Repository navigation
fix(aws-agents): bug bash skill fixes for AgentCore CLI v1 - #536
Merged
Merged
Conversation
added 30 commits
November 3, 2026 19:06
Port the authorizer flag casing fix to the canonical core-skills copy so both copies match, and add allowedAudience to the example because the v1 CLI rejects a discoveryUrl-only customJwtAuthorizer.
…in v1 projects The CreateHarness API accepts additionalParams on every model variant, but the v1 project schema rejects it for bedrock, open_ai, and gemini.
…tokens
Grep for {{UPPER_CASE}} tokens and <<< markers instead of any {{ or }}, which
valid rendered Python and JSON contain, and drop the literal token from the
Lambda shim docstring so a correctly rendered file passes.
…Agent IAM has no bedrock-agent-runtime service prefix, so policies built from the migration guidance failed validation. Keep bedrock-agent-runtime only as the API client name.
…gration guide Point at the deploy.md first-deploy section and name the --region flag instead of a section that no longer exists.
…paths The payment runtime always reads ~/.agents-pay/config.json of its OS account, so a separate --path per target never takes effect. Use one OS account per target or re-run init-config --force when switching.
… IAM simulation The old grep check passed on lookup errors and inspected a role that never holds CreatePaymentSession. Simulate against the Runtime execution role and note that default CLI wiring grants it both session and payment actions.
The v1 Strands templates read the actor from payload actorId and fall back to the shared actor default; userId and invoke --user-id are ignored.
…cialist The Strands template responds with text/event-stream, so json.loads on the body failed. Join the SSE text deltas and keep the JSON branch for dict returns.
Match the payload field the v1 Strands templates read for the Memory actor, and note that invoke --user-id does not set it.
…t ARN InvokeAgentRuntime is authorized on <runtime-arn>/runtime-endpoint/<qualifier>, so an exact runtime ARN alone is denied.
With a2a-sdk 0.3, send_message yields (Task, update) tuples for task responses and Part is a RootModel, so the text is on artifact parts' root.
The API takes the command in body and returns an event stream of stdout/stderr deltas. Also point to agentcore runtime exec and runtime shell.
The deployed Runtime name is <project>_<target>_<runtime>-<id>, not the logical name. Take the ARN from agentcore status and cover the endpoint ARN.
Point credential references at the agents-connect outbound authentication step and the payments onboarding tag check at Step 2, where the tag is added.
…nt example A default Gateway (protocolType None) has a bare-origin URL; MCP clients must append /mcp. Restore a Strands MCPClient example that signs SigV4 for AWS_IAM Gateways and a bearer-header variant for CUSTOM_JWT.
…gine v1 attaches a policy engine in ENFORCE by default, so an engine without a permit denies every tool call. Say so and use log-only in the example.
The CLI sets up no Gateway decision log. Point to the AllowDecisions and DenyDecisions metrics (Mode=LOG_ONLY) with list/get commands, or ENFORCE testing.
lambdaFunctionArn targets take no outboundAuth (gateway IAM role), and the shortcut target forms reject api-key; API_KEY is only set in full JSON config.
The agents-connect rewrite replaced its named sections with numbered steps; point get-started, harden, and debug at the current headings.
Deployed Runtimes are named <project>_<target>_<runtime>-<id>; take the exact ARN from agentcore status --json.
Add the ValidationException 'provided model identifier is invalid' cause with commands to check the ID against the region's profiles and models.
…argets Endpoint versions in agentcore.json apply to every target, but a new target only has version 1, so its first deploy rolls back with a 404 on the endpoint. Document the workaround and add the NoStack rollback and endpoint-not-found patterns to Path B.
… memory Re-adding a memory with only --name drops its strategies and other settings. Back up and restore the full memories[] entry, and warn that remove plus deploy deletes the stored memory data.
This error means the model ID or inference profile is mistyped, stale, or not offered in the region, not that model access is missing. Point to the Check 3 commands instead of the console access page.
Compare sessionsEvaluated with the session IDs the tests used, fail on dataset examples that could not be invoked, and report categorical results instead of treating them as errors. Poll with the project-free runtime traces command so the gate runs outside a checkout.
…mand evaluation A session with no supported-framework spans, such as one from a failed invoke, makes ondemand evaluate exit with no results. Recommend known-good session IDs or batch evaluation, and add the error to Troubleshooting.
Runtime endpoint versions are shared across targets, so a first deploy to a new target fails when an endpoint points past version 1.
init-config --force refuses a config written for another target, and the runtime ignores --path, so point users at moving the config aside instead.
…and surface specialist stream errors Deployed Runtime names replace hyphens in the target name with underscores, and call_specialist now raises on an error event instead of returning an empty string.
jariy17
approved these changes
Nov 3, 2026
nborges-aws
pushed a commit
that referenced
this pull request
Nov 6, 2026
nborges-aws
pushed a commit
that referenced
this pull request
Nov 6, 2026
nborges-aws
pushed a commit
that referenced
this pull request
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes skill guidance found during a bug bash of the AgentCore CLI v1 skill update (#502). Each finding was re-checked against
@aws/agentcore1.0.1 (CLI source,--help, and live runs where behavior mattered) and compared with the v0 skill onmainand CLI 0.31.2. This PR contains only the skill-side fixes; CLI behavior issues are tracked separately.One commit per fix, so individual changes are easy to review or drop.
amazon-bedrock (both copies, back in sync)
skills/core-skillsmatch the plugin copy again (sync-plugin-skills.py --checkwas failing) and give a Harness JWT authorizer example the CLI accepts (it needs at least one ofallowedAudience/allowedClients/allowedScopes/customClaims).additionalParamsis LiteLLM-only in v1 projects.{{TOKEN}}/<<<markers, so a correctly rendered shim passes.bedrock:Retrieve/bedrock:InvokeAgent(thebedrock-agent-runtime:prefix does not exist).agents-build
actorId(what the templates read);invoke --user-iddoes not set the Memory actor in v1.call_specialistparses the template's SSE stream (and raises on stream errors) instead ofjson.loads.<arn>/runtime-endpoint/*), which is what the call is authorized on.(Task, update)tuples /Part.root.text(a2a-sdk 0.3.x).InvokeAgentRuntimeCommandexample (body=,response["stream"]) and mentionagentcore runtime exec/shell.agentcore status --json(<project>_<target>_<runtime>-<id>).agents-connect / agents-debug / agents-get-started / agents-harden
protocolType: None) Gateway URL needs/mcp, and add Strands MCP client examples forAWS_IAM(SigV4) andCUSTOM_JWT.--attach-mode log-onlywhen attaching a policy engine (v1 defaults to enforce).AllowDecisions/DenyDecisions), not non-existent decision logs.lambdaFunctionArnuses the Gateway IAM role; shortcut targets rejectapi-key).agents-deploy / agents-optimize
agentcore.jsonapply to every target; explain the first-deploy-to-a-new-target rollback and how to find the real cause behindNoStack.agentcore runtime traces list --id(works outside a project).eval ondemand evaluate; use--session-idsor batch evaluation.agents-pay
simulate-principal-policyagainst the Runtime execution role, and states that default CLI wiring grants itCreatePaymentSession.Checks
tools/validate.py,tools/sync-plugin-skills.py --check, markdownlint on changed files,git diff --check, tool tests and payment-script tests all pass. Changed code snippets were executed (locally, againstagentcore dev, or against previously recorded live responses).