
27+
- Simplified `basic_agent.py` and `langgraph_agent.py` by extracting tool definitions into separate modules
28+
- Updated OpenTelemetry distro version across all agent pattern Dockerfiles
29+
30+
### Fixed
31+
32+
- API Gateway cache encryption at rest enabled in both CDK and Terraform
33+
- ASH PR comment artifact consolidation and dependabot auto-merge workflow trigger
34+
- Security scanner false positive suppressions (nosemgrep/nosec) for CDK path operations, JWT decode, and zip-packager urlopen
35+
- Added USER directive to `Dockerfile.frontend.dev` (CKV_DOCKER_3)
36+
37+
### Security
38+
39+
- Updated `tj-actions/changed-files` to v47.0.5 (CVE fix for GHSA-mrrh-fwg8-r2c3 and GHSA-mcph-m25j-8j63)
40+
- Bumped `fast-xml-parser` and `@aws-sdk/xml-builder` in frontend
41+
- Bumped `flatted` from 3.3.3 to 3.4.2 in frontend
42+
- Bumped `langgraph` in patterns/langgraph-single-agent
43+
44+
## [0.4.0] - 2026-03-12
45+
1046
### Added
1147

48+
- Claude Agent SDK agent pattern (`patterns/claude-agent-sdk/`) with single-agent and multi-agent variants
49+
- AgentCore client library (`frontend/src/lib/agentcore-client/`) with SSE streaming and parsers for Strands, LangGraph, and Bedrock Converse agents
50+
- Inline tool call rendering with message segments approach in the frontend
51+
- Markdown rendering with syntax highlighting and copy button for chat messages
52+
- Tool renderer registry and default `ToolCallDisplay` component for extensible tool output rendering
53+
- Streaming documentation update (`docs/STREAMING.md`) with new parser architecture and event flow
54+
- Local Docker testing for AgentCore with Docker Compose support (`docker/`)
55+
- GitHub repo-stats workflow for daily traffic tracking
56+
- ASH (Automated Security Helper) scan workflows for PR and full repository scanning
57+
- Dependabot auto-merge and PR labeler GitHub Actions workflows
58+
- JS/TS and Python linting workflows for pull requests
59+
- Prettier configuration and formatting for frontend source files
60+
- Prettier added to Makefile lint pipeline and frontend dev dependencies
61+
- READMEs for strands, langgraph, and claude-agent-sdk agent patterns
62+
- Permission boundary for CodeBuild temporary IAM role
1263
- VPC deployment mode (`network_mode: VPC`) for deploying AgentCore Runtime into an existing user-provided VPC for private network isolation
1364
- VPC configuration in `config.yaml` with `vpc_id`, `subnet_ids`, and optional `security_group_ids`
1465
- VPC configuration validation in `ConfigManager` for required fields when VPC mode is enabled
@@ -17,6 +68,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1768
- CodeBuild-based deployment script (`scripts/deploy-with-codebuild.py`) that enables deploying FAST without requiring Docker
1869
- [Terraform] Full Terraform infrastructure alternative to CDK (`infra-terraform/`) with modules for Amplify Hosting, Cognito, and Backend (Runtime, Gateway, Memory, Feedback API, SSM)
1970
- [Terraform] Support for both Docker and Zip deployment types via `deployment_type` variable
71+
- [Terraform] OAuth2 Credential Provider support
72+
- [Terraform] VPC deployment mode with input/output parity to CDK
2073
- [Terraform] Dedicated scripts for frontend deployment (`deploy-frontend.py`, `deploy-frontend.sh`), Docker image build (`build-and-push-image.sh`), and agent testing (`test-agent.py`)
2174
- [Terraform] S3 backend configuration example (`backend.tf.example`) for remote state management
2275
- [Terraform] Version bump playbook (`TF_VERSION_BUMP_PLAYBOOK.md`) with independent versioning scheme
@@ -32,6 +85,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
3285

3386
### Changed
3487

88+
- Removed `userId` from client invocation — user identity now extracted server-side from JWT to prevent impersonation via prompt injection
89+
- Split claude-agent-sdk into single-agent and multi-agent pattern variants
90+
- Frontend switched from `access_token` to `id_token` for AgentCore authentication (`access_token` lacks required `aud` claim)
91+
- Removed old JS service files, replaced by new `agentcore-client` library
3592
- Migrated Gateway authentication to AgentCore SDK `@requires_access_token` decorator
3693
- Simplified agent code in `patterns/strands-single-agent/basic_agent.py` and `patterns/langgraph-single-agent/langgraph_agent.py`
3794
- Use `cr.Provider` pattern for OAuth2 provider to avoid IAM propagation delays
@@ -41,6 +98,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
4198
- Moved Secrets Manager permissions from base `AgentCoreRole` utility class to backend-stack.ts for better separation of concerns
4299
- Updated `README.md` to reference new architecture diagram and clarify OAuth2 M2M authentication flow descriptions
43100
- Updated `test-scripts/README.md` to remove Docker container testing documentation
101+
- Updated contributing docs to use `main` branch instead of `develop`
44102

45103
### Removed
46104

@@ -50,16 +108,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
50108
- Manual token fetching logic from agent code
51109
- Direct Secrets Manager access from agents
52110
- Wildcard Secrets Manager IAM permissions from base `AgentCoreRole` utility class
111+
- Old JS service files (replaced by `agentcore-client` library)
53112

54113
### Fixed
55114

115+
- LangGraph plain string content handling in `AIMessageChunk`
116+
- Test-agent `user_id` bug, added streaming parser and dynamic tool name lookup to test scripts
117+
- Frontend build issues: unused `sessionId` param and excluded test directory from `tsc`
118+
- Repo-stats workflow failing on forks
119+
- Real VPC/subnet IDs replaced with placeholders in `config.yaml`
120+
- Backend agent entrypoints
121+
- Docker Compose v2 syntax and outdated `userId` references in docs
122+
- JWT auth compatibility, Vite host binding, and credential docs
56123
- Stale token errors in agents by implementing fresh token retrieval on MCP Gateway reconnection (Strands) and per-request (LangGraph)
57124
- IAM permission scoping to prevent overly broad wildcard access
125+
- Removed `iam:PutRolePolicy` from CodeBuild permission boundary, added `cdk bootstrap`, fixed region detection
126+
- Resolved all ESLint warnings in frontend
127+
- CI: pinned `tj-actions/changed-files` to SHA and bumped Node to 20
58128

59129
### Security
60130

61131
- Enhanced security by delegating OAuth2 token management to AgentCore Identity service
62132
- Improved token lifecycle management with automatic refresh and error handling via Token Vault
133+
- Bumped `hono` from 4.11.9 to 4.12.7 in frontend
134+
- Bumped `@hono/node-server` in frontend
135+
- Bumped `rollup` from 4.56.0 to 4.59.0 in frontend
136+
- Bumped `minimatch` in frontend and `aws-cdk-lib` in infra-cdk
137+
- Bumped `fast-xml-parser` and `@aws-sdk/xml-builder` in frontend and infra-cdk
138+
- Bumped `qs` from 6.14.1 to 6.14.2 in frontend
139+
- Bumped `langgraph` in patterns/langgraph-single-agent
140+
- Bumped `@aws-sdk/client-bedrock-agentcore` in infra-cdk
63141

64142
## [0.3.1] - 2026-02-11
65143

‎CONTRIBUTORS.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,8 @@
1414
- Andrew Ang
1515
- Tesfagabir Meharizghi
1616
- Gauhar Bains
17+
- Meghana Ashok
18+
- Suren Gunturu
19+
- Samaneh Aminikhanghahi
20+
- Abhilash Balachandran
21+
- Rajat Dogra

0 commit comments

Comments
 (0)