Repository navigation
the web chat runs locally - #71
Merged
Merged
Conversation
A person signs in at :3000, opens a gerp, and its chat link reaches the agent — on an Anthropic key, no AWS credentials, no docker. Closes #70. - the container entrypoint runs as a process on :8090 under local-dev.sh: it finds dev/ beside itself with no /repo mount, makes its Anthropic client on the first turn so the stack starts without a key, answers POST /runtimes/{arn}/invocations (the path the SDK sends InvokeAgentRuntime to) beside /invocations, and hands the Anthropic API the system blocks in that API's shape — a cache point becomes cache_control. That last one was a live 400 on the container smoke path - tests/server/node_lambda.mjs runs a Node lambda the way _image.py runs a Python one: the snapshot's env applied (the shell winning), the handler imported from source and re-imported on edit, awslambda shimmed for a streaming handler. One process per Function URL — the chat on :8082, the storage portal on :8083 — and POST /invoke/<fn> for a Node tool, which dev/tools.py and the image's /fn/<name> mount call - the Node lambdas' SDK is pointed by env, no module: AWS_ENDPOINT_URL at moto, AWS_ENDPOINT_URL_BEDROCK_AGENTCORE at the agent process - the Cognito stand-in signs RS256 with a key made at start, lists it at /.well-known/jwks.json and issues tokens at GET /token?sub=&email=. The chat lambda reads COGNITO_ISSUER over the pool's derived issuer; the bff image verifies every bearer against the stand-in; /dev/login and the e2e login helper take their tokens from it. An unsigned token gets in nowhere - LOCAL_CHAT_URL on the gerp row the bff seeds, so the owner app's chat link opens the local door with the token in the fragment - modules/agent/dev/run.sh and main() in dev/agent.py are deleted: run_turn stays for the engine, the smoke and the flow test Tests: tests/server/local/test_local_tokens.py, test_node_lambda.py, tests/agent/local/test_local_chat.py (the chat lambda against the stand-in and a stub agent, over moto), test_local_agent_process.py. Browser smoke local: 23 passed. Full suite: 1765 passed. Co-Authored-By: Claude <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL on #71: console.error read a template holding the request url as its format string (js/tainted-format-string); the url is now a %s argument. The image's 502 for a Node process that did not answer carried the exception's text (py/stack-trace-exposure); it names the address, and the exception goes to the process log. Co-Authored-By: Claude <noreply@anthropic.com>
CI on #71: test_dev_login called the verb in-process and the token now comes from the Cognito stand-in over HTTP, which the unit job does not run. The test starts the stand-in (tests/server/cognito/standin.py, the starter the chat contract test uses too) and verifies the token against its jwks. Without the stand-in the verb answers 503 naming its address and the start command instead of a traceback, and a test says so. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A person signs in at :3000, opens a gerp, and its chat link reaches the agent on an Anthropic key. No AWS credentials, no docker. Closes #70.
what changed
entrypoint.pyunder uvicorn, started byscripts/local-dev.sh. It findsdev/beside itself with no/repomount, makes its Anthropic client on the first turn (the stack starts without a key; a turn then answers with the error), and answersPOST /runtimes/{arn}/invocations, the path the SDK sendsInvokeAgentRuntimeto, beside/invocations. It also hands the Anthropic API the system blocks in that API's shape — the cache point becomescache_control. That was a live 400 on the container smoke path too.tests/server/node_lambda.mjsis_image.pyfor anindex.mjs: the snapshot's env applied with the shell winning, the handler imported from source and re-imported on edit,awslambdashimmed for a streaming handler. One process per Function URL: the web chat on :8082, the storage portal on :8083.POST /invoke/<fn>runs a Node tool;dev/tools.pyand the image's/fn/<name>mount call it.AWS_ENDPOINT_URLat moto,AWS_ENDPOINT_URL_BEDROCK_AGENTCOREat the agent process. No handler carries a local branch./.well-known/jwks.json, and issues tokens atGET /token?sub=&email=. The chat lambda readsCOGNITO_ISSUERover the pool's derived issuer (one config read); the bff image verifies every bearer against the stand-in;/dev/loginand the e2e login helper take their tokens from it. An unsigned token gets in nowhere.LOCAL_CHAT_URLon the gerp row the bff seeds, so the owner app's chat link opens the local door with the token in the fragment, as in production.modules/agent/dev/run.shandmain()indev/agent.pyare deleted.run_turnstays for the engine, the smoke and the flow test.the image
entrypoint.pyis the one file in the agent image that changes.StrandsEngine, the production engine, is untouched; the new route is never hit by AgentCore. It rides the nextdeploy.sh image.tests
tests/server/local/test_local_tokens.py— sign/verify, every refusal, the stand-in's tokens, the bff image's claimstests/server/local/test_node_lambda.py— env, the shell winning, the Function URL event streamed through, live edit, the image's forwardtests/agent/local/test_local_chat.py— the chat lambda against the stand-in and a stub agent over moto: the issuer honored, the invoke on the SDK's path with the session header and the payload, the buffered reply as one chunk, the chats rowtests/agent/local/test_local_agent_process.py— the route, the system blocks, the engine starting without a keyBrowser smoke, local: 23 passed, 4 skipped as before. Full suite: 1765 passed across 208 files. One real turn through the door by hand: "local chat works".