feat(dev): add Agent Inspector HTTP layer (server, security, assets) by tejaskash · Pull Request #2082 · aws/agentcore-cli

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

tejaskash · 2026-08-24T16:41:15Z

What

First of three stacked PRs re-authoring the Agent Inspector from feat/agent-inspector against current refactor APIs. This one lands the HTTP contract and SPA delivery only — a pure request to response handler the dev command will compose with io/startHttpServer. It is not yet reachable from the CLI.

Stacked on #2041 (feat/dev-supervisor); retarget to refactor once that merges.

Scope

src/core/dev/inspector/{types,respond,server,testkit}.ts — DI interfaces (InspectorSupervisor, InspectorTraces, InspectorAssets, InspectorDeps), response helpers, and createInspectorHandler.
src/core/dev/inspectorAssets.ts — reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and a node_modules fallback.
src/io/packagedAssets.ts — raw file reads and package-dir resolution, so node:fs/node:module stay out of core/dev.
scripts/build.ts — stageInspectorAssets() copies @aws/agent-inspector/dist-assets into the asset tree before bundle and compile.

Routes registered this PR: GET /api/status, POST /api/start, GET /api/traces, GET /api/traces/:id, static SPA (with index.html fallback), and a graceful { success:false, error } 404 for everything else. Agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring land in the following PRs, so no stub routes appear here.

Security model

Loopback-only Host check (accepts localhost, 127.0.0.1, [::1]), server-side Origin allowlist (plus the Vite :5173 dev origins), X-Agentcore-Local required on POSTs, CORS preflight, and a CSP on served HTML.

Design notes vs the reference branch

Route matching hardened: exact /api/traces for the list route and slice + decodeURIComponent for :id, so /api/tracesXYZ no longer matches the list route and encoded ids decode. Covered by tests.
Boundary of concern: filesystem and package resolution moved into src/io/packagedAssets.ts; inspectorAssets.ts no longer imports node:fs/node:module.
Trace list capped to the newest 200 per poll, matching TraceStore.list's existing limit contract, since each summary carries full spans/logs.
Security-guard rejection cases parameterized with test.each.

Verification

bun test src/core/dev/inspector + inspectorAssets.test.ts — 26 pass.
Full bun test (1812 pass), bun run typecheck, bun run lint:check, bun run format:check all green.
bun run build stages the four SPA files into src/assets/agent-inspector/ (gitignored) and mirrors them into dist/assets/.

codecov-commenter · 2026-08-25T17:48:54Z

Codecov Report

❌ Patch coverage is 95.90164% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.41%. Comparing base (f1a651c) to head (31df625).

Files with missing lines	Patch %	Lines
src/core/dev/inspector/server.ts	96.42%	4 Missing ⚠️
src/core/dev/inspector/testkit.ts	93.75%	3 Missing ⚠️
src/io/packagedAssets.ts	84.61%	2 Missing ⚠️
src/core/dev/inspector/respond.ts	96.87%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## refactor #2082 +/- ##
============================================
- Coverage 97.42% 97.41% -0.02% 
============================================
Files 429 434 +5 Lines 26314 26558 +244 ============================================
+ Hits 25637 25871 +234 - Misses 677 687 +10

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation · 2026-08-25T20:32:28Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-08-26T00:38:58Z

+import { dirname } from "node:path";
+
+/** Read a file's raw bytes, or undefined when it is absent or unreadable. */
+export async function readOptionalBytes(path: string): Promise<Uint8Array | undefined> {


Is this helper necessary? Looking at where it's used, it doesn't seem to be reducing complexity or cognitive load? In other words, the code above would be just as easy to follow, or even easier, without this little helper.

AlexanderRichey

Primarily copy/pasting stuff as is, right?

tejaskash · 2026-08-26T02:32:17Z

Primarily copy/pasting stuff as is, right?

Yep, split up into smaller chunks to make it easier to read

Port the reference WebUIServer as a pure request to response handler the dev command composes with io/startHttpServer. This lands the HTTP contract and SPA delivery only; agent-proxy routes (invocations, MCP, A2A, resources) and the CLI wiring follow in later PRs. - security: loopback-only Host check (incl. IPv6 [::1]), server-side origin allowlist, X-Agentcore-Local on POSTs, CORS preflight, CSP on served HTML - routes: GET /api/status, POST /api/start, GET /api/traces[/:id], static SPA with index.html fallback, graceful JSON 404 for everything else - exact-match trace routing with decodeURIComponent :id extraction - InspectorAssets reads the staged SPA through AssetSource with an AGENT_INSPECTOR_PATH override and node_modules fallback; raw filesystem and package resolution live in src/io/packagedAssets, keeping node:fs/node:module out of core/dev - build stages @aws/agent-inspector/dist-assets into the asset tree before bundle and compile

- serve static assets over a zero-copy Buffer view of the cached bytes - hoist the constant CORS headers to module scope; the per-request origin pick reduces to origin || primary now that the guard runs first - drop the single-use InspectorAssetReader alias; inline read's signature - hoist the asset TextEncoder to module scope

agentcore-devx-automation · 2026-08-26T13:17:26Z

Claude Security Review: no high-confidence findings. (run)

github-actionsBot added the size/xl PR size: XL label Aug 24, 2026

tejaskash had a problem deploying to e2e-testing August 24, 2026 16:41 — with GitHub Actions Failure

github-actionsBot added agentcore-harness-reviewing AgentCore Harness review in progress and removed agentcore-harness-reviewing AgentCore Harness review in progress labels Aug 24, 2026

This was referenced Aug 24, 2026
feat(dev): agent-proxy routes for the Agent Inspector #2085
Merged
feat(dev): wire the Agent Inspector into project dev #2086
Merged

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 24, 2026

tejaskash had a problem deploying to e2e-testing August 24, 2026 18:16 — with GitHub Actions Failure

tejaskash force-pushed the feat/inspector-http-layer branch from e59cda5 to 1b3491bCompare August 25, 2026 17:35

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

tejaskash had a problem deploying to e2e-testing August 25, 2026 17:36 — with GitHub Actions Failure

tejaskash force-pushed the feat/inspector-http-layer branch from 1b3491b to f84a91fCompare August 25, 2026 17:45

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

tejaskash changed the title ~~feat(dev): Agent Inspector HTTP layer (server, security, assets)~~feat(dev): add Agent Inspector HTTP layer (server, security, assets)Aug 25, 2026

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

tejaskash force-pushed the feat/inspector-http-layer branch from f84a91f to ac74941Compare August 25, 2026 19:01

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

tejaskash force-pushed the feat/inspector-http-layer branch from ac74941 to a0dd0f6Compare August 25, 2026 19:39

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

Base automatically changed from feat/dev-supervisor to refactorAugust 25, 2026 20:25

tejaskash force-pushed the feat/inspector-http-layer branch from a0dd0f6 to defd2b1Compare August 25, 2026 20:25

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 25, 2026

agentcore-devx-automationBot added the claude-security-reviewing Claude Code /security-review in progress label Aug 25, 2026

agentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 25, 2026

AlexanderRichey reviewed Aug 26, 2026
View reviewed changes

AlexanderRichey approved these changes Aug 26, 2026
View reviewed changes

tejaskash added 2 commits August 26, 2026 09:13

tejaskash force-pushed the feat/inspector-http-layer branch from defd2b1 to 31df625Compare August 26, 2026 13:13

github-actionsBot added size/xl PR size: XL and removed size/xl PR size: XL labels Aug 26, 2026

agentcore-devx-automationBot added the claude-security-reviewing Claude Code /security-review in progress label Aug 26, 2026

agentcore-devx-automationBot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 26, 2026

tejaskash merged commit 3bafeae into refactorAug 26, 2026
19 of 20 checks passed

tejaskash deleted the feat/inspector-http-layer branch August 26, 2026 15:05