Skip to content

Commit db25ce7

Browse files
github-actions[bot]github-actions[bot]
committed
chore: sync main with public/main
2 parents a079a5a + 7d27f47 commit db25ce7

12 files changed

Lines changed: 794 additions & 512 deletions

File tree

‎package-lock.json‎

Lines changed: 644 additions & 502 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@
7878
"@aws-sdk/client-bedrock": "^3.1012.0",
7979
"@aws-sdk/client-bedrock-agent": "^3.1012.0",
8080
"@aws-sdk/client-bedrock-agentcore": "^3.1020.0",
81-
"@aws-sdk/client-bedrock-agentcore-control": "^3.1020.0",
81+
"@aws-sdk/client-bedrock-agentcore-control": "^3.1039.0",
8282
"@aws-sdk/client-bedrock-runtime": "^3.893.0",
8383
"@aws-sdk/client-cloudformation": "^3.893.0",
8484
"@aws-sdk/client-cloudwatch-logs": "^3.893.0",
@@ -90,7 +90,7 @@
9090
"@aws/agent-inspector": "0.3.0",
9191
"@commander-js/extra-typings": "^14.0.0",
9292
"@opentelemetry/api": "^1.9.1",
93-
"@opentelemetry/exporter-metrics-otlp-http": "^0.217.0",
93+
"@opentelemetry/exporter-metrics-otlp-http": "^0.215.0",
9494
"@opentelemetry/otlp-transformer": "^0.213.0",
9595
"@opentelemetry/resources": "^2.6.1",
9696
"@opentelemetry/sdk-metrics": "^2.6.1",
@@ -141,19 +141,23 @@
141141
"lint-staged": "^16.2.7",
142142
"node-pty": "^1.1.0",
143143
"prettier": "^3.7.4",
144-
"secretlint": "^13.0.0",
144+
"secretlint": "^12.2.0",
145145
"tsx": "^4.21.0",
146146
"typescript": "^5",
147147
"typescript-eslint": "^8.50.1",
148148
"vitest": "^4.0.18"
149149
},
150150
"overridesComments": {
151151
"minimatch": "GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch 10.0.0-10.2.2 has ReDoS vulnerabilities. Multiple transitive deps (eslint, typescript-eslint, eslint-plugin-import, eslint-plugin-react, prettier-plugin-sort-imports, aws-cdk-lib) pin older versions. Remove this override once upstream packages update their minimatch dependency to >=10.2.3.",
152-
"glob": "glob <12 is deprecated and emits npm install warnings (https://github.com/isaacs/node-glob). Pulled in transitively via archiver-utils@5.0.2 (latest), which still pins glob@^10.0.0. archiver-utils only uses glob.sync(pattern, options), which remains compatible in glob@13. Remove this override once archiver-utils updates its glob dependency."
152+
"glob": "glob <12 is deprecated and emits npm install warnings (https://github.com/isaacs/node-glob). Pulled in transitively via archiver-utils@5.0.2 (latest), which still pins glob@^10.0.0. archiver-utils only uses glob.sync(pattern, options), which remains compatible in glob@13. Remove this override once archiver-utils updates its glob dependency.",
153+
"fast-xml-parser": "GHSA-8gc5-j5rx-235r, GHSA-jp2q-39xq-3w4g: fast-xml-parser <=5.5.6 has entity expansion bypass (CVE-2026-33036, CVE-2026-33349). Transitive via @aws-sdk/xml-builder. Remove once @aws-sdk updates to fast-xml-parser >=5.5.7.",
154+
"@aws-sdk/xml-builder": "aws/aws-sdk-js-v3#7867: @aws-sdk/xml-builder <3.972.14 does not configure maxTotalExpansions on fast-xml-parser, causing 'Entity expansion limit exceeded' on large CloudFormation responses. Remove once @aws-sdk/client-* deps are bumped past 3.972.14."
153155
},
154156
"overrides": {
155157
"minimatch": "10.2.4",
156-
"glob": "^13.0.0"
158+
"glob": "^13.0.0",
159+
"fast-xml-parser": "5.5.7",
160+
"@aws-sdk/xml-builder": "3.972.15"
157161
},
158162
"engines": {
159163
"node": ">=20"

‎src/cli/aws/agentcore-control.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,7 @@ export interface GetEvaluatorResult {
467467
llmAsAJudge?: GetEvaluatorLlmConfig;
468468
codeBased?: GetEvaluatorCodeBasedConfig;
469469
};
470+
kmsKeyArn?: string;
470471
tags?: Record<string, string>;
471472
}
472473

@@ -545,6 +546,7 @@ export async function getEvaluator(options: GetEvaluatorOptions): Promise<GetEva
545546
status: response.status ?? 'UNKNOWN',
546547
description: response.description,
547548
evaluatorConfig,
549+
kmsKeyArn: response.kmsKeyArn,
548550
tags,
549551
};
550552
}

‎src/cli/commands/import/__tests__/import-evaluator.test.ts‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,49 @@ describe('toEvaluatorSpec', () => {
210210

211211
expect(result.tags).toBeUndefined();
212212
});
213+
214+
it('forwards kmsKeyArn when present', () => {
215+
const detail: GetEvaluatorResult = {
216+
evaluatorId: 'eval-kms',
217+
evaluatorArn: 'arn:aws:bedrock-agentcore:us-west-2:123456789012:evaluator/eval-kms',
218+
evaluatorName: 'kms_eval',
219+
level: 'SESSION',
220+
status: 'ACTIVE',
221+
evaluatorConfig: {
222+
llmAsAJudge: {
223+
model: 'anthropic.claude-3-5-sonnet-20241022-v2:0',
224+
instructions: 'Evaluate',
225+
ratingScale: { numerical: [{ value: 1, label: 'Low', definition: 'Low' }] },
226+
},
227+
},
228+
kmsKeyArn: 'arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012',
229+
};
230+
231+
const result = toEvaluatorSpec(detail, 'kms_eval');
232+
233+
expect(result.kmsKeyArn).toBe('arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012');
234+
});
235+
236+
it('omits kmsKeyArn when not present', () => {
237+
const detail: GetEvaluatorResult = {
238+
evaluatorId: 'eval-no-kms',
239+
evaluatorArn: 'arn:aws:bedrock-agentcore:us-west-2:123456789012:evaluator/eval-no-kms',
240+
evaluatorName: 'no_kms_eval',
241+
level: 'SESSION',
242+
status: 'ACTIVE',
243+
evaluatorConfig: {
244+
llmAsAJudge: {
245+
model: 'anthropic.claude-3-5-sonnet-20241022-v2:0',
246+
instructions: 'Evaluate',
247+
ratingScale: { numerical: [{ value: 1, label: 'Low', definition: 'Low' }] },
248+
},
249+
},
250+
};
251+
252+
const result = toEvaluatorSpec(detail, 'no_kms_eval');
253+
254+
expect(result.kmsKeyArn).toBeUndefined();
255+
});
213256
});
214257

215258
// ============================================================================

‎src/cli/commands/import/import-evaluator.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ export function toEvaluatorSpec(detail: GetEvaluatorResult, localName: string):
5050
level,
5151
...(detail.description && { description: detail.description }),
5252
config,
53+
...(detail.kmsKeyArn && { kmsKeyArn: detail.kmsKeyArn }),
5354
...(detail.tags && Object.keys(detail.tags).length > 0 && { tags: detail.tags }),
5455
};
5556
}

‎src/cli/primitives/EvaluatorPrimitive.ts‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import { findConfigRoot } from '../../lib';
22
import type { EvaluationLevel, Evaluator, EvaluatorConfig } from '../../schema';
3-
import { EvaluationLevelSchema, EvaluatorSchema } from '../../schema';
3+
import { EvaluationLevelSchema, EvaluatorSchema, isValidKmsKeyArn } from '../../schema';
44
import { getErrorMessage } from '../errors';
55
import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
66
import { runCliCommand } from '../telemetry/cli-command-run.js';
@@ -25,6 +25,7 @@ export interface AddEvaluatorOptions {
2525
level: EvaluationLevel;
2626
description?: string;
2727
config: EvaluatorConfig;
28+
kmsKeyArn?: string;
2829
}
2930

3031
export type RemovableEvaluator = RemovableResource;
@@ -184,6 +185,7 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
184185
'--config <path>',
185186
'Path to evaluator config JSON file (overrides --model, --instructions, --rating-scale) [non-interactive]'
186187
)
188+
.option('--kms-key-arn <arn>', 'KMS key ARN for evaluator encryption (optional)')
187189
.option('--json', 'Output as JSON [non-interactive]')
188190
.action(
189191
async (cliOptions: {
@@ -196,6 +198,7 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
196198
lambdaArn?: string;
197199
timeout?: string;
198200
config?: string;
201+
kmsKeyArn?: string;
199202
json?: boolean;
200203
}) => {
201204
if (!findConfigRoot()) {
@@ -289,10 +292,17 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
289292
};
290293
}
291294

295+
if (cliOptions.kmsKeyArn && !isValidKmsKeyArn(cliOptions.kmsKeyArn)) {
296+
fail(
297+
'--kms-key-arn must be a valid KMS key ARN (e.g. arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012)'
298+
);
299+
}
300+
292301
const result = await this.add({
293302
name: cliOptions.name!,
294303
level: levelResult.data!,
295304
config: configJson,
305+
kmsKeyArn: cliOptions.kmsKeyArn,
296306
});
297307

298308
if (!result.success) {
@@ -386,6 +396,7 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
386396
level: options.level,
387397
...(options.description && { description: options.description }),
388398
config: options.config,
399+
...(options.kmsKeyArn && { kmsKeyArn: options.kmsKeyArn }),
389400
};
390401

391402
project.evaluators.push(evaluator);

‎src/cli/tui/hooks/useCreateEvaluator.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ interface CreateEvaluatorConfig {
88
name: string;
99
level: string;
1010
config: EvaluatorConfig;
11+
kmsKeyArn?: string;
1112
}
1213

1314
export function useCreateEvaluator() {
@@ -29,6 +30,7 @@ export function useCreateEvaluator() {
2930
name: config.name,
3031
level: config.level as 'SESSION' | 'TRACE' | 'TOOL_CALL',
3132
config: config.config,
33+
kmsKeyArn: config.kmsKeyArn,
3234
})
3335
);
3436
if (!addResult.success) {

‎src/cli/tui/screens/evaluator/AddEvaluatorScreen.tsx‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import type { EvaluationLevel, EvaluatorConfig } from '../../../../schema';
2-
import { EvaluatorNameSchema, isValidBedrockModelId } from '../../../../schema';
2+
import { EvaluatorNameSchema, isValidBedrockModelId, isValidKmsKeyArn } from '../../../../schema';
33
import type { SelectableItem } from '../../components';
44
import { ConfirmReview, Panel, Screen, StepIndicator, TextInput, WizardSelect } from '../../components';
55
import { HELP_TEXT } from '../../constants';
@@ -91,6 +91,7 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
9191
const isRatingScaleCustomStep = wizard.step === 'ratingScale-custom';
9292
const isLambdaArnStep = wizard.step === 'lambda-arn';
9393
const isTimeoutStep = wizard.step === 'timeout';
94+
const isKmsKeyArnStep = wizard.step === 'kms-key-arn';
9495
const isConfirmStep = wizard.step === 'confirm';
9596

9697
const evaluatorTypeNav = useListNavigation({
@@ -163,6 +164,8 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
163164

164165
// Build confirm fields based on evaluator type
165166
const confirmFields = useMemo(() => {
167+
const kmsField = wizard.config.kmsKeyArn ? [{ label: 'KMS Key ARN', value: wizard.config.kmsKeyArn }] : [];
168+
166169
if (wizard.evaluatorType === 'llm-as-a-judge') {
167170
const llm = wizard.config.config.llmAsAJudge!;
168171
return [
@@ -175,6 +178,7 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
175178
value: llm.instructions.length > 60 ? llm.instructions.slice(0, 60) + '...' : llm.instructions,
176179
},
177180
{ label: 'Rating Scale', value: formatRatingScale(llm.ratingScale) },
181+
...kmsField,
178182
];
179183
}
180184

@@ -187,6 +191,7 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
187191
{ label: 'Code', value: managed.codeLocation },
188192
{ label: 'Entrypoint', value: managed.entrypoint },
189193
{ label: 'Timeout', value: `${managed.timeoutSeconds}s` },
194+
...kmsField,
190195
];
191196
}
192197

@@ -197,6 +202,7 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
197202
{ label: 'Name', value: wizard.config.name },
198203
{ label: 'Level', value: wizard.config.level },
199204
{ label: 'Lambda ARN', value: external.lambdaArn },
205+
...kmsField,
200206
];
201207
}, [wizard.evaluatorType, wizard.codeBasedType, wizard.config]);
202208

@@ -374,6 +380,21 @@ export function AddEvaluatorScreen({ onComplete, onExit, existingEvaluatorNames
374380
/>
375381
)}
376382

383+
{isKmsKeyArnStep && (
384+
<TextInput
385+
key="kms-key-arn"
386+
prompt="KMS key ARN for encryption (optional, press Enter to skip)"
387+
initialValue=""
388+
onSubmit={wizard.setKmsKeyArn}
389+
onCancel={() => wizard.goBack()}
390+
customValidation={value =>
391+
value === '' ||
392+
isValidKmsKeyArn(value) ||
393+
'Must be a valid KMS key ARN (e.g. arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012)'
394+
}
395+
/>
396+
)}
397+
377398
{isConfirmStep && <ConfirmReview fields={confirmFields} />}
378399
</Panel>
379400
</Screen>

‎src/cli/tui/screens/evaluator/types.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,14 @@ export type AddEvaluatorStep =
2020
| 'ratingScale-custom'
2121
| 'lambda-arn'
2222
| 'timeout'
23+
| 'kms-key-arn'
2324
| 'confirm';
2425

2526
export interface AddEvaluatorConfig {
2627
name: string;
2728
level: EvaluationLevel;
2829
config: EvaluatorConfig;
30+
kmsKeyArn?: string;
2931
}
3032

3133
export const EVALUATOR_STEP_LABELS: Record<AddEvaluatorStep, string> = {
@@ -41,6 +43,7 @@ export const EVALUATOR_STEP_LABELS: Record<AddEvaluatorStep, string> = {
4143
'ratingScale-custom': 'Scale',
4244
'lambda-arn': 'Lambda',
4345
timeout: 'Timeout',
46+
'kms-key-arn': 'KMS Key',
4447
confirm: 'Confirm',
4548
};
4649

‎src/cli/tui/screens/evaluator/useAddEvaluatorWizard.ts‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ const LLM_STEPS: AddEvaluatorStep[] = [
2222
'model',
2323
'instructions',
2424
'ratingScale',
25+
'kms-key-arn',
2526
'confirm',
2627
];
2728
const CODE_MANAGED_STEPS: AddEvaluatorStep[] = [
@@ -30,6 +31,7 @@ const CODE_MANAGED_STEPS: AddEvaluatorStep[] = [
3031
'name',
3132
'level',
3233
'timeout',
34+
'kms-key-arn',
3335
'confirm',
3436
];
3537
const CODE_EXTERNAL_STEPS: AddEvaluatorStep[] = [
@@ -38,6 +40,7 @@ const CODE_EXTERNAL_STEPS: AddEvaluatorStep[] = [
3840
'name',
3941
'level',
4042
'lambda-arn',
43+
'kms-key-arn',
4144
'confirm',
4245
];
4346

@@ -80,6 +83,7 @@ export function useAddEvaluatorWizard() {
8083
const [lambdaArn, setLambdaArnState] = useState('');
8184
const [timeout, setTimeoutState] = useState(DEFAULT_CODE_TIMEOUT);
8285
const [customRatingScaleType, setCustomRatingScaleType] = useState<CustomRatingScaleType>('numerical');
86+
const [kmsKeyArn, setKmsKeyArnState] = useState('');
8387
const [step, setStep] = useState<AddEvaluatorStep>('evaluator-type');
8488

8589
const steps = useMemo(() => getSteps(evaluatorType, codeBasedType), [evaluatorType, codeBasedType]);
@@ -109,11 +113,13 @@ export function useAddEvaluatorWizard() {
109113

110114
// Build the final config based on current state
111115
const config: AddEvaluatorConfig = useMemo(() => {
116+
const kms = kmsKeyArn || undefined;
112117
if (evaluatorType === 'llm-as-a-judge') {
113118
return {
114119
name,
115120
level,
116121
config: { llmAsAJudge: llmConfig },
122+
...(kms && { kmsKeyArn: kms }),
117123
};
118124
}
119125

@@ -126,6 +132,7 @@ export function useAddEvaluatorWizard() {
126132
external: { lambdaArn },
127133
},
128134
},
135+
...(kms && { kmsKeyArn: kms }),
129136
};
130137
}
131138

@@ -143,8 +150,9 @@ export function useAddEvaluatorWizard() {
143150
},
144151
},
145152
},
153+
...(kms && { kmsKeyArn: kms }),
146154
};
147-
}, [evaluatorType, codeBasedType, name, level, llmConfig, lambdaArn, timeout]);
155+
}, [evaluatorType, codeBasedType, name, level, llmConfig, lambdaArn, timeout, kmsKeyArn]);
148156

149157
const selectEvaluatorType = useCallback((type: EvaluatorTypeId) => {
150158
setEvaluatorType(type);
@@ -256,6 +264,15 @@ export function useAddEvaluatorWizard() {
256264
[nextStep]
257265
);
258266

267+
const setKmsKeyArn = useCallback(
268+
(arn: string) => {
269+
setKmsKeyArnState(arn);
270+
const next = nextStep('kms-key-arn');
271+
if (next) setStep(next);
272+
},
273+
[nextStep]
274+
);
275+
259276
const reset = useCallback(() => {
260277
setEvaluatorType('code-based');
261278
setCodeBasedType('managed');
@@ -264,6 +281,7 @@ export function useAddEvaluatorWizard() {
264281
setLlmConfig(getDefaultLlmConfig().llmAsAJudge!);
265282
setLambdaArnState('');
266283
setTimeoutState(DEFAULT_CODE_TIMEOUT);
284+
setKmsKeyArnState('');
267285
setStep('evaluator-type');
268286
}, []);
269287

@@ -288,6 +306,7 @@ export function useAddEvaluatorWizard() {
288306
setCustomRatingScale,
289307
setLambdaArn,
290308
setTimeout,
309+
setKmsKeyArn,
291310
reset,
292311
};
293312
}

0 commit comments

Comments
 (0)