Merge remote-tracking branch 'upstream/main' into lv-sync-main-2026-07-23b

# Conflicts:
#	agent/pyproject.toml
#	agent/src/pipeline.py
#	agent/src/shell.py
#	agent/tests/conftest.py
#	agent/tests/test_aws_session.py
#	agent/tests/test_shell.py
#	cdk/src/constructs/ecs-agent-cluster.ts
#	cdk/src/constructs/task-table.ts
#	cdk/src/handlers/shared/create-task-core.ts
#	cdk/src/handlers/shared/error-classifier.ts
#	cdk/src/handlers/shared/types.ts
#	cdk/test/constructs/task-table.test.ts
#	cdk/test/handlers/shared/error-classifier.test.ts
#	cdk/test/stacks/agent.test.ts

Author: isadeks

.github/workflows/deploy.yml

@@ -153,7 +153,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -228,7 +228,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}

.github/workflows/docs.yml

@@ -199,7 +199,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           # Fall back to us-east-1 if the repo variable is unset, so the action

.github/workflows/integ.yml

@@ -41,7 +41,7 @@ jobs:
           echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
 
       - name: Report on issues
-        uses: github/issue-metrics@44173f9e0a3b2144a777a10a340e4c09a25ac9f8 # v4.2.8
+        uses: github/issue-metrics@df8c49d20958f9345281fa2124858bd0ad227e1f # v5.0.0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SEARCH_QUERY: repo:aws-samples/sample-autonomous-cloud-coding-agents is:issue created:${{ env.last_month }} -reason:"not planned"
@@ -54,7 +54,7 @@ jobs:
           content-filepath: ./issue_metrics.md
 
       - name: Report on PRs
-        uses: github/issue-metrics@44173f9e0a3b2144a777a10a340e4c09a25ac9f8 # v4.2.8
+        uses: github/issue-metrics@df8c49d20958f9345281fa2124858bd0ad227e1f # v5.0.0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SEARCH_QUERY: repo:aws-samples/sample-autonomous-cloud-coding-agents is:pr created:${{ env.last_month }} -is:draft

.github/workflows/monthly-repo-metrics.yml

@@ -4,7 +4,7 @@ ARG GH_VERSION=2.93.0
 FROM --platform=$TARGETPLATFORM jdxcode/mise:latest AS mise
 
 # Build gh with a patched Go toolchain; upstream packages can lag Go CVE fixes.
-FROM --platform=$TARGETPLATFORM golang:1.26.3-bookworm AS gh-builder
+FROM --platform=$TARGETPLATFORM golang:1.26.4-bookworm AS gh-builder
 ARG GH_VERSION
 RUN GOPROXY=direct GOBIN=/out go install "github.com/cli/cli/v2/cmd/gh@v${GH_VERSION}"
 

agent/Dockerfile

@@ -14,23 +14,29 @@
 # in the MAIN thread during a test's *call* phase, so a deadlock in a WORKER
 # thread, a fixture, collection, or a C-level socket read the main thread never
 # returns from stalls the whole `mise run build` silently — up to the platform's
-# 3600s build-verify ceiling (the ECS-only stall on ABCA-684/686/688, and again
-# on ABCA-707: 40+ min of dead air, container never reaped).
+# 3600s build-verify ceiling (the ECS-only stall on ABCA-684/686/688, and the
+# scoped-session S3 hang the _clean_env reset below guards against: 40+ min of
+# dead air, container never reaped).
 #
 # The obvious instrument — ``faulthandler.dump_traceback_later(1200, exit=True)``
 # — does NOT work here: faulthandler has a SINGLE internal timer, and pytest's
 # ``faulthandler_timeout`` (pyproject.toml) RE-ARMS it at the start of every test
 # WITHOUT ``exit=True``. So a session-level exit timer is cancelled by the first
-# test, the per-test timer only DUMPS, and the suite hangs forever anyway
-# (exactly what happened on ABCA-707: a 300s dump fired, no exit followed).
+# test, the per-test timer only DUMPS, and the suite hangs forever anyway.
 #
 # So own the reaper on a dedicated daemon thread pytest cannot touch. A blocked
-# socket read (the ABCA-707 failure mode) releases the GIL, so this thread runs;
-# it dumps every thread's stack for diagnosis and then HARD-EXITS the process, so
-# `mise run build` returns non-zero within seconds of the deadline instead of
-# burning to the 3600s ceiling. Deadline 600s: ~200x the whole suite's normal
-# ~3s… well above any legitimate run (per-test cap is 300s) yet far under the
-# build ceiling.
+# socket read releases the GIL, so this thread runs; it dumps every thread's
+# stack for diagnosis and then HARD-EXITS the process, so `mise run build`
+# returns non-zero within seconds of the deadline instead of burning to the
+# ceiling. Deadline 600s: a SESSION backstop for the whole-suite hangs SIGALRM
+# can't interrupt — sized well above the longest healthy run (the suite normally
+# finishes in seconds; the per-test pytest-timeout cap is 120s, see
+# pyproject.toml) yet far under the 3600s build-verify ceiling.
+#
+# ``pytest_sessionfinish`` cancels the timer on a clean finish (below), so a
+# legitimately slow-but-passing run that lands near 600s — e.g. still in teardown
+# / coverage write — is NOT hard-exited into a bewildering red (#616 review N2).
+# ``os._exit`` skips atexit + buffer flush, so it must only fire on a TRUE hang.
 _HANG_REAP_DEADLINE_S = 600
 
 
@@ -52,6 +58,17 @@ def _reap_on_hang() -> None:
 _hang_watchdog.start()
 
 
+def pytest_sessionfinish(session, exitstatus):
+    """Cancel the hang watchdog on a clean session finish (#616 review N2).
+
+    Without this, a legitimately slow-but-passing suite that finishes just after
+    the 600s deadline (e.g. during teardown / coverage write) would be hard-exited
+    by ``_reap_on_hang`` and turn green red with a thread-dump uncorrelated to any
+    failed test. ``Timer.cancel()`` is a no-op if the timer already fired (a true
+    hang), so this only prevents the false-positive kill."""
+    _hang_watchdog.cancel()
+
+
 class FakeRunCmd:
     """Shared fake for ``shell.run_cmd``: records argv and returns scripted results.
 
@@ -139,15 +156,9 @@ def make_task_config(**overrides) -> TaskConfig:
     "LOG_GROUP_NAME",
     "MEMORY_ID",
     "ENABLE_CLI_TELEMETRY",
-    # Per-session IAM scoping (PR #209). When this is set, ``aws_session`` resolves
-    # a *scoped* session and ``tenant_client`` returns ``session.client(...)`` —
-    # which BYPASSES a ``@patch("boto3.client")`` mock. On the ECS substrate the
-    # task def sets this, so a test that mocks ``boto3.client`` (e.g.
-    # ``test_attachments``) instead makes a REAL S3 call that hangs on the network
-    # (no egress). Stripping it here forces every test onto the unscoped path,
-    # where the ``boto3.client`` mock actually intercepts. Resetting the session
-    # cache below is NOT enough on its own — a fresh ``get_session()`` re-resolves
-    # as scoped while this var is still set. (Live-caught on ABCA-707, 2026-07-15.)
+    # Per-session IAM scoping (PR #209) — the scoped-session S3-hang guard.
+    # See the ``_clean_env`` docstring below for the full rationale (why the
+    # env strip AND the cache reset are both required).
     "AGENT_SESSION_ROLE_ARN",
 ]
 
@@ -156,9 +167,6 @@ def make_task_config(**overrides) -> TaskConfig:
 def _clean_env(monkeypatch):
     """Remove agent-related env vars and reset the AWS session cache each test.
 
-    The env cleanup keeps host state from leaking into agent code that reads
-    ``os.environ`` at import/call time.
-
     The env cleanup + session reset TOGETHER close a scoped-session leak that
     hangs the suite on the ECS substrate: ``aws_session`` caches the resolved
     boto3 session in a MODULE GLOBAL (``_session``/``_scoped``), and
@@ -171,7 +179,7 @@ def _clean_env(monkeypatch):
     the var gone AND the cache reset, every test resolves the unscoped path where
     its ``boto3.client`` mock intercepts. Otherwise a mocked test (e.g.
     ``test_attachments``) makes a REAL S3 call that hangs on the ECS network
-    (no egress) in a socket read SIGALRM can't interrupt. (Live-caught ABCA-707.)
+    (no egress) in a socket read SIGALRM can't interrupt.
     """
     for var in _AGENT_ENV_VARS:
         monkeypatch.delenv(var, raising=False)

agent/tests/conftest.py

@@ -79,33 +79,13 @@ def test_blank_role_arn_treated_as_unset(self, monkeypatch):
         assert is_scoped() is False
 
 
-class TestConftestScrubsScopingEnv:
-    """Regression guard for the ECS test-hang (ABCA-707).
-
-    The bug: the ECS agent task def sets ``AGENT_SESSION_ROLE_ARN``. If that var
-    leaks into the test process, ``get_session()`` resolves a *scoped* session and
-    ``tenant_client`` returns ``session.client(...)`` — bypassing a
-    ``@patch("boto3.client")`` mock. A mocked test (e.g. ``test_attachments``)
-    then makes a REAL S3 call that hangs on the ECS network (no egress) in a
-    socket read SIGALRM can't interrupt → the whole ``mise run build`` stalls
-    silently for 40+ min. The ``_clean_env`` autouse fixture in conftest MUST
-    strip the var (resetting the session cache alone is not enough — a cold
-    ``get_session()`` re-resolves scoped while the var is still set).
-    """
-
-    def test_session_role_arn_not_visible_to_tests(self):
-        import os
-
-        # No monkeypatch here: this asserts the AUTOUSE fixture already scrubbed
-        # the var, even if the parent (ECS) environment had it set.
-        assert os.environ.get(SESSION_ROLE_ARN_ENV) is None
-
-    def test_session_resolves_unscoped_by_default(self):
-        # With the var scrubbed and the cache reset (both by _clean_env), a bare
-        # get_session() must be unscoped — the path where boto3.client mocks work.
-        with patch("boto3.Session", return_value=MagicMock()):
-            get_session()
-        assert is_scoped() is False
+# NOTE: the conftest-scrub regression guard for AGENT_SESSION_ROLE_ARN lives in
+# tests/test_conftest_env_scrub.py — deliberately in its OWN module with NO local
+# autouse fixture. This file's `_reset` fixture (above) itself does
+# `monkeypatch.delenv(SESSION_ROLE_ARN_ENV)`, which would MASK whether conftest's
+# `_clean_env` performs the scrub — a guard placed here passes even if the
+# conftest line is deleted (#616 review B1). Only a fixture-free module truly
+# guards the fix.
 
 
 # ---------------------------------------------------------------------------

agent/tests/test_aws_session.py

@@ -0,0 +1,50 @@
+"""Fixture-free regression guard for the ECS test-hang scrub (#615 / #616 B1).
+
+This module deliberately has NO local autouse fixture. It exists to prove that
+conftest's ``_clean_env`` autouse fixture strips ``AGENT_SESSION_ROLE_ARN`` from
+the environment before each test — the exact line the #615 fix adds to
+``_AGENT_ENV_VARS``.
+
+Why a separate module: ``test_aws_session.py`` has its OWN autouse ``_reset``
+fixture that does ``monkeypatch.delenv(SESSION_ROLE_ARN_ENV)``, so a guard placed
+there passes even if the conftest scrub is deleted (it asserts what the local
+fixture guarantees, not what the fix does — #616 review B1). Here, only conftest's
+``_clean_env`` is in play.
+
+Why set the var at MODULE IMPORT time (not in the test body): pytest autouse
+fixtures run during test *setup*, before the body executes — so a
+``monkeypatch.setenv`` inside the test can't be scrubbed by them. Poisoning the
+process env at import time (before any fixture runs) means the conftest scrub is
+the only thing that can clear it by the time a test body reads it. Remove the
+``AGENT_SESSION_ROLE_ARN`` line from conftest's ``_AGENT_ENV_VARS`` and BOTH tests
+below fail — a true bidirectional guard.
+
+The bug this guards: with ``AGENT_SESSION_ROLE_ARN`` set, ``aws_session``
+resolves a *scoped* session and ``tenant_client`` returns ``session.client(...)``,
+bypassing a ``@patch("boto3.client")`` mock. A mocked test (e.g.
+``test_attachments``) then makes a REAL S3 call that hangs forever on the ECS
+network (no egress) in a socket read SIGALRM can't interrupt — stalling the whole
+``mise run build``.
+"""
+
+import os
+
+from aws_session import SESSION_ROLE_ARN_ENV, is_scoped
+
+# Poison the process env at import time — BEFORE any fixture runs. The conftest
+# `_clean_env` autouse must scrub this for the assertions below to hold.
+os.environ[SESSION_ROLE_ARN_ENV] = "arn:aws:iam::123456789012:role/leaked-from-parent-env"
+
+
+def test_conftest_scrubs_session_role_arn():
+    # If conftest's _clean_env strips AGENT_SESSION_ROLE_ARN, it is gone here even
+    # though the module poisoned it at import time. If the scrub line is removed,
+    # this fails — the guard the #615 fix actually needs.
+    assert os.environ.get(SESSION_ROLE_ARN_ENV) is None
+
+
+def test_session_resolves_unscoped_when_scrubbed():
+    # With the var scrubbed (and the cache reset, both by conftest _clean_env) a
+    # bare get_session() must be unscoped — the path where boto3.client mocks
+    # intercept, so no real S3 call is made and nothing hangs.
+    assert is_scoped() is False