feat(dev): Agent Inspector HTTP layer (server, security, assets) - #2082
Open
tejaskash wants to merge 6 commits into
Open
feat(dev): Agent Inspector HTTP layer (server, security, assets)#2082tejaskash wants to merge 6 commits into
tejaskash wants to merge 6 commits into
Conversation
project dev without --agent now runs all of the project's runtimes at once: a DevSupervisor owns per-agent lifecycle (sequential port resolution — a concurrent race would put two agents on one port), merges every runner's output into one agent-attributed stream ([name] prefixes; an agent field in NDJSON), and keeps the session alive when one agent crashes. Selecting a single runtime (--agent, or a one-runtime project) keeps the direct path where a crash still fails the command.
…setup A child that stays alive without ever binding its port previously blocked every later runtime (starts are sequential) until interrupted; readiness now gives up after 120s and fails that start. Setup failures before the pump exists (port resolution, environment) now remove their parent-abort listener like every other exit path, so Inspector retries of a failing agent cannot accumulate listeners.
The #1980 rebase carried a single-runtime host check (runtime.build) into the multi-agent dev handler, where the variable is the runtimes array. Bind all interfaces when any selected runtime runs in a container.
…batch events() spliced the queue, yielded each event, then installed its wake callback and blocked. A push landing during the yields ran while wake was undefined, so its wake was a no-op, and the newly installed waiter never noticed the queued event until the next push or shutdown. Re-check the queue inside the wait so a queued event resolves immediately.
Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile
tejaskash
had a problem deploying
to
e2e-testing
August 24, 2026 16:41 — with 
GitHub Actions
Failure
GitHub Actions
Failure
github-actions
Bot
added
agentcore-harness-reviewing
This was referenced Aug 24, 2026
tejaskash
force-pushed
the
feat/dev-supervisor
branch
from
August 24, 2026 17:49
94eed9a to
fc5db62
Compare
- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope
tejaskash
had a problem deploying
to
e2e-testing
August 24, 2026 18:16 — with
GitHub Actions
Failure
GitHub Actions
Failure
tejaskash
force-pushed
the
feat/dev-supervisor
branch
2 times, most recently
from
August 25, 2026 15:06
9904ee1 to
0a77c0c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First of three stacked PRs re-authoring the Agent Inspector from
feat/agent-inspectoragainst currentrefactorAPIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose withio/startHttpServer. It is not yet reachable from the CLI.Stacked on #2041 (
feat/dev-supervisor); retarget torefactoronce that merges.Scope
src/core/dev/inspector/{types,respond,server,testkit}.ts— DI interfaces (InspectorSupervisor,InspectorTraces,InspectorAssets,InspectorDeps), response helpers, andcreateInspectorHandler.src/core/dev/inspectorAssets.ts— reads the staged SPA throughAssetSourcewith anAGENT_INSPECTOR_PATHoverride and a node_modules fallback.src/io/packagedAssets.ts— raw file reads and package-dir resolution, sonode:fs/node:modulestay out ofcore/dev.scripts/build.ts—stageInspectorAssets()copies@aws/agent-inspector/dist-assetsinto the asset tree before bundle and compile.Routes registered this PR:
GET /api/status,POST /api/start,GET /api/traces,GET /api/traces/:id, static SPA (withindex.htmlfallback), and a graceful{ success:false, error }404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.Security model
Loopback-only Host check (accepts
localhost,127.0.0.1,[::1]), server-side Origin allowlist (plus the Vite:5173dev origins),X-Agentcore-Localrequired on POSTs, CORS preflight, and a CSP on served HTML.Design notes vs the reference branch
/api/tracesfor the list route andslice+decodeURIComponentfor:id, so/api/tracesXYZno longer matches the list route and encoded ids decode. Covered by tests.src/io/packagedAssets.ts;inspectorAssets.tsno longer importsnode:fs/node:module.TraceStore.list's existinglimitcontract, since each summary carries full spans/logs.test.each.Verification
bun test src/core/dev/inspector+inspectorAssets.test.ts— 26 pass.bun test(1812 pass),bun run typecheck,bun run lint:check,bun run format:checkall green.bun run buildstages the four SPA files intosrc/assets/agent-inspector/(gitignored) and mirrors them intodist/assets/.