Release/1.0.1#516
Merged
Merged
Conversation
Bumps [types-aiofiles](https://github.com/python/typeshed) from 25.1.0.20251011 to 25.1.0.20260409. - [Commits](https://github.com/python/typeshed/commits) --- updated-dependencies: - dependency-name: types-aiofiles dependency-version: 25.1.0.20260409 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…conversation cost badge, compaction events (#249) Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* feat(login): lava-lamp motion for backdrop blobs Replace the static circular drift with organic morphing blob shapes that rise and fall vertically with squish/stretch and gentle rotation. Bumps blob count from 3 to 5 with offset animation delays so morph cycles don't deform in lockstep. Honors prefers-reduced-motion. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(login): three-tier parallax for backdrop blobs Restructure the 5 lava blobs into 6 across 3 depth tiers (far/mid/near). Size, blur, opacity, animation duration, and travel distance all scale with depth so the velocity contrast reads as parallax: huge soft far blobs barely budge while small sharp near blobs traverse the viewport. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(first-boot): apply lava-lamp parallax backdrop and frosted card Mirror the login page's shell so first-boot and login feel like one system: three-tier parallax blobs, primary-color radial wash, faint grid overlay, and the frosted-glass card. Class names are reused under component-scoped styles, so they don't collide with login. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
#254) Replace the dense badge with a richer attachment renderer in user message history: - Images render as an iMessage-style mosaic (1-bubble, 2-col, 1+2 split, 2x2 grid, 5+ with "+N" overlay) and open in a full-screen lightbox with arrow-key navigation. - Non-image files render as a document-style card: tinted header strip with type chip, white "page" body with a folded corner, and filename + size footer. Text-based files (txt, md, csv, html) show a real content excerpt; binary types (pdf, docx, xls/xlsx) get skeleton lines. Backend additions to support the UI: - GET /files/{upload_id}/preview-url — short-lived presigned GET URL, scoped to the file owner, used for inline images and the lightbox. - GET /files/{upload_id}/text-snippet — first 2KB of a text-based file, decoded as UTF-8, for the document card content peek.
…tion - Add spreadsheet_analysis module with factory-produced tools for listing and analyzing tabular data - Implement make_list_spreadsheets_tool to enumerate CSV/Excel files from knowledge bases and chat attachments - Implement make_analyze_tool to download files from S3, execute Python analysis via Code Interpreter, and return results - Add intelligent schema detection with skiprows probing to handle report-style exports with metadata rows - Implement stderr cleaning to filter pandas/numpy internal frames and show only user-relevant errors - Add output truncation (10K chars) and error truncation (600 chars) to prevent context window overflow - Update ToolRegistry integration to inject spreadsheet tools per-request via extra_tools parameter - Update chat routes (app_api and inference_api) to pass conversation context to tool factories - Add comprehensive docstrings and logging for debugging file discovery and Code Interpreter execution - Enables agents to analyze user-provided spreadsheets without manual file handling or external dependencies
- Add S3 read permissions (GetObject, GetObjectVersion) to runtime execution role for assistants documents bucket - Enable agent's spreadsheet_analysis tool to download tabular KB files (CSV/XLSX) from S3 for Code Interpreter sandbox analysis - Add S3_ASSISTANTS_DOCUMENTS_BUCKET_NAME environment variable to runtime configuration via SSM parameter - Update documentation comments to clarify that documents bucket is now accessed at runtime by the agent, not just during ingestion - Resolves agent failures when attempting spreadsheet analysis due to missing bucket configuration
…mentation - Add StartCodeInterpreterSession, StopCodeInterpreterSession, GetCodeInterpreter, GetCodeInterpreterSession, and ListCodeInterpreterSessions actions to runtime execution role - Replace CreateCodeInterpreterSession with StartCodeInterpreterSession to align with AWS API - Add detailed inline documentation referencing AWS Bedrock Agent Core policy guide - Scope permissions to this stack's Custom Code Interpreter resource only, removing need for account-wide discovery permissions
…sion navigation - Add loaded assistant check to prevent re-fetching already-loaded assistant on metadata signal changes - Prioritize in-memory loaded assistant over query params and session preferences when determining which assistant to use - Add cross-session navigation detection to clear stale assistant state before new session metadata loads - Prevent mid-session assistant attachment validation error when query param persists after first message - Add conditional clearing of assistant state to avoid wiping in-memory assistant on first turn of new sessions - Improve assistant resolution priority: loaded assistant → query param → session preferences - Add detailed comments explaining RAG continuation across follow-up messages and state management edge cases - Fixes issue where assistant would be lost after first message submission or when navigating between sessions (#205)
…d using URL as source of truth - Fix assistant_id storage in SessionMetadata by updating preferences sub-model instead of top-level model, resolving silent failures under extra="allow" - Remove redundant assistant_id resolution logic that attempted fallback to session preferences, simplifying to trust URL query parameter - Update session list to pass assistantId query param when navigating to sessions with attached assistants - Refactor session page effect to use URL as single source of truth for assistant attachment, eliminating race conditions from metadata fetch timing - Add self-heal redirect to rebuild URL with assistantId when landing on bare `/s/:id` URLs from bookmarks or legacy links - Prevents mid-session assistant validation failures on turn 2+ by ensuring preferences.assistant_id is properly persisted and accessible Fixes #205
- Add comprehensive section on handling missing/disabled tools in main agent system prompt - Include step-by-step instructions for identifying user intent and suggesting tool enablement - Provide mapping of common user intents to corresponding tools (spreadsheet analysis, code interpreter, web search, knowledge base) - Add concrete example response showing how to guide users to enable Spreadsheet Analysis tool - Improve user experience by directing users to settings panel rather than refusing requests - Enable graceful degradation with fallback suggestions when tools are unavailable
…files (#262) Render parsed markdown in the attachment card excerpt instead of raw text, and open a full-screen modal viewer when a .md card is clicked rather than opening the raw source in a new tab. Reuses ngx-markdown (already wired up for assistant messages) and the existing presigned preview-url flow. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Render real first-page thumbnails for PDF attachments instead of the
skeleton mockup. Page rasterization runs in app-api via pypdfium2
(Apache 2.0 / BSD, bundled PDFium binary, no system poppler/ghostscript).
Backend:
- New `ThumbnailRenderer` with a MIME-type dispatcher; PDF only today.
Class docstring documents the recommended out-of-process design for
.docx / .xlsx so the dispatcher stays small.
- New `GET /files/{upload_id}/thumbnail` endpoint. Lazy: HEAD-checks for
a cached `_thumb.png` sibling next to the original, renders + stores
on miss, returns a short-lived presigned GET URL. 415 for unsupported
MIME types, 422 for unreadable / corrupt PDFs.
- Render runs in `loop.run_in_executor` so request workers aren't blocked.
- Single-file and session-cascade deletes now also remove the thumbnail
sibling.
Frontend:
- `FileUploadService.getThumbnail()` returns a typed result so callers
can switch on `ready` / `unsupported` / `unavailable` without parsing
HTTP errors.
- File attachment badge fetches the thumbnail on mount for PDFs and
renders it as an `object-cover` image in the card body, suppressing
the bottom fade. Silently falls back to the existing skeleton on any
error.
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…for Code Interpreter - Add targeted error hints for XLSX→CSV filename mismatches in sandbox environment - Implement tolerant file matching for CSV↔XLSX aliasing to prevent retry loops - Expand analyze_tool docstring with critical guidance on filename vs. sandbox paths - Add schema footer preservation on errors for better retry context - Enhance list_spreadsheets_tool with file size and MIME type metadata - Update system prompt builder to clarify file handling for spreadsheet analysis - Improve stream processor error handling for Code Interpreter responses - Add file metadata models and utilities for consistent attachment handling - Update chat input component to support file metadata in message attachments Fixes: #206
# Conflicts: # backend/pyproject.toml # backend/src/apis/inference_api/chat/routes.py # backend/src/apis/inference_api/chat/service.py # frontend/ai.client/src/app/auth/login/login.page.css # frontend/ai.client/src/app/auth/login/login.page.ts # frontend/ai.client/src/app/session/session.page.ts
* docs(spec): bugfix requirements for BFF middleware event-loop blocking Regression surfaced after v1.0.0-beta.24 deploy (commit 258193d). The new SessionRefreshMiddleware runs sync boto3 (DynamoDB + Cognito) inside async handlers on the hot path of every cookie-bearing request, on a single uvicorn worker in a single ECS task, with aligned cache TTL and sliding-renewal throttle defaults. Page-load fan-out produces ~16 serialized blocking AWS calls per active user per minute. Spec captures the defect (7 clauses), corrected behavior (7 clauses), and regression-prevention invariants (11 clauses) to carry into design. * docs(spec): Add BFF middleware event-loop blocking bugfix design and tasks - Add comprehensive design specification for SessionRefreshMiddleware event-loop blocking issue - Document root causes: sync boto3 I/O, missing fan-out coalescing, aligned cache/throttle windows, inline awaited writes - Include formal bug condition specification with 7 sub-conditions and observable symptoms - Add detailed glossary of key components and terminology - Document preservation requirements and public contracts that must remain unchanged - Add implementation tasks with acceptance criteria and verification steps - Include deployment configuration changes (CDK worker count, environment variables) - Provide testing strategy for concurrency, performance, and regression validation * fix(bff-middleware): Resolve event-loop blocking and fan-out amplification - Offload SessionRepository boto3 calls via asyncio.to_thread to prevent event-loop blocking - Offload CognitoRefreshClient.refresh via asyncio.to_thread for non-blocking auth operations - Add per-session single-flight primitive module to coalesce concurrent refresh requests - Wire single-flight into SessionRefreshMiddleware._resolve_session to eliminate duplicate work - Convert _maybe_slide to fire-and-forget DDB write with synchronous cache update - De-align cache/leeway and throttle windows in config (throttle: 60s → 300s) - Raise production appApi.desiredCount to 2 for distributed request handling - Add comprehensive bug condition and preservation property tests - Update task completion checklist and infrastructure configuration * test(bff): poll for fire-and-forget slide-write under slower schedulers Task 3.5 moved the slide-write DDB call off the request path via `asyncio.create_task`, but `test_3_4_slide_max_age_matches_on_both_cookies` and `test_slide_past_throttle_writes_ddb_and_reemits_cookie` still sampled `update_item_calls` / `touch_last_seen.await_count` immediately after `TestClient` returned the response. On CI's slower scheduling (Python 3.12 runners), the detached task hadn't run yet, so Hypothesis tripped a `FlakyFailure` on the 3.4 property strategy. Fix: poll the counter up to 1s before asserting. The observable external contract (cookie attributes, Max-Age, response body) is unchanged; only the internal timing of the DDB write moved, which is exactly what task 3.5 intends. * fix(bff): keep strong ref on fire-and-forget slide-write tasks Task 3.5 dispatched the slide-write via `asyncio.create_task` but discarded the returned Task reference. Python's docs explicitly warn about this — without a strong reference, the task can be garbage-collected mid-execution. On Python 3.12 CI runners this was racing: the preservation test `test_3_4_slide_max_age_matches_on_both_cookies` saw 0 `update_item` calls (Hypothesis flagged it as FlakyFailure — failed on first run, passed on retry). Fix: hold a set of pending tasks on the middleware instance and attach an `add_done_callback(self._slide_tasks.discard)` so the set doesn't leak. This is the canonical pattern from the asyncio docs: https://docs.python.org/3/library/asyncio-task.html\#asyncio.create_task Verified locally by running the exact CI test scripts inside the agentcore-dev container: - scripts/stack-app-api/test.sh -> 2459 passed - scripts/stack-inference-api/test.sh -> 2459 passed * test(bff): poll inside TestClient context so background task can run CI was still failing `test_3_4_slide_max_age_matches_on_both_cookies` on Python 3.12 despite the strong-reference fix in 78891e2. The production change was correct — the task reference prevents GC. But the test was polling OUTSIDE the `with TestClient(app)` block, and TestClient's `__exit__` shuts down the anyio portal (and the event loop) before the polling even starts. Any pending asyncio.Task on that loop is cancelled on teardown, never runs, update_item_calls stays 0. Fix: poll INSIDE the `with` block. If the task hasn't flushed yet, drive the event loop with a second GET to give the pending task a chance to run. Same pattern applied to test_slide_past_throttle_writes_ddb_and_reemits_cookie. Reproduced the race locally by setting up a Python 3.12 venv inside the agentcore-dev container (CI's exact version). Ran the full test suite on both 3.12 and 3.13: 2459 passed on each. Also includes the code review report written earlier. --------- Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* feat(agents): upgrade strands to 1.39.0 and enable Bedrock prompt caching Bumps strands-agents 1.37.0 → 1.39.0 and strands-agents-tools 0.5.1 → 0.5.2. Re-enables CacheConfig(strategy="auto") on the BedrockModel: the original blocker (strands PR #1438 — cachePoint blocks alongside non-PDF document attachments) is now included in v1.39.0, so the workaround is no longer needed. Updates the corresponding model_config test to assert caching is emitted rather than suppressed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(model-config): defer Bedrock prompt caching enablement Backs out the CacheConfig(strategy="auto") activation. The SDK-side blocker (strands PR #1438) is resolved in 1.39.0, so the technical barrier is gone — but the user-visible cost/badge impact warrants a separate, scoped rollout. The version bump itself stays. The deferral comment in model_config.py replaces the outdated "Bedrock limitation" rationale; the test now documents intentional deferral instead of the SDK limitation. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…mantics (#270) * fix(token-accounting): correct per-message cost and context-window semantics Two related bugs were inflating cost and context-% reporting on tool-use turns: 1. Per-message cost double-count. Strands emits both per-LLM-call metadata (each call's tokens) and a final AgentResultEvent whose EventLoopMetrics.accumulated_usage is summed across every call in the turn. Both were emitted as `metadata` events and routed into per_message_metadata[current_assistant_message_index]["usage"] via .update(). Because the AgentResult event arrives after every message_stop, the index still pointed at the last assistant message — so cumulative tokens overwrote that message's per-call values, double-counting earlier messages' input tokens when each entry was priced and summed. Fix: route the result-extracted cumulative on the existing `metadata_summary` (turn-summary) track instead of `metadata`. The stream_processor main loop now consumes both event types into its accumulated_metadata so the final summary still carries true totals. 2. Context-% inflation within a tool turn. Bedrock reports each per-LLM-call inputTokens as the FULL context size sent on that call. For a 2-call tool turn (call_1.input=1000, call_2.input=2500), Strands' accumulated_usage reports 3500 — but the actual current context occupancy is 2500. The final SSE `usage` field (which drives the context-% badge and compaction trigger) was inheriting Strands' summed value via the metadata_summary handler in stream_coordinator. Fix: stream_coordinator no longer accumulates `metadata_summary` into accumulated_metadata. Per-call `metadata` events last-write-wins via .update(), so accumulated_metadata.usage equals the most recent call's full input = current context. Added a CAUTION comment noting AgentResult.context_size / EventLoopMetrics.latest_context_size return only `inputTokens` (excluding cacheRead/cacheWrite) — under prompt caching they under-report by 99%+, so we deliberately sum all three buckets. Also folded in: TTFT placeholder of 0 → null. A real time-to-first-token can never be 0ms, and aggregations need to distinguish absence from a real value. LatencyMetrics.time_to_first_token is now Optional[int] in both shared/sessions and app_api/messages models. Frontend stream parser preserves null instead of coercing; badge component already hides via truthy check. Existing zero-valued data deserializes fine. Tooltip on the context-% badge clarified: "Reflects the most recent turn ... May shrink after a context compaction." Aria-label matches. Regression tests in test_per_message_cost_attribution.py: - TestPerMessageAttributionTwoCallTurn (3 cases) — locks the metadata vs metadata_summary contract; without the fix, per_message_metadata[1].usage = (2300, 130, 2430) instead of the expected per-call (1300, 80, 1380). - TestSummaryAccumulatorAcceptsBothTracks — main loop accumulator must consume both tracks for cumulative totals. - TestStreamCoordinatorContextOccupancy (2 cases) — pin "current context" semantic in stream_coordinator and verify the all-three- bucket sum (cacheRead/cacheWrite included) matches the most recent call's full input. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(costs): add unit tests for CostCalculator math CostCalculator is the source-of-truth for all USD math, but the existing costs/ test suite only exercises it transitively through aggregator and storage tests with mocks. Add a direct test file with 26 cases covering: - Per-bucket pricing (input/output/cacheRead/cacheWrite) and component sums equaling the total - Cache scenarios (read-only, write-only, mixed) priced against Sonnet 4.5 rates so dollar values can be sanity-checked - Defensive cases: missing pricing keys, None values throughout, empty dicts — all degrade to 0 without raising - calculate_cache_savings correctness and None-tolerance - validate_pricing / validate_usage required-field predicates Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…oot (#271) The dark-mode CSS for the auth pages' lava-lamp backdrop and frosted-glass card never applied: hand-written `html.dark .X` selectors don't match correctly under Angular's emulated view encapsulation, and ThemeService (providedIn:'root') was never injected by anything in the pre-auth tree so the `dark` class wasn't reaching <html> on a cold load. - Switch the auth-page CSS to `:host-context(html.dark) .X`, the pattern the rest of the codebase already uses for component-scoped dark rules. - Force ThemeService to construct at bootstrap via provideAppInitializer so the persisted/system theme is applied to <html> before any route renders, including /auth/login and /auth/first-boot on cold load. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
…272) * feat(auth): add SKIP_AUTH=true local-dev bypass with allowlist guard Adds a single-env-var bypass so unattended local dev (and Claude Code) can hit protected routes without the Cognito redirect to an external IdP. The bypass returns a fake admin user from the three auth dependencies in apis.shared.auth.dependencies; everything else (CSRF middleware, RBAC, profile cache) flows naturally because no `bff_session` is resolved. Two safeguards keep the bypass scoped to local dev: 1. Allowlist startup guard in app_api/main.py — refuses to boot when SKIP_AUTH=true is paired with any non-localhost entry in CORS_ORIGINS. Empty CORS_ORIGINS also refused. Fails closed for deploy targets we haven't anticipated, instead of a blocklist of known cloud env vars. 2. CI guard (.github/workflows/skip-auth-guard.yml) — greps CDK source, workflows, and Dockerfiles for SKIP_AUTH=true / SKIP_AUTH: true patterns and fails the build if any leak into deployed config. Why an allowlist of CORS origins: CORS_ORIGINS must be set correctly per environment for the app to function at all, so it's a reliable positive signal of "this is local dev" — far stronger than enumerating Lambda / ECS / EKS / App Runner / AgentCore Runtime indicators. Inference-api is intentionally not bypassed; all SPA traffic flows through app-api per the BFF pattern, so the single bypass on app-api is sufficient. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(ci): SHA-pin checkout and use ubuntu-24.04 in skip-auth-guard workflow Match the supply-chain conventions enforced by tests/supply_chain/{test_action_pinning,test_runner_pinning}.py: pin actions/checkout to the canonical repo SHA and replace ubuntu-latest with ubuntu-24.04. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(auth): defer SKIP_AUTH startup guard to lifespan + add tests Move the CORS_ORIGINS allowlist check from import-time into lifespan() so tests that import or reload apis.app_api.main (e.g. tests/routes/test_pbt_auth_sweep.py) don't trip the guard. The runtime behaviour is unchanged — uvicorn still invokes lifespan at boot. Add tests/auth/test_skip_auth.py covering: - _skip_auth_user(): None when unset/falsey, fake User when truthy, honors all SKIP_AUTH_* env overrides. - All three auth dependencies bypass when enabled, still 401 when not. - Startup guard accepts every localhost variant, rejects empty / unset / non-localhost CORS_ORIGINS. - The skip-auth-guard.yml regex matches realistic leak strings and skips benign ones. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test: scrub SKIP_AUTH bleed from local .env in pytest conftest Tests that reload apis.app_api.main (e.g. test_pbt_auth_sweep.py) re-run load_dotenv(override=True), which copies SKIP_AUTH=true from a developer's backend/src/.env into os.environ for the rest of the process. Downstream auth-aware tests then silently take the bypass path and return a fake user. Add a session-wide autouse fixture that delenvs SKIP_AUTH_* per test. Test-local monkeypatch.setenv still wins (autouse runs first). Mirrors the existing pattern at tests/apis/shared/oauth/conftest.py. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(test): manage SKIP_AUTH env directly so autouse doesn't break sibling fixtures The monkeypatch-based scrub fixture changed pytest's fixture dependency graph: tests/apis/app_api/test_connectors_routes.py uses monkeypatch.setattr(routes, "_agentcore_control_client", lambda) and relies on its own autouse `_reset_control_client` tearing down AFTER that monkeypatch reverts. Adding a sibling autouse fixture that also depends on monkeypatch flipped the teardown order, leaving `_agentcore_control_client` as a plain lambda when `_reset_control_client` calls `cache_clear()` on it — 9 errors in CI. Manage os.environ directly via save/restore in a try/finally so the new fixture is independent of monkeypatch and doesn't perturb ordering for tests that compose monkeypatch with their own fixtures. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(env): document SKIP_AUTH local-dev bypass in .env.example Add a DEVELOPMENT SETTINGS section entry covering SKIP_AUTH and its optional SKIP_AUTH_ROLES / SKIP_AUTH_USER_ID / SKIP_AUTH_EMAIL knobs. Calls out the boot-time CORS_ORIGINS allowlist, the CI guard workflow, and the inference-api carve-out so a new dev landing in the file sees the safety story alongside the feature. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(bff): share AES-256 cookie data key across tasks via Secrets Manager PR #264 raised app-api desiredCount from 1 → 2 for concurrency slack but left CookieCodec calling kms:GenerateDataKey on first use per process. That generates a fresh random AES key per task, so a cookie sealed by Task A unseals as `bad seal` on Task B — every page-load fan-out under the new deployment shape becomes a 401 storm. Dev confirmed: /sessions returns 200 from one task while /permissions, /models, /tools, /quota, /connectors all return 401 from the other. This commit moves the data key out of per-process state and into a shared Secrets Manager secret, bootstrapped once at deploy time. Infra (CDK): - New `BFFCookieDataKeySecret`, encrypted at rest with the existing `BFFCookieSigningKey` CMK. - Two chained `AwsCustomResource`s bootstrap the wrapped data key on Create only: `kms:GenerateDataKey` -> `secretsmanager:PutSecretValue`. `outputPaths: ["CiphertextBlob"]` whitelists the field returned to CFN so the response Plaintext (the AES key itself) never enters CloudFormation state. - SSM parameter publishes the secret ARN for app-api to consume. App-api: - `CookieCodec._ensure_cipher` now reads the wrapped blob from Secrets Manager, calls `kms:Decrypt(KeyId=BFFCookieSigningKey, ...)` to unwrap, and caches the AESGCM cipher as before. KeyId is pinned to defend against blob substitution if the secret is ever tampered. - Distinguish infra failure (`CookieDataKeyUnavailable` -> 5xx) from decode failure (`CookieDecodeError` -> clear cookie). Empty / non- base64 / wrong-size key all surface as infra errors. - Drop `kms:GenerateDataKey` from the runtime task role (least privilege; runtime no longer needs it). The bootstrap custom resource carries its own narrow grant. Tests: - Cross-task seal/unseal regression locked in: `test_two_codecs_with_same_wrapped_blob_decrypt_to_the_same_cipher` — two CookieCodec instances simulate two ECS tasks; cookie sealed on one MUST unseal on the other. - New `_ensure_cipher` battery: happy path, KeyId pin, hot-path caching, Secrets Manager / KMS failure propagation, empty / bad base64 / wrong-size key rejection, missing config -> decode error. - Updated test_3_6 preservation contract to match the new code path (one Secrets Manager + one KMS Decrypt per process, was: one GenerateDataKey). - CDK tests for the bootstrap custom resources (KeySpec=AES_256, outputPaths whitelisted, narrow IAM grants), the new env var on app-api, and the IAM grant changes (Decrypt-only on the CMK, GetSecretValue on the data-key secret). - Fixed two pre-existing stale resource-count assertions in infrastructure-stack tests (16 → 18 DDB tables, 3 → 6 secrets). * fix(bff): coalesce Cognito refresh across tasks via DDB conditional-write lock The in-process `single_flight` and `get_session_lock` introduced by PR #264 only coalesce same-session callers within a single Python process. Once the cookie-codec fix lands and dev's two app-api tasks can share cookies again, two tasks under desiredCount: 2 will each see the same cookie cross the refresh-leeway boundary and each call `cognito-idp:initiate_auth` with the same refresh token. Cognito rotates on the winning call; the loser receives `NotAuthorizedException`, the loser's middleware clears the user's cookie, and the user is silently logged out. This commit adds a cross-task lock so exactly one Cognito refresh per session per leeway window happens across the entire fleet. Repository (DDB): - New `try_acquire_refresh_lock(session_id, owner, lock_ttl_seconds)`: conditional UpdateItem that succeeds iff `attribute_not_exists( refresh_lock_until) OR refresh_lock_until < :now`. Loser returns False; non-condition errors propagate. - `update_tokens` gains `expected_lock_owner=...` — when supplied, the write conditionally requires the row's `refresh_lock_owner` to match (or be absent), and atomically REMOVE-es the lock attrs in the same write. ConditionalCheckFailed propagates so a stale leader can't stomp on a successor's freshly persisted tokens. - `release_refresh_lock(session_id, owner)`: best-effort cleanup for the leader-failed path so a peer doesn't have to wait the full TTL before retrying. No-op if the lock has TTL'd or another task owns it. Other DDB errors logged-and-swallowed. Middleware: - Two-tier coalescing inside `_resolve_session._loader`: 1. existing `get_session_lock` (in-process) collapses N concurrent same-session callers within one task to one contender. 2. NEW `try_acquire_refresh_lock` (cross-process via DDB) elects exactly one leader across the entire fleet. Followers poll the row via `_wait_for_peer_refresh` and adopt the leader's tokens (rotation detected by refresh-token mismatch; non-rotation detected by access-token mismatch + future-dated exp). - Leader path: lock owner threaded through `_persist_refresh` so the write is conditional on still-being-leader. ConditionalCheckFailed on persist → re-read DDB and adopt the peer's tokens rather than invalidating the cache. - Cognito refresh failure on leader path: lock is released eagerly (best-effort) so peer requests don't have to wait for the full TTL. - Configurable `refresh_lock_ttl_seconds` (default 30s) — bounds the worst case where a leader crashes mid-refresh. Tests: - 8 new repository tests for the lock primitive: acquire on unlocked row, contention blocks peer, TTL recovery, distinct-session isolation, release-by-owner-only, atomic clear on token persist, condition fails when peer owns the lock. - 5 new integration-level cross-task tests (`test_session_refresh_cross_task.py`) running two `SessionRefreshMiddleware` instances over one moto DDB table — covers leader/follower paths, follower-polling-then-adopting, lock TTL recovery after dead leader, follower-falls-back-terminal when leader is stuck, and the headline invariant: two tasks racing in parallel call Cognito at most once. - Updated `test_session_refresh_preservation.py`'s `InstrumentedTable` to differentiate lock-acquire / token-persist / slide writes so `update_item_side_effect` injection only fires on the persist path (preserving the original test intent). No IAM change required: app-api task role already has `dynamodb:UpdateItem` on the BFF sessions table.
…nerated secret (#274) PR #273 introduced an `AwsCustomResource`-chained bootstrap (kms:GenerateDataKey -> secretsmanager:PutSecretValue) to materialize a wrapped AES-256 data key for cross-task cookie sealing. That design fails on first stack create with: Custom::AWS BFFCookieDataKeyGenerate CREATE_FAILED Response object is too long. Root cause: the AwsCustomResource framework Lambda JSON-stringifies the AWS-SDK response BEFORE applying `outputPaths`. KMS returns `CiphertextBlob` as a Uint8Array, which serializes as `{"0":233,"1":18, ...}` — for a ~200-byte ciphertext that's ~1.5 KB, blowing past CloudFormation's 4 KB response-object limit. Even if it had landed under the limit, the value threaded into PutSecretValue via `getResponseField` would have been the JSON-object form, not a base64 ciphertext — runtime base64-decode would have failed at first cookie seal attempt. Fix: drop the chained custom resources entirely. Use Secrets Manager's own `generateSecretString` (44-char alphanumeric, ~261 bits of entropy) and derive the AES-256 key at runtime via SHA-256. Single-shot SHA-256 of a >=256-bit-entropy random input is a sound KDF — the output is statistically indistinguishable from random for AES-256 use. Threat model is preserved: - Secret is still encrypted at rest with the customer-managed `BFFCookieSigningKey` CMK. - Reading it requires both `secretsmanager:GetSecretValue` AND `kms:Decrypt` on the CMK (Secrets Manager invokes Decrypt on the caller's behalf using the secret-ARN encryption context). - Runtime never gets `kms:GenerateDataKey`, so a compromised task can't seal cookies under a parallel key. - Cross-task seal/unseal regression lock (`test_two_codecs_with_same_secret_derive_the_same_cipher`) still holds. Infra (CDK): - Removed `BFFCookieDataKeyGenerate` and `BFFCookieDataKeyStore` AwsCustomResources and their narrow IAM grants. - `BFFCookieDataKeySecret` now uses `generateSecretString` directly. - Dropped `kms:DescribeKey` from app-api task role; kept `kms:Decrypt` (Secrets Manager invokes it on the caller's behalf when reading a CMK-encrypted secret). - Removed the `AwsCustomResource` import; cleaned up obsolete bootstrap-related comments. App-api: - `CookieCodec._ensure_cipher` now reads the secret string from Secrets Manager and applies SHA-256 to derive the 32-byte AES-256 key. No KMS round trip, no per-cold-start `kms:Decrypt` call. - `CookieCodec` constructor lost the `kms_client` parameter; only `secrets_manager_client` is needed for testing. - Updated module docstring and `CookieDataKeyUnavailable` comment. Tests: - `test_cookie.py`: rewrote `_ensure_cipher` test battery for the no-KMS path. New `test_ensure_cipher_derived_key_matches_sha256_of_secret` pins the KDF — a future change must keep the same derivation, or every cookie sealed by an old task fails to unseal on a new task after deploy. Cross-task regression lock renamed to `test_two_codecs_with_same_secret_derive_the_same_cipher`. - `test_session_refresh_preservation.py`: 3.6 contract no longer asserts `kms.decrypt.call_count` or KeyId-pinning; only the Secrets Manager singleton-call invariant remains. - `test_session_refresh_cross_task.py`: comment updated to match new vocabulary (data-key secret vs wrapped data key). - `infrastructure-stack.test.ts`: dropped bootstrap-CR assertions (`generateDataKey` / `putSecretValue`); added negative lock that no AwsCustomResource emits those actions, plus a positive assertion on the `generateSecretString` shape (PasswordLength: 44, ExcludePunctuation, IncludeSpace: false). - `app-api-stack.test.ts`: comment-only update for the `kms:GenerateDataKey` exclusion; same negative assertion still holds under the new design. Net diff: -153 lines. No more chained custom resources, no per-cold- start KMS round trip, simpler runtime IAM surface. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
… guard (#275) Two correctness improvements layered on top of PR #273's cross-task refresh-lock work. 1. Strict-owner lock release (repository.py) The post-#273 release condition was: attribute_not_exists(refresh_lock_owner) OR refresh_lock_owner = :owner That has a stale-leader stomp bug: Task A acquires the lock. Task A's lock TTLs (slow Cognito refresh, ECS eviction, etc.). Task B acquires the lock, refreshes, and persists tokens — which REMOVEs the lock attrs in the same write. Task A returns from Cognito and calls update_tokens with our (older) tokens. `attribute_not_exists(refresh_lock_owner)` matches — Task A's stale tokens overwrite Task B's freshly rotated ones. Next request: Cognito rejects Task A's now-revoked refresh token; user silently logged out. Fix: tighten to strictly `refresh_lock_owner = :owner`. The leader always sets these attrs in `try_acquire_refresh_lock`, so the strict form is correct in every legitimate flow and surfaces every stale- leader case as `ConditionalCheckFailedException` for the caller to re-read and adopt the peer's tokens. Also adds `try_acquire_refresh_lock` test coverage to lock in that the acquire path uses `attribute_exists(PK)` so it never creates phantom rows for sessions that don't exist. 2. Absolute-lifetime guard before refresh (session_refresh.py) Mirrors the existing `_maybe_slide` short-circuit. If a session is past `created_at + absolute_lifetime_seconds`, don't burn a Cognito refresh-token rotation on a session whose row would TTL-evict immediately after the write — clear the cookie instead. Otherwise we silently rotate a token we'll never read again. Plus INFO logging on cross-task adoption success so CloudWatch can answer "how often is cross-task coalescing actually firing?" without needing a debug deploy. Tests: - test_repository.py: new test_update_tokens_rejects_persist_when_peer_already_cleared_the_lock locks in the strict-owner condition. test_try_acquire_refresh_lock_does_not_create_phantom_row pins the acquire-path attribute_exists guard. - test_session_refresh_middleware.py: new test_refresh_path_past_absolute_cap_clears_cookie_without_calling_cognito pins the absolute-lifetime guard ahead of the lock acquisition. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Previously only the SessionService bootstrap path redirected on 401 — a session that expired mid-session left the user stranded with a generic toast (CRUD endpoints) or no feedback (SSE chat stream). Now every 401 flows through SessionService.handleUnauthorized(), which dedupes concurrent calls and queues a single navigation to /auth/login with a returnUrl preserved. Also surfaces session loss proactively rather than waiting for the next HTTP call to fail: - Cookie-presence fast-path in bootstrap and recheck — when the JS-readable __Host-bff_csrf cookie is gone, the session cookie is gone too (BFF sets/clears them together with matching Max-Age), so we skip the /auth/session round-trip and bounce straight to login. - Visibility re-probe in the app shell — on tab refocus, recheck() runs the cookie check and falls back to /auth/session, so a session that expired while the tab was backgrounded is caught immediately. Deferred to follow-ups: cross-tab BroadcastChannel coordination, draft preservation across login redirect, periodic background polling. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
… bootstrap run 2026-05-10 (#278) Adds two new repo-level skills under .claude/skills/: - kaizen-research: Friday early-AM external + internal scan (AWS Bedrock/AgentCore, Strands, aws-samples reference repo, MCP, frontier models, agent-harness patterns; internal git/PR/CI/version-pin signals). Outputs dated research doc + queues ideas in docs/kaizen/review-queue.md. - kaizen-review-prep: Friday late-AM ranked decision agenda. Consumes research + open queue + last-week's POC findings (from prior research PR comments) + recent merges/CI signal. Every item has Ship/Decline/Defer recommendation. Both skills open PRs into develop on kaizen/* branches. Web budget soft-target 50/run; subagent fan-out for external sources; explicit handoff contract via review-queue.md. This commit also includes the first bootstrap output: - docs/kaizen/research/2026-05-10.md - docs/kaizen/reviews/2026-05-10.md - docs/kaizen/review-queue.md (7 open items) Top finding: bedrock-agentcore is 3 minor versions behind (1.6.4 -> 1.9.0, released inside scan window) and our open issues #266/#267 were quietly closed by Strands v1.37/v1.38 (already in our 1.39 pin from #265). CI failure cluster (9 nightly + 6 deploy failures since May 6) is the loudest internal signal. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…ative subtraction clarification (#279) Three additions to the kaizen-research skill (and corresponding refresh of the 2026-05-10 bootstrap output): 1. **FastMCP** added as source category 4a — tracks upstream releases for the externally hosted MCP servers this stack consumes via AgentCore Gateway. Not pinned in this repo's pyproject.toml; lives in the MCP server repos. Source: https://github.com/jlowin/fastmcp + PyPI. 2. **Library-native subtraction** explicitly named in the Subtraction-first philosophy. When upstream ships a capability we built or filed an issue for, the win is closing our version and adopting upstream. The 2026-05-10 bootstrap surfaces a canonical example: Strands v1.37/v1.38 silently closed our open issues #266 and #267. 3. **Security posture audit** added as internal source 18a. Snapshots open Dependabot alerts, open CodeQL findings (with severity + rule + path), open security-labeled issues, recent auth-surface commit churn, and the most recent CHANGELOG security block. Cross-references open Dependabot alerts against external advisories scan to surface "we already know it's hitting us" overlap. Surfaces in the doc as a new "Security posture" section between Version-pin lag and Retirement candidates. The bootstrap output (2026-05-10) was re-walked through the new lenses: - Security posture section added: 9 open Dependabot alerts (4 high — all `fast-uri`, confirmed real by the external advisories scan), 10 open CodeQL (3 error-severity `py/log-injection` in real backend paths), 0 security-labeled issues, 7-commit BFF auth-surface churn. - 2 new Top-7 proposals: #1 patch `fast-uri` Dependabot alerts; #3 fix `py/log-injection` CodeQL findings. Both Low effort, High/Med-High impact — they jump to the top of the ranked agenda. - TL;DR, Take, and Review Protocol updated to reflect security findings. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…I/UX lens (#280) Scope refinement to kaizen-research skill based on feedback. The kaizen loop is for emerging functionality, agentic trends, tools, and feature/UX improvements — security signals are handled by Dependabot and CodeQL directly and don't need a parallel weekly kaizen pass. Removed: - External source #10 "Security advisories" (github.com/advisories filter) - Internal source #18a "Security posture audit" (gh dependabot/codeql/secret-scanning + auth-surface churn) - Output template "Security posture" section, "Security advisories" source subsection - Step 5a security cross-reference - Security-related Top-5 weighting in step 6 - Bootstrap proposals #1 (fast-uri patch) and #3 (log-injection) — these belong on the security tracker, not the kaizen agenda Added: External source #4b "Agentic UI/UX patterns" covering: - MCP Apps + extensions spec (modelcontextprotocol.io/extensions/apps — SEP-1865) - AI SDK / Generative UI cookbook (ai-sdk.dev — patterns, not React adoption) - assistant-ui releases + mcp-app-studio (Yonom/assistant-ui) - Vendor product blogs (Linear, Cursor, Anthropic news filtered for design/artifact/ui) - OpenAI Canvas + ChatGPT UI updates - NN/g AI articles (evidence-based UX research) Output template gains an "Agentic UI/UX patterns" subsection. Top-5 weighting now boosts UI/UX patterns that match an existing surface (tool-call rendering, attachments, A2A attribution, consent flows). Re-walks the 2026-05-10 bootstrap output through the new lens: - New Top-6 proposal #1: scope an MCP Apps host renderer in our chat (every major host — Claude Desktop, ChatGPT, VS Code Copilot, Goose, Postman — ships this; we don't) - New Top-6 proposal #3: per-tool renderer registry (signal-backed) — independently valuable AND pre-paves the MCP Apps work - New proposal #8: named A2A agent participants (Linear Agent pattern) - TL;DR and Take rewritten around the UX shift + library-native subtraction - Review-queue + review-prep doc renumbered to match 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…queue item (#281) Adapt kaizen-research and kaizen-review-prep to evaluate upstream features through a dual lens — impact-on-existing-code and capability-unlock — rather than only asking what each feature replaces. Triggered by the 2026-05-10 AgentCore Runtime BYO filesystem (S3 Files / EFS) item, which was initially framed as "could replace future filesystem-staging glue" — under-weighting the actual story (code-interpreter sandboxes, cross-session uploads, shared skill hot-swap, persistent vector indexes). Skill changes: - New Philosophy bullet on the dual lens in both skills. - Research source-item template gains an `*unlocks*` annotation alongside `*relevance*`; Top 5 table gains an `Unlocks?` column. - Review-queue entry template and review-prep Proposal template both gain an `Unlocks` field (required when `Subtracts: no — addition only`). - Ranking guidance: capability-unlock items rank on strategic merit, not auto-deferred for lacking an existing-code intersection. Queue update: - Add "Scope AgentCore Runtime BYO filesystem (S3 Files / EFS) for persistent agent workspaces" at the top of `## Open`, framed as a capability unlock with explicit Unlocks bullets and Open questions on GA status, VPC commitment, and multi-tenancy isolation. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* Potential fix for pull request finding 'Unused local variable'
* Potential fix for pull request finding 'Unused local variable'
* docs(readme): update version badges and tech stack to v1.0.0-beta.18
- Update release badge from v1.0.0-beta.17 to v1.0.0-beta.18
- Bump Tailwind CSS version from v4.1 to v4.2 in all references
- Update current release version in release notes section
- Reflect latest dependency versions in architecture and tech stack documentation
* feat(embeddings): add optional token validation bypass for search queries
- Add skip_token_validation parameter to generate_embeddings function
- Allow skipping tiktoken-based token validation for short inputs where tiktoken may not be installed
- Update search_assistant_knowledgebase to skip validation for query embeddings
- Enables embedding generation in environments where tiktoken is unavailable (e.g., search Lambda)
* refactor(embeddings): extract shared embedding logic to separate module
- Move core embedding generation and vector store operations to apis.shared.embeddings
- Create new shared bedrock_embeddings module with generate_embeddings, store_embeddings_in_s3, search_assistant_knowledgebase, and delete_vectors_for_document
- Extract vector search logic to new apis.shared.assistants.vector_search module
- Keep ingestion-specific token validation (tiktoken-based) in app_api embeddings module
- Update ingestion embeddings module to re-export shared functions for backward compatibility
- Simplify bedrock_embeddings in ingestion pipeline to focus on chunk validation and splitting
- Update imports across documents routes and rag_service to use new shared modules
- Reduces code duplication and establishes clear separation between shared RAG infrastructure and ingestion-specific concerns
* docs(release-notes): document v1.0.0-beta.19 features and fixes
- Add Angular production build optimization section explaining minification and tree-shaking enablement
- Document embeddings refactor extracting shared logic to apis.shared.embeddings module
- Add skip_token_validation parameter documentation for generate_embeddings function
- Update highlights section to mention Angular production build optimization
- Clarify CodeQL workflow improvements and unused import/variable cleanup
- Enable optimization flag in angular.json production configuration for reduced bundle size
* docs(release-notes): remove Angular optimization section and revert config
- Remove "Frontend Production Build Optimization" section from release notes
- Revert optimization flag removal from angular.json production configuration
- Align documentation with actual production build configuration state
* feat: add API Keys section to README for programmatic access to AI models
* fix(model_config): comment out caching configuration due to Bedrock limitations
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* feat: refactor session compaction and enable by default (#86)
* feat: update compaction configuration and enhance session manager tests
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
---------
* test(to_bedrock_config): add missing result assignment in caching disabled test
* Potential fix for code scanning alert no. 41: Clear-text logging of s… (#85)
* Potential fix for code scanning alert no. 41: Clear-text logging of sensitive information
* ci: Add explicit read-only permissions to all workflows
- Add `permissions: contents: read` to 13 GitHub Actions workflows
- Workflows updated: app-api, bootstrap-data-seeding, codeql, frontend, gateway, inference-api, infrastructure, nightly-deploy-pipeline, nightly, rag-ingestion, release, sagemaker-fine-tuning, version-check
- Implements principle of least privilege by explicitly declaring minimal required permissions
- Improves security posture and aligns with GitHub Actions best practices
* fix(security): Redact sensitive information from logs
- Mask client ID in seed_auth_provider output, showing only first 8 characters
- Redact full Secrets ARN in seed_auth_provider, displaying only resource name
- Replace full exception objects with error codes in seed_bootstrap_data error messages
- Downgrade MCP client configuration logging from info to debug level
- Remove user ID from OAuth token retrieval and re-auth status log messages
- Add URL validation to OAuth callback redirect to prevent open redirect vulnerabilities
- Prevents accidental exposure of credentials and sensitive identifiers in application logs
* fix(security): Resolve remaining CodeQL clear-text logging alerts
- seed_auth_provider: Fully redact Secrets Manager ARN from output
- external_mcp_client: Remove server URL from logs, decouple oauth_token from log expressions
- oauth_tool_service: Isolate decrypted token into _try_get_token() to prevent taint bleed, use lazy log formatting
- config.ts: Remove AWS account ID and CORS origins from CDK config log output
* Potential fix for code scanning alert no. 499: Clear-text logging of sensitive information
* Potential fix for code scanning alert no. 496: Clear-text logging of sensitive information
* Potential fix for code scanning alert no. 498: Clear-text logging of sensitive information
* Potential fix for code scanning alert no. 497: Clear-text logging of sensitive information
---------
* feat(frontend): enable production optimization, branch-aware BUILD_CONFIG
- Remove optimization: false from base options (was blocking prod override)
- Production: optimization, no source maps, extract licenses
- Fix anyComponentStyle budget from 4kB to 200kB for Tailwind
- BUILD_CONFIG: main→production, develop→development, dispatch→manual input
Production build: 4.96 MB initial (871 KB gzip) vs 8.85 MB unoptimized
* fix: move Google Fonts import to index.html to prevent CI build failure
* ci: skip docker builds and CDK synth on pull requests
* implement conversation sharing. (#87)
* implement conversation sharing.
* Potential fix for code scanning alert no. 509: Log Injection
* Potential fix for code scanning alert no. 510: Log Injection
* fix github warnings
* fix log issue
---------
* Allow for private share (only with yourself)
* release: v1.0.0-beta.19
* fix float error on sharing
* Apply suggestions from code review
* ci: skip redundant stack dependency checks on PRs (keep infrastructure only)
* ci: skip install on PRs for rag-ingestion (no downstream jobs)
* ci: revert check-stack-deps skip on workflows with PR jobs, skip entire gateway/sagemaker on PRs
* fix(security): resolve CodeQL log-injection, unused-import, and unused-variable alerts
- Remove user-controlled values from 180 log f-strings (py/log-injection)
- Remove 87 unused Python imports (py/unused-import)
- Remove 27 unused JS/TS variables (js/unused-local-variable)
- Fix 3 useless assignments (js/useless-assignment-to-local)
- Fix 1 incompatible type comparison (js/comparison-between-incompatible-types)
* fix(tests): remove stale AgentCoreMemorySessionManager patch from session factory tests
The CodeQL commit removed the unused AgentCoreMemorySessionManager import
from session_factory.py, breaking two tests that patched it at that path.
Removed the unnecessary patch decorator since TurnBasedSessionManager was
already being patched separately.
* chore(docker): add shared embeddings module to rag-ingestion Lambda image
- Copy shared embeddings package to Lambda task root directory
- Add apis/__init__.py to ensure proper Python package structure
- Enable ingestion embeddings to access re-exported shared embeddings module
- Resolves import errors when bedrock_embeddings.py loads shared embeddings
* fix(quality): resolve all open CodeQL findings on develop
Empty excepts (5 fixes):
- url_fetcher: narrow bare except to Exception, add comment
- code_interpreter_diagram_tool: narrow bare except to Exception
- tool_result_processor: add explanatory comment to JSONDecodeError catch
- users/service: log warning on invalid pagination cursor
- event_formatter: log warning instead of silently swallowing errors
Catch BaseException (2 fixes):
- url_fetcher: narrowed to Exception (same fix as empty except)
- code_interpreter_diagram_tool: narrowed to Exception
Unreachable code (1 fix):
- stream_processor: remove dead if result_seen: break (never set to True)
Redundant assignment (1 fix):
- fine_tuning/routes: remove unused job = on create_inference_job
Print during import (1 fix):
- inference_api/main: replace print() with logging
Commented-out code (1 fix):
- inference_api/chat/models: remove commented InvocationRequest class
Unnecessary lambdas (2 fixes):
- job_repository, inference_repository: lambda v: int(v) → int
Unused local variables (13 fixes):
- Remove or rename: period, user_id, error_msg, matches, requested_set,
exception_type, updated, limit, preferences, execution_output,
next_month, next_year across 10 files
Unused imports (3 fixes):
- compaction_models: remove unused field import
- bedrock_embeddings: remove dead re-exports, clean up __init__.py
- timezone: use find_spec for pytz availability check
Cyclic import (1 fix):
- Move get_metadata_storage() factory from metadata_storage.py to
storage/__init__.py, breaking the metadata_storage ↔ dynamodb_storage
cycle. Update 3 callers to import from apis.app_api.storage.
Dismissed as false positives (11 alerts):
- 9x untrusted-checkout on nightly workflows (schedule/dispatch only)
- 1x non-iterable for-loop (Enum is iterable)
- 1x unused global _generic_validator_initialized (global stmt tracking)
* fix(deps): patch Dependabot security vulnerabilities
- requests 2.32.5 → 2.33.0 (insecure temp file reuse, CVE)
- picomatch 4.0.3 → 4.0.4 (frontend, ReDoS + method injection, via override)
- picomatch 2.3.1 → 2.3.2 (infrastructure, method injection, via override)
- diff 4.0.x → patched (infrastructure, DoS in parsePatch, via audit fix)
Unfixable:
- yaml 1.10.2 bundled inside aws-cdk-lib 2.244.0 (latest) — awaiting AWS CDK update
- Pygments 2.19.2 (latest) — no patched version released yet
* fix(rag-ingestion): ensure Lambda uses latest image digest on deploy
- Add FUNCTION_NAME variable to capture Lambda function identifier
- Update Lambda function code explicitly after image push to force digest refresh
- Add wait condition to ensure function update completes before deployment succeeds
- Remove outdated next steps logging that duplicated deployment completion message
- Resolve issue where CDK's SSM-resolved image tags don't trigger updates when underlying image layers change, causing CloudFormation to report no changes despite fresh image push
* fix share issues and icon tweaks
* release: v1.0.0-beta.20
* fix(rag-ingestion): restore shared embedding re-exports for Lambda handler
The CodeQL fix removed re-exports from bedrock_embeddings.py, but the
RAG ingestion Lambda handler imports generate_embeddings and
store_embeddings_in_s3 from embeddings.bedrock_embeddings (Lambda task
root path). Restored re-exports with __all__ and explanatory comments.
* feat(documents): add upload failure reporting and assistant cleanup
- Add ReportUploadFailureRequest model for client-side upload error reporting
- Implement POST /{document_id}/upload-failed endpoint to mark documents as failed
- Add update_document_status service function to update document status and error details
- Implement background cleanup of vectors and S3 objects when assistant is deleted
- Add delete_vectors_for_assistant function to remove embeddings from vector store
- Update document routes to import new models and service functions
- Add start.sh to .gitignore
- Update bedrock_embeddings to support vector deletion by assistant ID
- Enhance frontend document service to handle upload failure reporting
- Improve assistant deletion flow with proper resource cleanup and error handling
* feat(assistants): remove archive functionality and simplify deletion
- Remove archive_assistant service function and endpoint
- Simplify delete operation to single hard delete without archive option
- Remove include_archived query parameter from list assistants endpoint
- Remove ARCHIVED status from assistant status enum
- Update frontend assistant model and services to remove archive references
- Simplify assistant lifecycle by consolidating soft and hard delete into single delete operation
- Update API documentation and test examples to reflect deletion changes
* feat(frontend): upgrade Analog.js testing dependencies and remove vitest config
- Add @analogjs/vite-plugin-angular and @analogjs/vitest-angular v3.0.0-alpha.18
- Update package-lock.json with new dependency tree and transitive dependencies
- Remove vitest.config.ts in favor of Analog.js configuration
- Update app.config.spec.ts and tool-rail.component.spec.ts test files
- Modernize Angular testing setup with latest Analog.js tooling
* feat(documents): implement reliable deletion with soft-delete and cleanup retries
- Add deleting status to document lifecycle and TTL field for auto-expiry
- Create cleanup_service.py with retry logic for S3 vectors and source file deletion
- Implement soft-delete pattern: mark documents as deleting, return immediately, cleanup asynchronously
- Update search path to filter out non-complete documents and prevent stale results
- Add batch soft-delete for assistant deletion with background cleanup
- Implement deterministic vector key generation for reliable cleanup
- Add comprehensive property-based and integration tests for deletion flows
- Update RAG service to cross-check document status during search
- Configure DynamoDB TTL as backstop for failed cleanups (7-day expiry)
- Add Kiro spec documentation for reliable document deletion design
* test(assistants): remove archive assistant test and fix package dependencies
- Remove test_archive_assistant test case as archive functionality was removed
- Update package-lock.json to fix dependency flags for Angular DevKit and related packages
- Change chokidar dev flag to devOptional to reflect optional development dependency
- Remove unnecessary dev flags from multiple dependencies (ajv, chalk, cli-cursor, fast-deep-equal, and others)
- Align package metadata with current project configuration
* chore(frontend): pin Analog.js dependencies to exact versions
- Remove caret (^) version specifiers from @analogjs/vite-plugin-angular
- Remove caret (^) version specifiers from @analogjs/vitest-angular
- Lock both packages to 3.0.0-alpha.18 for consistent builds
- Prevent unexpected minor/patch updates that could introduce breaking changes
* chore(frontend): pin Analog.js devDependencies to exact versions
- Update @analogjs/vite-plugin-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Update @analogjs/vitest-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Remove caret (^) prefix to lock exact versions and ensure consistent builds
* feat(fine-tuning-dashboard): add informational section about fine-tuning and update icons
* chore(deps)(deps): bump the frontend-minor-patch group (#101)
Bumps the frontend-minor-patch group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@ng-icons/core](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [@ng-icons/heroicons](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.33` | `0.16.44` |
| [marked](https://github.com/markedjs/marked) | `17.0.3` | `17.0.5` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.3` | `11.13.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.1` | `4.2.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.1` | `4.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.2` |
Updates `@ng-icons/core` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `@ng-icons/heroicons` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `katex` from 0.16.33 to 0.16.44
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](https://github.com/KaTeX/KaTeX/compare/v0.16.33...v0.16.44)
Updates `marked` from 17.0.3 to 17.0.5
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](https://github.com/markedjs/marked/compare/v17.0.3...v17.0.5)
Updates `mermaid` from 11.12.3 to 11.13.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...mermaid@11.13.0)
Updates `@tailwindcss/postcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-postcss)
Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/coverage-v8)
Updates `postcss` from 8.5.6 to 8.5.8
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.8)
Updates `tailwindcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/tailwindcss)
Updates `vitest` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)
---
updated-dependencies:
- dependency-name: "@ng-icons/core"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@ng-icons/heroicons"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: katex
dependency-version: 0.16.44
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: marked
dependency-version: 17.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: mermaid
dependency-version: 11.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@tailwindcss/postcss"
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: postcss
dependency-version: 8.5.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: tailwindcss
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: vitest
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
...
* chore(deps)(deps): bump the aws-cdk group (#90)
Bumps the aws-cdk group in /infrastructure with 2 updates: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).
Updates `aws-cdk-lib` from 2.244.0 to 2.245.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.245.0/packages/aws-cdk-lib)
Updates `aws-cdk` from 2.1113.0 to 2.1115.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1115.0/packages/aws-cdk)
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.245.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: aws-cdk
- dependency-name: aws-cdk
dependency-version: 2.1115.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: aws-cdk
...
* chore(deps)(deps): bump actions/setup-node from 5.0.0 to 6.3.0 (#100)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5.0.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/a0853c24544627f65ddf259abe73b1d18a591444...53b83947a5a98c8d113130e565377fae1a50d02f)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-major
...
* chore(deps)(deps): bump github/codeql-action (#95)
Bumps the actions-minor-patch group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).
Updates `github/codeql-action` from 4.34.1 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
* chore(deps)(deps-dev): bump @types/node in /infrastructure (#94)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.10.1 to 25.5.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.5.0
dependency-type: direct:development
update-type: version-update:semver-major
...
* chore(deps)(deps-dev): bump jsdom in /frontend/ai.client (#102)
Bumps [jsdom](https://github.com/jsdom/jsdom) from 27.4.0 to 29.0.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](https://github.com/jsdom/jsdom/compare/v27.4.0...v29.0.1)
---
updated-dependencies:
- dependency-name: jsdom
dependency-version: 29.0.1
dependency-type: direct:development
update-type: version-update:semver-major
...
* chore(deps)(deps): bump ng2-charts in /frontend/ai.client (#105)
Bumps [ng2-charts](https://github.com/valor-software/ng2-charts) from 8.0.0 to 10.0.0.
- [Release notes](https://github.com/valor-software/ng2-charts/releases)
- [Commits](https://github.com/valor-software/ng2-charts/compare/v8.0.0...v10.0.0)
---
updated-dependencies:
- dependency-name: ng2-charts
dependency-version: 10.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
* chore(deps)(deps): bump the angular group (#97)
Bumps the angular group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@angular/cdk](https://github.com/angular/components) | `21.2.3` | `21.2.4` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.5` | `21.2.6` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.5` | `21.2.6` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.5` | `21.2.6` |
| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.5` | `21.2.6` |
| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.5` | `21.2.6` |
| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.5` | `21.2.6` |
| [@angular/build](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.5` | `21.2.6` |
Updates `@angular/cdk` from 21.2.3 to 21.2.4
- [Release notes](https://github.com/angular/components/releases)
- [Changelog](https://github.com/angular/components/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/components/compare/v21.2.3...v21.2.4)
Updates `@angular/common` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/common)
Updates `@angular/compiler` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler)
Updates `@angular/core` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/core)
Updates `@angular/forms` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/forms)
Updates `@angular/platform-browser` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/platform-browser)
Updates `@angular/router` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/router)
Updates `@angular/build` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/cli` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/compiler-cli` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler-cli)
---
updated-dependencies:
- dependency-name: "@angular/cdk"
dependency-version: 21.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/common"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/core"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/forms"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/platform-browser"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/router"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/build"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/cli"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler-cli"
dependency-version: 21.2.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
...
* chore(deps)(deps-dev): bump jest and @types/jest in /infrastructure (#92)
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) and [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest). These dependencies needed to be updated together.
Updates `jest` from 29.7.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)
Updates `@types/jest` from 29.5.14 to 30.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)
---
updated-dependencies:
- dependency-name: jest
dependency-version: 30.3.0
dependency-type: direct:development
update-type: version-update:semver-major
- dependency-name: "@types/jest"
dependency-version: 30.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
* add conversation deleting handling for shared conversations + bug fix
* chore(deps)(deps): bump constructs (#91)
Bumps the infra-minor-patch group in /infrastructure with 1 update: [constructs](https://github.com/aws/constructs).
Updates `constructs` from 10.5.1 to 10.6.0
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.5.1...v10.6.0)
---
updated-dependencies:
- dependency-name: constructs
dependency-version: 10.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: infra-minor-patch
...
* feat(messages): displayText support for RAG-augmented and file attachment messages (#107)
* feat(messages): add displayText support for RAG-augmented messages
- Add original_message parameter to stream_async and StreamCoordinator to preserve user input before RAG augmentation
- Store displayText in message metadata when original message differs from augmented version
- Add display_text field to MessageMetadata model with displayText alias for JSON serialization
- Update chat_stream route to pass original message when RAG augmentation is applied
- Enhance metadata retrieval to query both cost records (C#) and display text records (D#) from DynamoDB
- Add store_user_display_text function to persist original message text for clean UI display
- Update .gitignore to exclude local dev scripts (start.sh)
- Improves user experience by showing original unaugmented messages in conversation UI while maintaining RAG-enhanced context for agent processing
* feat(messages): add displayText support for file attachments and local runtime override
- Add LOCAL_RUNTIME_ENDPOINT_URL environment variable support for development runtime override in auth routes
- Extend displayText storage to handle file attachment content block modifications, not just RAG augmentation
- Add message_will_be_modified logic to determine when original message should be stored as displayText
- Implement showDebugOutput local settings signal for toggling debug information display
- Update user message component to display original text when displayText is available
- Add debug output toggle to chat preferences settings page
- Update session metadata documentation to clarify displayText usage for all prompt modifications
- Ensure original user message is preserved for UI display while augmented prompt remains in AgentCore Memory
* test(metadata): add displayText (D# record) tests for store and retrieval
* chore(deps): bump fast-check from 3.23.2 to 4.6.0
- Update fast-check to version 4.6.0 with caret constraint for minor/patch updates
- Update pure-rand dependency to 4.6.0's requirement of ^8.0.0 (from ^6.1.0)
- Increase minimum Node.js requirement from 8.0.0 to 12.17.0
- Migrate auth-pbt.spec.ts to use fast-check 4.x API (stringOf → string with unit parameter)
* chore(deps)(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#99)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
* chore(deps)(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (#98)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
* chore(deps)(deps): bump the python-minor-patch group in /backend with 10 updates (#96)
* chore(deps)(deps): bump the python-minor-patch group
Bumps the python-minor-patch group in /backend with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.35.0` | `0.42.0` |
| [boto3](https://github.com/boto/boto3) | `1.42.73` | `1.42.78` |
| [strands-agents](https://github.com/strands-agents/sdk-python) | `1.32.0` | `1.33.0` |
| [strands-agents-tools](https://github.com/strands-agents/tools) | `0.2.23` | `0.3.0` |
| [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.14.2` | `0.16.0` |
| [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.4.7` | `1.4.8` |
| [openai](https://github.com/openai/openai-python) | `2.29.0` | `2.30.0` |
| [google-genai](https://github.com/googleapis/python-genai) | `1.68.0` | `1.69.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.151.9` | `6.151.10` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.8` |
Updates `uvicorn` from 0.35.0 to 0.42.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.35.0...0.42.0)
Updates `boto3` from 1.42.73 to 1.42.78
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.42.73...1.42.78)
Updates `strands-agents` from 1.32.0 to 1.33.0
- [Release notes](https://github.com/strands-agents/sdk-python/releases)
- [Commits](https://github.com/strands-agents/sdk-python/compare/v1.32.0...v1.33.0)
Updates `strands-agents-tools` from 0.2.23 to 0.3.0
- [Release notes](https://github.com/strands-agents/tools/releases)
- [Commits](https://github.com/strands-agents/tools/compare/v0.2.23...v0.3.0)
Updates `aws-opentelemetry-distro` from 0.14.2 to 0.16.0
- [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases)
- [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-observability/aws-otel-python-instrumentation/compare/v0.14.2...v0.16.0)
Updates `bedrock-agentcore` from 1.4.7 to 1.4.8
- [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases)
- [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws/bedrock-agentcore-sdk-python/compare/v1.4.7...v1.4.8)
Updates `openai` from 2.29.0 to 2.30.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.29.0...v2.30.0)
Updates `google-genai` from 1.68.0 to 1.69.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googleapis/python-genai/compare/v1.68.0...v1.69.0)
Updates `hypothesis` from 6.151.9 to 6.151.10
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](https://github.com/HypothesisWorks/hypothesis/compare/hypothesis-python-6.151.9...hypothesis-python-6.151.10)
Updates `ruff` from 0.15.7 to 0.15.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.15.7...0.15.8)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: boto3
dependency-version: 1.42.78
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: strands-agents
dependency-version: 1.33.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: strands-agents-tools
dependency-version: 0.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: aws-opentelemetry-distro
dependency-version: 0.16.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: bedrock-agentcore
dependency-version: 1.4.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: openai
dependency-version: 2.30.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: google-genai
dependency-version: 1.69.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: hypothesis
dependency-version: 6.151.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: ruff
dependency-version: 0.15.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
...
* chore(deps): downgrade cachetools to 6.2.4
- Downgrade cachetools from 7.0.5 to 6.2.4 in backend dependencies
- Resolves compatibility issues with OAuth provider management
---------
* chore(deps): pin fast-check to exact version 4.6.0
- Remove caret (^) version constraint from fast-check dependency
- Update package.json to use exact version 4.6.0
- Update package-lock.json to reflect pinned version
- Ensure consistent dependency resolution across environments
* feat: add fine-tuning cost dashboard and user cost breakdown (#108)
* feat: add fine-tuning cost dashboard and user cost breakdown
- Introduced new models for cost dashboard and user cost breakdown in the admin API.
- Implemented endpoint to retrieve aggregated cost data for fine-tuning jobs.
- Enhanced fine-tuning access control to support default monthly quota hours for users without explicit grants.
- Added new routes and frontend components for displaying fine-tuning costs and usage statistics.
- Updated infrastructure configuration to include default quota hours for fine-tuning.
- Added tests to ensure proper functionality of new features and configurations.
* fix(logging): improve log message formatting for cost dashboard request
* fix(logging): sanitize period string in cost dashboard log message
* check in share conversations specs
* chore(docs): update versioning documentation and release notes for v1.0.0-beta.20
- Update versioning skill and rule documentation to include README.md version badge and "Current release" text in sync script scope
- Update Kiro steering guide to document README.md and lockfile updates in version sync process
- Bump version badge in README.md from v1.0.0-beta.19 to v1.0.0-beta.20
- Update "Current release" text in README.md to v1.0.0-beta.20
- Add comprehensive release notes for v1.0.0-beta.20 with highlights on document deletion, displayText system, fine-tuning cost dashboard, and dependency updates
- Ensure all AI assistant rule files reflect current versioning workflow
* ci(frontend): remove common scripts from workflow triggers and restrict CDK jobs to non-PR events
- Remove 'scripts/common/**' from push and pull_request trigger paths
- Add condition to synth-cdk job to skip execution on pull_request events
- Update test-cdk job condition to exclude pull_request events while preserving skip_tests logic
- Prevents unnecessary CDK synthesis and testing during pull requests to reduce workflow overhead
* Apply suggestions from code review
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh (#118)
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* Purge outdated AI specs and documentation (#121)
* spring cleaning. AI spec file and outdated documentation purge
* spring cleanup --> purging old ai specs and outdated docs
---------
* Feat/cognito first boot auth (#125)
* feat: replace multi-step auth bootstrap with Cognito first-boot experience
- Add Cognito User Pool, App Client, and Domain to CDK infrastructure
- Implement first-boot backend with race-condition-safe DynamoDB writes
- Add CognitoJWTValidator replacing GenericOIDCJWTValidator
- Add federated identity provider management via Cognito IdP APIs
- Migrate frontend to Cognito OAuth 2.0 + PKCE flow
- Add first-boot setup page with admin account creation
- Update AgentCore Runtime to single Cognito JWT authorizer
- Remove runtime-provisioner and runtime-updater Lambdas
- Remove hardcoded Entra ID configuration from CDK and scripts
- Remove auth provider seeding from bootstrap workflow
- Wire SSM parameters across stacks for Cognito config
- Update GitHub Actions workflows for Cognito context values
* FOR TESTING ONLY< REVERT BEFORE MERGING
* Feat/cognito first boot auth (#123)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDeleteUser permission for user deletion operations
- Add cognito-idp:AdminAddUserToGroup permission for group membership management
- Add cognito-idp:CreateGroup permission for group creation operations
- Enables system admin functionality for managing Cognito user pools and groups
* refactor(auth): replace user email with name in logging and events
- Replace user.email with user.name in quota event recorder metadata
- Update admin cost dashboard logging to use user.name instead of email
- Update admin users routes logging to use user.name instead of email
- Update file upload routes logging to use user.name instead of email
- Update model routes logging to use user.name instead of email
- Update tools routes logging to use user.name instead of email
- Update OAuth routes logging to use user.name instead of email
- Update user models and routes logging to use user.name instead of email
- Update auth service and user service in frontend to use name field
- Standardize user identification across backend and frontend to use name for privacy and consistency
* feat(frontend): update logos and URL-encode inference API ARN
- Update logo-dark.png and logo-light.png assets
- Add URL encoding for ARN portion in inferenceApiUrl computed signal
- Prevent URL parsing errors caused by colons and slashes in AgentCore runtime ARNs
- Improve config service documentation with encoding behavior explanation
* fix(frontend): add /invocations path to inference API endpoints
- Update preview-chat.service.ts to include /invocations path in runtime endpoint URL
- Update chat-http.service.ts to include /invocations path in runtime endpoint URL
- Fixes inference API calls by using correct endpoint path with qualifier parameter
* feat(inference-api): add Authorization header to ALB request configuration
- Add requestHeaderConfiguration to ALB listener rule
- Include Authorization header in requestHeaderAllowlist
- Enable proper header propagation for authenticated requests to inference API
* refactor(auth): consolidate RBAC to AppRole-based authorization
- Replace multiple role-checking functions with single require_app_roles dependency
- Remove require_roles, require_all_roles, has_any_role, has_all_roles, and role-specific decorators (require_faculty, require_staff, require_developer, require_aws_ai_access)
- Update rbac.py to resolve permissions through AppRoleService instead of hardcoded JWT groups
- Simplify auth module exports to only expose require_app_roles and require_admin
- Update admin routes to remove unused role imports
- Add comprehensive docstring explaining AppRole system as single source of truth for permissions
- Update tests to reflect new authorization flow via AppRoleService
* feat(inference-api): add SSM parameters and environment variables to AgentCore runtime
- Import DynamoDB table names from SSM parameters for users, RBAC, auth, OAuth, quota, cost tracking, and file uploads
- Import S3 bucket and vector index names for RAG functionality
- Import gateway URL and frontend CORS origins from SSM parameters
- Add comprehensive environment variables to AgentCore runtime configuration including DynamoDB table mappings, authentication settings, OAuth configuration, AgentCore resource IDs, and directory paths
- Enable authentication and quota enforcement in runtime environment
- Configure frontend URL and CORS origins for cross-origin requests
* feat(inference-api): remove gateway URL parameter and simplify CORS origins
- Remove SSM parameter import for gateway URL from InferenceApiStack
- Remove GATEWAY_URL environment variable from AgentCore runtime configuration
- Replace SSM-imported CORS origins with config-based construction to avoid circular dependency between InferenceApiStack and FrontendStack
- Construct CORS origins dynamically from config.domainName (https://{domain}) with localhost fallback for development
- Eliminates circular dependency: InferenceApiStack ↔ FrontendStack by removing reliance on FrontendStack SSM parameters
* chore(frontend): update favicon and logo assets
- Remove redundant favicon PNG variants (android-chrome, apple-touch-icon, favicon-16x16, favicon-32x32)
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Consolidate favicon assets to reduce redundancy and improve maintainability
* feat(inference-api): add AWS Marketplace permissions for Bedrock model access
- Add MarketplaceModelAccess policy statement to runtime execution role
- Grant aws-marketplace:ViewSubscriptions and aws-marketplace:Subscribe actions
- Enable foundation model access for marketplace-gated models like Anthropic Claude
- Required for subscription validation before Bedrock model invocation
* Release 1.0.0-beta.19: Conversation sharing, session compaction, fine-tuning enhancements, CI optimization
## Features
- Conversation sharing with public/email-restricted access via shareable URLs
- Session compaction enabled by default (100K token threshold, 3 protected turns)
- Fine-tuning: drag-and-drop dataset upload, custom HuggingFace model support
## Security
- Resolve all CodeQL clear-text logging alerts (secrets, tokens, ARNs redacted)
- OAuth redirect URL validation to prevent open redirects
- Explicit read-only permissions on all 13 GitHub Actions workflows
## Performance
- Frontend production build optimized: 8.85 MB → 4.96 MB (871 KB gzipped)
- PR workflows trimmed: skip Docker builds, CDK synth, and redundant jobs
## Infrastructure
- New shared-conversations DynamoDB table with SessionShare and OwnerShare GSIs
- Bedrock prompt caching temporarily disabled due to provider limitations
## Bug Fixes
- Google Fonts moved to index.html to fix CI build failure
- Private sharing support (owner-only shares)
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* refactor(inference-api): remove underscore prefix from containerImageUri variable
- Remove underscore prefix from containerImageUri variable name
- Improve code clarity by following standard naming conventions
- Variable is used throughout the stack and should follow public naming patterns
* chore(deps): add cognitoidp moto extra and update infrastructure tests
- Add cognitoidp extra to moto dependency in uv.lock for Cognito IDP mocking support
- Update moto dependency extras to include both cognitoidp and dynamodb
- Refactor IAM policy assertions in inference-api-stack tests to search both inline and managed policies
- Simplify policy verification logic to use findResources and filter by policy attributes
- Remove S3 bucket and S3 Vector Store test sections from app-api-stack tests
- Update test assertions to be more flexible with policy resource types
* chore(frontend): update favicon and logo assets
- Add Android Chrome favicon variants (192x192 and 512x512)
- Add Apple Touch Icon for iOS devices
- Add favicon sizes for 16x16 and 32x32 resolutions
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Update logo-light.png with refreshed branding
- Improve cross-platform icon support and visual consistency
* fix(auth-providers): remove OIDC discovery endpoint and add JSON parsing error handling
- Remove POST /discover endpoint for OIDC endpoint discovery from admin routes
- Add try-except blocks to handle JSON parsing errors in AuthProviderRepository
- Gracefully default to empty dict when SecretString is invalid or malformed
- Improve resilience when retrieving auth provider secrets from AWS Secrets Manager
---------
* Feat/cognito first boot auth (#124)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDeleteUser permission for user deletion oper…
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
Signed-off-by: Phil Merrell <philmerrell@boisestate.edu>
Signed-off-by: ofilson <SuperScorer911@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
Co-authored-by: derrickfink <derrickfink@boisestate.edu>
Co-authored-by: Phil Merrell <philmerrell@boisestate.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: ofilson <SuperScorer911@gmail.com>
Co-authored-by: Oscar Filson <OSCARFILSON@boisestate.edu>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Derrick Fink <DerrickF@users.noreply.github.com>
Co-authored-by: Colin <colin@colin-os>
…ve caps - Add MAX_SHEETS_TO_CONVERT and MAX_ROWS_PER_SHEET environment-configurable limits to prevent latency blowout from pathological XLSX files (thousands of sheets packed into few MB) - Implement _sanitize_sheet_name() to generate filesystem-safe, deterministic filenames from sheet names for model predictability - Implement _parse_sheet_inventory() to extract and structure sheet metadata from bootstrap stdout without evaluating untrusted literals - Implement _safe_int() utility for defensive integer parsing from bootstrap output - Implement _format_sheet_note() to generate markdown footer documenting sheet conversion status, truncation warnings, and per-sheet CSV paths - Update analyze_tool docstring to document single-sheet fast-path (stem.csv) and multi-sheet per-sheet naming (stem.sheetname.csv) with primary alias for first sheet - Surface skipped/truncated sheets to model with actionable warnings so users learn about caps rather than getting silently wrong results
The deploy workflows (backend.yml, platform.yml, frontend-deploy.yml) only run on push to develop/main and run their test jobs as a pre-deploy gate, so unit tests never executed on the PR itself. PRs into develop ran only skip-auth-guard. Adds .github/workflows/ci.yml triggered on pull_request -> [develop, main] with three parallel test jobs reusing the existing commands: - test-backend: uv sync + uv run pytest tests/ - test-frontend: npm ci + npm run test:ci (vitest) - test-infra: npm ci + npx jest No build/deploy/AWS steps — deploys stay push-only. Actions are SHA-pinned with the shared checkout SHA, runners pinned to ubuntu-24.04, and cancel-in-progress: true (safe; no CDK deploy). Conforms to all tests/supply_chain checks (31 passed).
…across edge origins (#491) Collapse the three-separate-cert first-deploy footgun into one shared wildcard, and make cert handling consistent and fail-loud across all CloudFront origins. - config.ts: add CDK_CLOUDFRONT_CERTIFICATE_ARN (top-level cloudfrontCertificateArn). frontend/artifacts/mcpSandbox certs fall back to it when their section-specific ARN is unset; section-specific wins. ALB cert stays separate (region-specific). One us-east-1 wildcard ({domain}+*.{domain}) now satisfies all three origins. - artifacts-distribution-construct: add domain-set-but-cert-missing guard mirroring mcp-sandbox (replaces the false 'config.ts already enforced' comment + opaque fromCertificateArn(undefined) crash), and add a domain-less fallback to the CloudFront default domain so domain-less synth no longer crashes with 'reading startsWith'. - load-env.sh: forward cloudfrontCertificateArn + mcpSandbox.certificateArn context params (were missing, breaking the cdk.context.json path). - workflows: wire CDK_CLOUDFRONT_CERTIFICATE_ARN job-level env in platform / nightly / teardown. - docs: step-02/step-03/ACTIONS-REFERENCE recommend the single shared cert and reframe per-origin vars as optional overrides; troubleshooting entry for the synth cert-guard failure. - tests: CloudFront cert resolution (config), artifacts cert guard + domain-less fallback, and end-to-end shared-cert PlatformStack synth. Full infra suite: 20 suites / 406 tests green.
* fix(infra): bump aws-cdk CLI 2.1120.0 -> 2.1128.0 to match aws-cdk-lib 2.260.0 aws-cdk-lib 2.260.0 emits cloud-assembly schema 54.0.0, but the pinned aws-cdk CLI (2.1120.0) only reads up to schema 53 — so synth/deploy failed with 'CDK CLI is not compatible with the CDK library ... Maximum schema version supported is 53.x.x, but found 54.0.0. You need at least CLI version 2.1128.0'. The library was bumped without bumping the CLI. Scripts invoke 'npx cdk', which resolves the local aws-cdk devDependency on the CI runner, so bumping the pin + regenerating the lockfile is the fix. Also bump the devcontainer global CDK pin (Dockerfile) and the version tables (README, dev-environment steering) that are documented to track package.json, so the interactive 'cdk' in the container doesn't drift and reproduce the same error locally. Verified in the devcontainer: npx cdk --version -> 2.1128.0; a synth of an aws-cdk-lib 2.260.0 assembly (manifest schema 54.0.0) is read by the 2.1128.0 CLI with exit 0; full infra suite 20 suites / 406 tests green. * ci(platform): pin Node 22 in the PlatformStack deploy jobs The deploy jobs in platform.yml and nightly-deploy-pipeline.yml were the only jobs without actions/setup-node — they ran scripts/platform/deploy.sh (which does npm ci + cdk via deploy.sh -> scripts/cdk/install.sh) on the runner's ambient Node instead of the Node 22 every other job and the devcontainer pin. Add setup-node (node 22 + npm cache) so the deploy toolchain is pinned and reproducible. Note: deps were already being installed (deploy.sh calls install.sh -> npm ci); the recent schema-mismatch failure was the stale aws-cdk pin (2.1120.0), fixed in 4339f26 by bumping to 2.1128.0. This change is the toolchain-pinning gap the #396 refactor left in the deploy jobs.
* fix(infra): auto-generate IAM role names to avoid first-deploy collisions Drop explicit roleName from the AgentCore memory/code-interpreter/browser/ gateway/runtime execution roles and the SageMaker execution role. Fixed physical names collide with orphaned roles left by a rolled-back/partial deploy. Every consumer references these roles by .roleArn (or resolves them at runtime via GetGateway / SAGEMAKER_EXECUTION_ROLE_ARN), so auto-generated names are safe. * chore(infra): replace deprecated pointInTimeRecovery with pointInTimeRecoverySpecification Silences the aws_dynamodb.TableOptions#pointInTimeRecovery deprecation warnings across all DynamoDB table constructs. Synthesized CloudFormation output is unchanged (still PointInTimeRecoveryEnabled: true). * fix(deploy): re-seed image-tag SSM param when the referenced ECR image is missing The seed guard skipped any URI-shaped value, trusting the build pipeline. But image-tag params are not CFN-managed and survive teardown, so a stale project-repo URI could outlive its ECR repo and break the AgentCore Runtime / ECS task def with 'repository does not exist'. Verify the image actually exists (ecr describe-images) before skipping; otherwise overwrite with the bootstrap URI. * fix(infra): grant Cognito group + delete actions for first-boot admin setup Add cognito-idp:CreateGroup and AdminAddUserToGroup (the first-boot flow creates the system_admin group and adds the initial admin) plus AdminDeleteUser (so the rollback path doesn't orphan a Cognito user and block retry with UsernameExistsException) to the app-api task role.
…es (#495) Reverts the roleName removal from 7107cf9 for the AgentCore memory/ code-interpreter/browser/gateway/runtime and SageMaker execution roles. Auto-generating these names is unsafe on an already-deployed stack: the role ARN feeds create-only properties on the AgentCore resources (BrowserCustom/CodeInterpreterCustom executionRoleArn, Memory memoryExecutionRoleArn, Gateway/Runtime roleArn). Renaming the role replaces it (new ARN) -> forces replacement of the dependent AgentCore resource -> CFN re-creates it with the same create-only Name -> 'already exists' collision -> UPDATE_ROLLBACK. Confirmed via ai-sbmt-api-PlatformStack events (BrowserCustom/CodeInterpreterCustom DELETE_COMPLETE with empty PhysicalResourceId during rollback). Orphaned fixed-name roles on a *fresh* deploy are handled by deleting the orphans before deploying, not by renaming. Added comments on each role to prevent re-introducing the auto-name change.
The RAG ingestion Lambda and AgentCore Runtime are arm64, but the post-refactor backend.yml ran their build jobs on amd64 (ubuntu-24.04). inference-api compensated with QEMU emulation (platform: linux/arm64); rag-ingestion had neither the platform input nor a build-one.sh PLATFORM, so it produced an amd64 image -> the arm64 Lambda failed every invoke with Runtime.InvalidEntrypoint (file uploads stuck 'uploading', no embeddings). Restore the pre-refactor (main) approach: build both arm images on native ubuntu-24.04-arm runners instead of emulating on amd64. - backend.yml: build-inference-api and build-rag-ingestion -> runs-on ubuntu-24.04-arm; drop the QEMU-triggering platform input from inference-api (native build needs no emulation). - build-one.sh: rag-ingestion PLATFORM=linux/arm64 (explicit native build). Deploy jobs stay on ubuntu-24.04 (API-only, no docker build). Note: the stale amd64 rag-ingestion ECR image must be deleted once so the content-hash build doesn't skip the corrected arm64 build.
… off) (#497) * feat(skills): gate skills feature behind SKILLS_ENABLED flag (default off) Defer the skills feature (user picker, admin catalog, skills mode) for a release without removing any merged code. A new apis/shared/feature_flags.py::skills_enabled() reads SKILLS_ENABLED (default false), mirroring the FINE_TUNING_ENABLED precedent. Deployed environments go dark automatically because the env var is absent; set SKILLS_ENABLED=true on both app-api and inference-api to re-enable. Gated surfaces (code and data left intact): - app-api main.py: user-facing skills router mounted only when enabled. - app-api admin/routes.py: admin skills + chat-mode-policy routers gated. - app-api system/routes.py: GET /system/chat-settings reports chat/no-toggle/ skillsEnabled:false when off (new skills_enabled field on the response). - inference-api chat/routes.py: force skill -> chat when off (voice/other agent types untouched). - SPA: ChatModeService.skillsEnabled drives admin nav hide; mode toggle and skills section auto-hide via allowModeToggle:false; SkillService eager load gated by an effect so a disabled env never fires the now-404 GET /skills/. Tests default off; skills-mode tests opt in via SKILLS_ENABLED=true and new off-behavior tests cover the forced-chat path and admin mount gating. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(model-settings): mock Skill/ChatMode services to stop teardown rejection model-settings.spec instantiated the real SkillService and ChatModeService, which fire /skills/ (now via an effect) and /system/chat-settings on construction. With no httpMock those requests fail asynchronously, and the SKILLS_ENABLED change shifted the timing so a console.error landed during worker teardown — surfacing as an unhandled EnvironmentTeardownError that failed the vitest run with exit 1 even though all 1218 tests passed. Provide minimal mocks for both services so the spec fires no stray async work. Full suite exits 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The admin "discover from server" button signs its request as the app-api task role (SigV4, service=lambda), but that role has no lambda:InvokeFunctionUrl — only inference-api does. Against an AuthType=AWS_IAM Lambda Function URL the signed request is rejected with 403, which surfaces during MCP client init as an anyio TaskGroup ExceptionGroup and falls through to a generic 502. For same-team MCP servers that validate a forwarded user JWT (Lambda URL AuthType=NONE), discovery should mirror the runtime forward_auth_token path and sign with the admin's own OIDC token instead of SigV4. Add a forward_auth_token flag to MCPDiscoverRequest; when set, the discover route forwards admin.raw_token as the bearer (400 if unavailable) and skips SigV4. Provider-gated OAuth (3LO) discovery is still rejected — the admin session can't supply an end-user provider token. Wire the flag through the admin tool form's discover call so the existing "Forward app authentication token" checkbox governs discovery too. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…or single-stack (#499) Reconcile the nightly pipeline and teardown scripts with the single PlatformStack, API-driven-deploy architecture. nightly-deploy-pipeline.yml: restore the workflow_call input contract the orchestrator still passes (ref, project-prefix, alb-subdomain, skip-teardown, label, source-project-prefix, run-e2e). Every job now checks out inputs.ref and deploys to the ephemeral inputs.project-prefix (never the shared environment). Add an always() teardown job (needs all deploy/test jobs, gated on skip-teardown) so every nightly stack is destroyed even on partial/failed deploys -- no paying for idle resources. Ephemeral env runs with no custom domain and an unset CDK_COGNITO_DOMAIN_PREFIX (defaults to the unique prefix). scripts/nightly/teardown.sh: delete <prefix>-PlatformStack via cloudformation delete-stack + wait (was a dead cdk-destroy loop over removed per-stack names). scripts/teardown/destroy.sh: add PlatformStack to the foundation phase while keeping legacy InfrastructureStack/app-stack handling, so the manual teardown works for both single-stack and legacy deployments.
…cret (#501) The admin auth-providers endpoints (POST/DELETE /admin/auth-providers) write the provider client-secret bag back to the auth-provider-secrets secret via PutSecretValue (apis/shared/auth_providers/repository.py), but the App API task role was only granted GetSecretValue. Configuring/removing an auth provider failed with AccessDeniedException on secretsmanager:PutSecretValue. Add a least-privilege PutSecretValue statement scoped to just the auth-provider-secrets secret (trailing wildcard matches the random ARN suffix). No other runtime-written secret needs this.
* fix(nightly): auto-teardown ephemeral nightly deploys; fix teardown for single-stack Reconcile the nightly pipeline and teardown scripts with the single PlatformStack, API-driven-deploy architecture. nightly-deploy-pipeline.yml: restore the workflow_call input contract the orchestrator still passes (ref, project-prefix, alb-subdomain, skip-teardown, label, source-project-prefix, run-e2e). Every job now checks out inputs.ref and deploys to the ephemeral inputs.project-prefix (never the shared environment). Add an always() teardown job (needs all deploy/test jobs, gated on skip-teardown) so every nightly stack is destroyed even on partial/failed deploys -- no paying for idle resources. Ephemeral env runs with no custom domain and an unset CDK_COGNITO_DOMAIN_PREFIX (defaults to the unique prefix). scripts/nightly/teardown.sh: delete <prefix>-PlatformStack via cloudformation delete-stack + wait (was a dead cdk-destroy loop over removed per-stack names). scripts/teardown/destroy.sh: add PlatformStack to the foundation phase while keeping legacy InfrastructureStack/app-stack handling, so the manual teardown works for both single-stack and legacy deployments. * fix(nightly): restore test-infra/backend/frontend gates in deploy pipeline The pipeline rewrite for ephemeral auto-teardown dropped the per-pipeline test gates, breaking infrastructure/test/repo-shape.test.ts which requires: - build-*/code-deploy-* jobs gate on test-backend - deploy-frontend gates on test-frontend - deploy-platform gates on test-infra Re-add the three test jobs (checking out inputs.ref) and the needs edges, keeping the input-driven ephemeral deploy + always() teardown intact. Also add the test jobs to teardown's needs so teardown waits for the whole graph. Verified: npx jest repo-shape passes (49/49); both nightly workflow YAMLs parse and all orchestrator calls pass only declared inputs.
…502) The McpSandboxDistributionConstruct doc comment claimed it publishes the proxy origin to SSM at `/{prefix}/mcp-sandbox/origin`. That was true of the pre-#396 standalone McpSandboxStack, but the single-stack consolidation dropped the SSM publication: the origin is now exposed as `proxyOrigin` and threaded through PlatformComputeRefs straight into inference-api's `AGENTCORE_MCP_APPS_SANDBOX_ORIGIN` env var. The stale comment misleads anyone debugging the sandbox (a missing SSM param looks like a broken deploy when it is expected). Update the comment to match the code. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Generated by the kaizen-research skill. Top 5 ideas appended to docs/kaizen/review-queue.md for the kaizen-review-prep run later this morning. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The ui/message bridge handler read `params.content` as a single block
({type,text}), but per SEP-1865 / the ext-apps SDK the View sends an ARRAY
of content blocks (content: [{type:'text',text}]). Every spec-compliant
widget message was therefore rejected with -32000 "Invalid ui/message
params" (e.g. an MCP App's app.sendMessage()).
Read `content` as an array and concatenate its text blocks (mirrors the
ui/update-model-context handler). Update MessageParams to the array shape,
fix the two bridge specs that sent single objects, and add a multi-block
concatenation regression test.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…rt (#504) A single TLS handshake blip (e.g. SSLV3_ALERT_HANDSHAKE_FAILURE from a TLS-inspecting middlebox) or connection reset when starting an external MCP client otherwise fails the whole agent build: Strands' start() raises MCPClientInitializationError, the tool fails to load, and agent creation errors out for the user. UICapableMCPClient.start() now retries transient transport failures — ConnectError/SSLError/timeouts, detected by walking the MCPClientInitializationError -> ExceptionGroup -> httpx.ConnectError chain — up to 3 attempts with exponential backoff. Non-transient errors (bad URL, auth, protocol) are re-raised on the first attempt. Strands resets its init future + background thread on failure (stop()), so re-invoking start() is safe. Covers both external and gateway clients. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…rdances (#505) A user turn initiated by an MCP App widget (ui/message → submitChatRequest) appeared in the conversation but skipped the two affordances the composer path triggers: the loading indicator (the page sets chatLoading before submitting) and the scroll-to-top of the new user message (chat-container's post-submit setTimeout). The widget delegate called the service directly, bypassing the chat-input → chat-container → page chain. - ChatStateService: add a `scrollToLastUserTick` signal + `requestScrollToLastUser()`. - ChatContainer: react to the tick by scrolling the last user message to the top (mirrors onMessageSubmitted; skips the initial 0 so it doesn't scroll on mount). - mcp-app-frame widget delegate: set chatLoading(true) and request the scroll around submitChatRequest (the user message is added synchronously inside it). The composer path is untouched (it keeps its own setTimeout scroll), so no existing behavior changes. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…tions to connected apps (#507) Extends the connector/adapter pattern that powers Google Drive document import (read) to the write direction, so a connector can also be a *destination* a user saves content to (e.g. saving a conversation transcript to Drive). This is PR-1 of the plan in docs/specs/conversation-export-connectors.md: data + capability scaffold only, no user-facing behavior yet. The connector auth layer (OAuthProvider + AgentCore Identity + consent UX) is direction-agnostic and reused unchanged; only the capability layer is new. Rather than bolting a write method onto the read-shaped FileSourceAdapter, this adds a parallel ExportTargetAdapter registry. - Add export_target_adapter_id to OAuthProvider (model, Dynamo serializers, repository apply_metadata_update) and the Create/Update/Response API models, mirroring file_source_adapter_id. A connector may now be both a file source and an export target. - New apis/app_api/export_targets/ package: ExportTargetAdapter contract, ExportTargetMetadata (with supported_formats), ExportFormat / ExportDestination / CreatedFile models, and an ExportTargetRegistry singleton (intentionally empty until the Google Drive export adapter lands in PR-2). - New admin GET /admin/export-target-adapters endpoint and _validate_export_target_adapter enforced on connector create/update. - Tests mirror the file-source adapter tests, using a stub adapter under a test-only key so it never collides with the future shipped adapter. Full backend suite green (3978 passed, 3 skipped). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…er (#508) PR-2 of the Save Conversations to Connected Apps feature (docs/specs/conversation-export-connectors.md). Builds the write-side capability on top of PR-1's scaffold: the first ExportTargetAdapter, the transcript renderer, and the connector resolve/token helpers. Still no user-facing endpoint — that lands in PR-3. - GoogleDriveExportAdapter (drive.file scope, least privilege): multipart /related upload to /upload/drive/v3/files. GOOGLE_DOC uploads an HTML body against the Google Doc MIME type (Drive converts to a native Doc); MARKDOWN uploads a plain .md file. When no destination folder is given, find-or-creates a single app folder ("AI Conversations", overridable via EXPORT_DRIVE_FOLDER_NAME) — which works under drive.file because the search only matches the app's own files. Now registered in the registry. - render.py: pure render_transcript(title, messages, fmt, include) -> RenderedDocument. Markdown is the intermediate representation; GOOGLE_DOC converts it to HTML via markdown-it-py (already a dependency), so Markdown structure maps to real Docs styling. Honors the ExportInclude checkboxes (tool calls / images / citations on; reasoning / timestamps off). Raw HTML in message text is escaped, not injected (CommonMark's default passthrough is forced off). - service.py: resolve_export_target / require_export_target_token / http_error_for_export_target_error, mirroring the file-source service (404 not-a-target, 403 RBAC, 409 not-connected, 503 no-workload). - ExportInclude model added; PR-1 admin tests updated now the registry ships the Drive adapter. PDF is deferred: no PDF renderer is in the dependency set, so the Drive adapter advertises only google_doc + markdown for now. Tests: render, Drive adapter (httpx.MockTransport), and service helpers. Full backend suite green (4012 passed, 3 skipped). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…508 follow-up) (#509) Add the PR-3 export endpoint for saving a conversation transcript out to a connected app (Google Drive being the first export target): - POST /sessions/{session_id}/export — ownership check, resolve connector to export-target adapter, validate the requested format against the adapter, mint the user's OAuth token (409 = consent needed, the SPA's retry hook), page the full transcript, render it, and create the document. Adapter failures map to 502/403/404. - GET /export-targets — catalog mirroring GET /file-sources, surfacing per connector `connected` and `supportedFormats` so the SPA dialog can build its connector + format pickers without extra backend work. Persist an export receipt on the session (spec R-2): - ExportReceipt model + export_receipts on SessionMetadata and SessionMetadataResponse so a "Saved · Open" affordance survives a reload. - add_export_receipt: race-free list_append/if_not_exists writer mirroring add_pending_interrupt; best-effort so a metadata write never fails an export that already succeeded. Tests: 16 route cases (catalog gating/connected/formats; export success + receipt; multi-page transcript ordering; 404/403/409/503/422/502 matrix). Full backend suite green. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…ing dropdown (PR-4) (#510) Frontend for the conversation-export feature: a "Save to…" action that pushes a conversation transcript out to a connected app (Google Drive first), plus the admin surface to map a connector as an export target. Save-to dialog (session/): - ExportService + ExportError client for GET /export-targets and POST /sessions/{id}/export (mirrors FileSourceService: OAuth2CallbackUrl header, suppressed error toast, HTTP-status-carrying error). - ExportDialogComponent (CDK dialog): destination picker, format choice gated by each connector's supportedFormats, include-checkbox group (messages locked on; tool calls / images / citations on; reasoning / timestamps off). A not-connected or 409-expired destination runs the shared OAuth consent popup and retries the save automatically; success shows "Open in <app>". - "Save to…" item wired into the session-list overflow menu beside Share. Admin mapping dropdown (admin/connectors/): - exportTargetAdapterId on the connector model + create/update requests, an Export-target adapter resource over GET /admin/export-target-adapters, and an "Export Target" dropdown on the connector form with the same provider-compatibility filter, scope-coverage warning, and tri-state save semantics as the file-source dropdown. Tests: export.service.spec (4) + export-dialog.component.spec (6) covering catalog load, auto-select, save success, include toggles, and the consent-then-retry path. Production build + affected specs green. Depends on the app-api export endpoints in #509 for the runtime save path; the admin dropdown works against the already-merged admin adapter endpoint. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…#511) Reuse the import file-source browse dialog as a destination folder picker so a conversation export can target a specific Drive folder instead of only the default app folder. Unblocked by the combined-scope Drive connector (D-4): `drive.readonly` lets the existing roots/browse endpoints power the picker, `drive.file` writes the file — `parentId` already flowed through the export endpoint and request. Backend - Add a `browsable` flag to the `GET /export-targets` catalog, computed from the connector's `file_source_adapter_id` + the file-source registry. Only a connector that is also a shipped file source can back the picker; export-only connectors hide it and keep landing in the app folder. Frontend - Generalize `file-source-browser-dialog` with a `mode: 'import' | 'pick-folder'`. In pick-folder mode it shows folders only, tracks the current folder name client-side, and closes with a `FolderSelection` ("Use this folder"). Import mode is unchanged. - Wire the picker into the export dialog: a "Folder" row (shown only for browsable targets) opens the picker and threads the chosen `parentId` into the save request; default stays the app folder. A successful pick reconciles the connected flag. Tests: backend export-route catalog (browsable true/false/unshipped); picker specs for both dialogs. Full AOT build + architecture import-boundary tests green. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
) Add a manageDnsRecords flag (CDK_MANAGE_DNS_RECORDS env / manageDnsRecords context, default true). When false, the stack still attaches the custom domain + ACM cert to the ALB, SPA, artifacts, and mcp-sandbox origins but skips the in-account HostedZone.fromLookup + record creation that would fail when the zone for domainName lives in another AWS account. In that mode each origin emits CfnOutputs with the record name and alias target so an operator can create the records by hand. - config.ts: add manageDnsRecords to AppConfig + loadConfig, log it - zones/alb-dns + spa/artifacts/mcp-sandbox distribution constructs: guard record creation, emit manual-DNS CfnOutputs when unmanaged - load-env.sh: export + validate CDK_MANAGE_DNS_RECORDS - workflows (platform, nightly): pass the flag through - cdk.context.json + test mock-config: add the field - docs: document external-R53 deployment Co-authored-by: Colin <colin@boisestate.edu>
* Release/v1.0.0 beta.25 (#282)
* Potential fix for pull request finding 'Unused local variable'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for pull request finding 'Unused local variable'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* docs(readme): update version badges and tech stack to v1.0.0-beta.18
- Update release badge from v1.0.0-beta.17 to v1.0.0-beta.18
- Bump Tailwind CSS version from v4.1 to v4.2 in all references
- Update current release version in release notes section
- Reflect latest dependency versions in architecture and tech stack documentation
* feat(embeddings): add optional token validation bypass for search queries
- Add skip_token_validation parameter to generate_embeddings function
- Allow skipping tiktoken-based token validation for short inputs where tiktoken may not be installed
- Update search_assistant_knowledgebase to skip validation for query embeddings
- Enables embedding generation in environments where tiktoken is unavailable (e.g., search Lambda)
* refactor(embeddings): extract shared embedding logic to separate module
- Move core embedding generation and vector store operations to apis.shared.embeddings
- Create new shared bedrock_embeddings module with generate_embeddings, store_embeddings_in_s3, search_assistant_knowledgebase, and delete_vectors_for_document
- Extract vector search logic to new apis.shared.assistants.vector_search module
- Keep ingestion-specific token validation (tiktoken-based) in app_api embeddings module
- Update ingestion embeddings module to re-export shared functions for backward compatibility
- Simplify bedrock_embeddings in ingestion pipeline to focus on chunk validation and splitting
- Update imports across documents routes and rag_service to use new shared modules
- Reduces code duplication and establishes clear separation between shared RAG infrastructure and ingestion-specific concerns
* docs(release-notes): document v1.0.0-beta.19 features and fixes
- Add Angular production build optimization section explaining minification and tree-shaking enablement
- Document embeddings refactor extracting shared logic to apis.shared.embeddings module
- Add skip_token_validation parameter documentation for generate_embeddings function
- Update highlights section to mention Angular production build optimization
- Clarify CodeQL workflow improvements and unused import/variable cleanup
- Enable optimization flag in angular.json production configuration for reduced bundle size
* docs(release-notes): remove Angular optimization section and revert config
- Remove "Frontend Production Build Optimization" section from release notes
- Revert optimization flag removal from angular.json production configuration
- Align documentation with actual production build configuration state
* feat: add API Keys section to README for programmatic access to AI models
* fix(model_config): comment out caching configuration due to Bedrock limitations
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* feat: refactor session compaction and enable by default (#86)
* feat: update compaction configuration and enhance session manager tests
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Signed-off-by: Phil Merrell <philmerrell@boisestate.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* test(to_bedrock_config): add missing result assignment in caching disabled test
* Potential fix for code scanning alert no. 41: Clear-text logging of s… (#85)
* Potential fix for code scanning alert no. 41: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* ci: Add explicit read-only permissions to all workflows
- Add `permissions: contents: read` to 13 GitHub Actions workflows
- Workflows updated: app-api, bootstrap-data-seeding, codeql, frontend, gateway, inference-api, infrastructure, nightly-deploy-pipeline, nightly, rag-ingestion, release, sagemaker-fine-tuning, version-check
- Implements principle of least privilege by explicitly declaring minimal required permissions
- Improves security posture and aligns with GitHub Actions best practices
* fix(security): Redact sensitive information from logs
- Mask client ID in seed_auth_provider output, showing only first 8 characters
- Redact full Secrets ARN in seed_auth_provider, displaying only resource name
- Replace full exception objects with error codes in seed_bootstrap_data error messages
- Downgrade MCP client configuration logging from info to debug level
- Remove user ID from OAuth token retrieval and re-auth status log messages
- Add URL validation to OAuth callback redirect to prevent open redirect vulnerabilities
- Prevents accidental exposure of credentials and sensitive identifiers in application logs
* fix(security): Resolve remaining CodeQL clear-text logging alerts
- seed_auth_provider: Fully redact Secrets Manager ARN from output
- external_mcp_client: Remove server URL from logs, decouple oauth_token from log expressions
- oauth_tool_service: Isolate decrypted token into _try_get_token() to prevent taint bleed, use lazy log formatting
- config.ts: Remove AWS account ID and CORS origins from CDK config log output
* Potential fix for code scanning alert no. 499: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 496: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 498: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 497: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
---------
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* feat(frontend): enable production optimization, branch-aware BUILD_CONFIG
- Remove optimization: false from base options (was blocking prod override)
- Production: optimization, no source maps, extract licenses
- Fix anyComponentStyle budget from 4kB to 200kB for Tailwind
- BUILD_CONFIG: main→production, develop→development, dispatch→manual input
Production build: 4.96 MB initial (871 KB gzip) vs 8.85 MB unoptimized
* fix: move Google Fonts import to index.html to prevent CI build failure
* ci: skip docker builds and CDK synth on pull requests
* implement conversation sharing. (#87)
* implement conversation sharing.
* Potential fix for code scanning alert no. 509: Log Injection
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: ofilson <SuperScorer911@gmail.com>
* Potential fix for code scanning alert no. 510: Log Injection
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: ofilson <SuperScorer911@gmail.com>
* fix github warnings
* fix log issue
---------
Signed-off-by: ofilson <SuperScorer911@gmail.com>
Co-authored-by: Oscar Filson <OSCARFILSON@boisestate.edu>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Allow for private share (only with yourself)
* release: v1.0.0-beta.19
* fix float error on sharing
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* ci: skip redundant stack dependency checks on PRs (keep infrastructure only)
* ci: skip install on PRs for rag-ingestion (no downstream jobs)
* ci: revert check-stack-deps skip on workflows with PR jobs, skip entire gateway/sagemaker on PRs
* fix(security): resolve CodeQL log-injection, unused-import, and unused-variable alerts
- Remove user-controlled values from 180 log f-strings (py/log-injection)
- Remove 87 unused Python imports (py/unused-import)
- Remove 27 unused JS/TS variables (js/unused-local-variable)
- Fix 3 useless assignments (js/useless-assignment-to-local)
- Fix 1 incompatible type comparison (js/comparison-between-incompatible-types)
* fix(tests): remove stale AgentCoreMemorySessionManager patch from session factory tests
The CodeQL commit removed the unused AgentCoreMemorySessionManager import
from session_factory.py, breaking two tests that patched it at that path.
Removed the unnecessary patch decorator since TurnBasedSessionManager was
already being patched separately.
* chore(docker): add shared embeddings module to rag-ingestion Lambda image
- Copy shared embeddings package to Lambda task root directory
- Add apis/__init__.py to ensure proper Python package structure
- Enable ingestion embeddings to access re-exported shared embeddings module
- Resolves import errors when bedrock_embeddings.py loads shared embeddings
* fix(quality): resolve all open CodeQL findings on develop
Empty excepts (5 fixes):
- url_fetcher: narrow bare except to Exception, add comment
- code_interpreter_diagram_tool: narrow bare except to Exception
- tool_result_processor: add explanatory comment to JSONDecodeError catch
- users/service: log warning on invalid pagination cursor
- event_formatter: log warning instead of silently swallowing errors
Catch BaseException (2 fixes):
- url_fetcher: narrowed to Exception (same fix as empty except)
- code_interpreter_diagram_tool: narrowed to Exception
Unreachable code (1 fix):
- stream_processor: remove dead if result_seen: break (never set to True)
Redundant assignment (1 fix):
- fine_tuning/routes: remove unused job = on create_inference_job
Print during import (1 fix):
- inference_api/main: replace print() with logging
Commented-out code (1 fix):
- inference_api/chat/models: remove commented InvocationRequest class
Unnecessary lambdas (2 fixes):
- job_repository, inference_repository: lambda v: int(v) → int
Unused local variables (13 fixes):
- Remove or rename: period, user_id, error_msg, matches, requested_set,
exception_type, updated, limit, preferences, execution_output,
next_month, next_year across 10 files
Unused imports (3 fixes):
- compaction_models: remove unused field import
- bedrock_embeddings: remove dead re-exports, clean up __init__.py
- timezone: use find_spec for pytz availability check
Cyclic import (1 fix):
- Move get_metadata_storage() factory from metadata_storage.py to
storage/__init__.py, breaking the metadata_storage ↔ dynamodb_storage
cycle. Update 3 callers to import from apis.app_api.storage.
Dismissed as false positives (11 alerts):
- 9x untrusted-checkout on nightly workflows (schedule/dispatch only)
- 1x non-iterable for-loop (Enum is iterable)
- 1x unused global _generic_validator_initialized (global stmt tracking)
* fix(deps): patch Dependabot security vulnerabilities
- requests 2.32.5 → 2.33.0 (insecure temp file reuse, CVE)
- picomatch 4.0.3 → 4.0.4 (frontend, ReDoS + method injection, via override)
- picomatch 2.3.1 → 2.3.2 (infrastructure, method injection, via override)
- diff 4.0.x → patched (infrastructure, DoS in parsePatch, via audit fix)
Unfixable:
- yaml 1.10.2 bundled inside aws-cdk-lib 2.244.0 (latest) — awaiting AWS CDK update
- Pygments 2.19.2 (latest) — no patched version released yet
* fix(rag-ingestion): ensure Lambda uses latest image digest on deploy
- Add FUNCTION_NAME variable to capture Lambda function identifier
- Update Lambda function code explicitly after image push to force digest refresh
- Add wait condition to ensure function update completes before deployment succeeds
- Remove outdated next steps logging that duplicated deployment completion message
- Resolve issue where CDK's SSM-resolved image tags don't trigger updates when underlying image layers change, causing CloudFormation to report no changes despite fresh image push
* fix share issues and icon tweaks
* release: v1.0.0-beta.20
* fix(rag-ingestion): restore shared embedding re-exports for Lambda handler
The CodeQL fix removed re-exports from bedrock_embeddings.py, but the
RAG ingestion Lambda handler imports generate_embeddings and
store_embeddings_in_s3 from embeddings.bedrock_embeddings (Lambda task
root path). Restored re-exports with __all__ and explanatory comments.
* feat(documents): add upload failure reporting and assistant cleanup
- Add ReportUploadFailureRequest model for client-side upload error reporting
- Implement POST /{document_id}/upload-failed endpoint to mark documents as failed
- Add update_document_status service function to update document status and error details
- Implement background cleanup of vectors and S3 objects when assistant is deleted
- Add delete_vectors_for_assistant function to remove embeddings from vector store
- Update document routes to import new models and service functions
- Add start.sh to .gitignore
- Update bedrock_embeddings to support vector deletion by assistant ID
- Enhance frontend document service to handle upload failure reporting
- Improve assistant deletion flow with proper resource cleanup and error handling
* feat(assistants): remove archive functionality and simplify deletion
- Remove archive_assistant service function and endpoint
- Simplify delete operation to single hard delete without archive option
- Remove include_archived query parameter from list assistants endpoint
- Remove ARCHIVED status from assistant status enum
- Update frontend assistant model and services to remove archive references
- Simplify assistant lifecycle by consolidating soft and hard delete into single delete operation
- Update API documentation and test examples to reflect deletion changes
* feat(frontend): upgrade Analog.js testing dependencies and remove vitest config
- Add @analogjs/vite-plugin-angular and @analogjs/vitest-angular v3.0.0-alpha.18
- Update package-lock.json with new dependency tree and transitive dependencies
- Remove vitest.config.ts in favor of Analog.js configuration
- Update app.config.spec.ts and tool-rail.component.spec.ts test files
- Modernize Angular testing setup with latest Analog.js tooling
* feat(documents): implement reliable deletion with soft-delete and cleanup retries
- Add deleting status to document lifecycle and TTL field for auto-expiry
- Create cleanup_service.py with retry logic for S3 vectors and source file deletion
- Implement soft-delete pattern: mark documents as deleting, return immediately, cleanup asynchronously
- Update search path to filter out non-complete documents and prevent stale results
- Add batch soft-delete for assistant deletion with background cleanup
- Implement deterministic vector key generation for reliable cleanup
- Add comprehensive property-based and integration tests for deletion flows
- Update RAG service to cross-check document status during search
- Configure DynamoDB TTL as backstop for failed cleanups (7-day expiry)
- Add Kiro spec documentation for reliable document deletion design
* test(assistants): remove archive assistant test and fix package dependencies
- Remove test_archive_assistant test case as archive functionality was removed
- Update package-lock.json to fix dependency flags for Angular DevKit and related packages
- Change chokidar dev flag to devOptional to reflect optional development dependency
- Remove unnecessary dev flags from multiple dependencies (ajv, chalk, cli-cursor, fast-deep-equal, and others)
- Align package metadata with current project configuration
* chore(frontend): pin Analog.js dependencies to exact versions
- Remove caret (^) version specifiers from @analogjs/vite-plugin-angular
- Remove caret (^) version specifiers from @analogjs/vitest-angular
- Lock both packages to 3.0.0-alpha.18 for consistent builds
- Prevent unexpected minor/patch updates that could introduce breaking changes
* chore(frontend): pin Analog.js devDependencies to exact versions
- Update @analogjs/vite-plugin-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Update @analogjs/vitest-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Remove caret (^) prefix to lock exact versions and ensure consistent builds
* feat(fine-tuning-dashboard): add informational section about fine-tuning and update icons
* chore(deps)(deps): bump the frontend-minor-patch group (#101)
Bumps the frontend-minor-patch group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@ng-icons/core](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [@ng-icons/heroicons](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.33` | `0.16.44` |
| [marked](https://github.com/markedjs/marked) | `17.0.3` | `17.0.5` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.3` | `11.13.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.1` | `4.2.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.1` | `4.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.2` |
Updates `@ng-icons/core` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `@ng-icons/heroicons` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `katex` from 0.16.33 to 0.16.44
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](https://github.com/KaTeX/KaTeX/compare/v0.16.33...v0.16.44)
Updates `marked` from 17.0.3 to 17.0.5
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](https://github.com/markedjs/marked/compare/v17.0.3...v17.0.5)
Updates `mermaid` from 11.12.3 to 11.13.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...mermaid@11.13.0)
Updates `@tailwindcss/postcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-postcss)
Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/coverage-v8)
Updates `postcss` from 8.5.6 to 8.5.8
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.8)
Updates `tailwindcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/tailwindcss)
Updates `vitest` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)
---
updated-dependencies:
- dependency-name: "@ng-icons/core"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@ng-icons/heroicons"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: katex
dependency-version: 0.16.44
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: marked
dependency-version: 17.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: mermaid
dependency-version: 11.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@tailwindcss/postcss"
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: postcss
dependency-version: 8.5.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: tailwindcss
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: vitest
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the aws-cdk group (#90)
Bumps the aws-cdk group in /infrastructure with 2 updates: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).
Updates `aws-cdk-lib` from 2.244.0 to 2.245.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.245.0/packages/aws-cdk-lib)
Updates `aws-cdk` from 2.1113.0 to 2.1115.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1115.0/packages/aws-cdk)
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.245.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: aws-cdk
- dependency-name: aws-cdk
dependency-version: 2.1115.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: aws-cdk
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump actions/setup-node from 5.0.0 to 6.3.0 (#100)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5.0.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/a0853c24544627f65ddf259abe73b1d18a591444...53b83947a5a98c8d113130e565377fae1a50d02f)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump github/codeql-action (#95)
Bumps the actions-minor-patch group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).
Updates `github/codeql-action` from 4.34.1 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump @types/node in /infrastructure (#94)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.10.1 to 25.5.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.5.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump jsdom in /frontend/ai.client (#102)
Bumps [jsdom](https://github.com/jsdom/jsdom) from 27.4.0 to 29.0.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](https://github.com/jsdom/jsdom/compare/v27.4.0...v29.0.1)
---
updated-dependencies:
- dependency-name: jsdom
dependency-version: 29.0.1
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump ng2-charts in /frontend/ai.client (#105)
Bumps [ng2-charts](https://github.com/valor-software/ng2-charts) from 8.0.0 to 10.0.0.
- [Release notes](https://github.com/valor-software/ng2-charts/releases)
- [Commits](https://github.com/valor-software/ng2-charts/compare/v8.0.0...v10.0.0)
---
updated-dependencies:
- dependency-name: ng2-charts
dependency-version: 10.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the angular group (#97)
Bumps the angular group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@angular/cdk](https://github.com/angular/components) | `21.2.3` | `21.2.4` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.5` | `21.2.6` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.5` | `21.2.6` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.5` | `21.2.6` |
| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.5` | `21.2.6` |
| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.5` | `21.2.6` |
| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.5` | `21.2.6` |
| [@angular/build](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.5` | `21.2.6` |
Updates `@angular/cdk` from 21.2.3 to 21.2.4
- [Release notes](https://github.com/angular/components/releases)
- [Changelog](https://github.com/angular/components/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/components/compare/v21.2.3...v21.2.4)
Updates `@angular/common` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/common)
Updates `@angular/compiler` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler)
Updates `@angular/core` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/core)
Updates `@angular/forms` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/forms)
Updates `@angular/platform-browser` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/platform-browser)
Updates `@angular/router` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/router)
Updates `@angular/build` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/cli` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/compiler-cli` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler-cli)
---
updated-dependencies:
- dependency-name: "@angular/cdk"
dependency-version: 21.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/common"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/core"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/forms"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/platform-browser"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/router"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/build"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/cli"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler-cli"
dependency-version: 21.2.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump jest and @types/jest in /infrastructure (#92)
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) and [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest). These dependencies needed to be updated together.
Updates `jest` from 29.7.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)
Updates `@types/jest` from 29.5.14 to 30.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)
---
updated-dependencies:
- dependency-name: jest
dependency-version: 30.3.0
dependency-type: direct:development
update-type: version-update:semver-major
- dependency-name: "@types/jest"
dependency-version: 30.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* add conversation deleting handling for shared conversations + bug fix
* chore(deps)(deps): bump constructs (#91)
Bumps the infra-minor-patch group in /infrastructure with 1 update: [constructs](https://github.com/aws/constructs).
Updates `constructs` from 10.5.1 to 10.6.0
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.5.1...v10.6.0)
---
updated-dependencies:
- dependency-name: constructs
dependency-version: 10.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: infra-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(messages): displayText support for RAG-augmented and file attachment messages (#107)
* feat(messages): add displayText support for RAG-augmented messages
- Add original_message parameter to stream_async and StreamCoordinator to preserve user input before RAG augmentation
- Store displayText in message metadata when original message differs from augmented version
- Add display_text field to MessageMetadata model with displayText alias for JSON serialization
- Update chat_stream route to pass original message when RAG augmentation is applied
- Enhance metadata retrieval to query both cost records (C#) and display text records (D#) from DynamoDB
- Add store_user_display_text function to persist original message text for clean UI display
- Update .gitignore to exclude local dev scripts (start.sh)
- Improves user experience by showing original unaugmented messages in conversation UI while maintaining RAG-enhanced context for agent processing
* feat(messages): add displayText support for file attachments and local runtime override
- Add LOCAL_RUNTIME_ENDPOINT_URL environment variable support for development runtime override in auth routes
- Extend displayText storage to handle file attachment content block modifications, not just RAG augmentation
- Add message_will_be_modified logic to determine when original message should be stored as displayText
- Implement showDebugOutput local settings signal for toggling debug information display
- Update user message component to display original text when displayText is available
- Add debug output toggle to chat preferences settings page
- Update session metadata documentation to clarify displayText usage for all prompt modifications
- Ensure original user message is preserved for UI display while augmented prompt remains in AgentCore Memory
* test(metadata): add displayText (D# record) tests for store and retrieval
* chore(deps): bump fast-check from 3.23.2 to 4.6.0
- Update fast-check to version 4.6.0 with caret constraint for minor/patch updates
- Update pure-rand dependency to 4.6.0's requirement of ^8.0.0 (from ^6.1.0)
- Increase minimum Node.js requirement from 8.0.0 to 12.17.0
- Migrate auth-pbt.spec.ts to use fast-check 4.x API (stringOf → string with unit parameter)
* chore(deps)(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#99)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (#98)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the python-minor-patch group in /backend with 10 updates (#96)
* chore(deps)(deps): bump the python-minor-patch group
Bumps the python-minor-patch group in /backend with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.35.0` | `0.42.0` |
| [boto3](https://github.com/boto/boto3) | `1.42.73` | `1.42.78` |
| [strands-agents](https://github.com/strands-agents/sdk-python) | `1.32.0` | `1.33.0` |
| [strands-agents-tools](https://github.com/strands-agents/tools) | `0.2.23` | `0.3.0` |
| [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.14.2` | `0.16.0` |
| [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.4.7` | `1.4.8` |
| [openai](https://github.com/openai/openai-python) | `2.29.0` | `2.30.0` |
| [google-genai](https://github.com/googleapis/python-genai) | `1.68.0` | `1.69.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.151.9` | `6.151.10` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.8` |
Updates `uvicorn` from 0.35.0 to 0.42.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.35.0...0.42.0)
Updates `boto3` from 1.42.73 to 1.42.78
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.42.73...1.42.78)
Updates `strands-agents` from 1.32.0 to 1.33.0
- [Release notes](https://github.com/strands-agents/sdk-python/releases)
- [Commits](https://github.com/strands-agents/sdk-python/compare/v1.32.0...v1.33.0)
Updates `strands-agents-tools` from 0.2.23 to 0.3.0
- [Release notes](https://github.com/strands-agents/tools/releases)
- [Commits](https://github.com/strands-agents/tools/compare/v0.2.23...v0.3.0)
Updates `aws-opentelemetry-distro` from 0.14.2 to 0.16.0
- [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases)
- [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-observability/aws-otel-python-instrumentation/compare/v0.14.2...v0.16.0)
Updates `bedrock-agentcore` from 1.4.7 to 1.4.8
- [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases)
- [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws/bedrock-agentcore-sdk-python/compare/v1.4.7...v1.4.8)
Updates `openai` from 2.29.0 to 2.30.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.29.0...v2.30.0)
Updates `google-genai` from 1.68.0 to 1.69.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googleapis/python-genai/compare/v1.68.0...v1.69.0)
Updates `hypothesis` from 6.151.9 to 6.151.10
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](https://github.com/HypothesisWorks/hypothesis/compare/hypothesis-python-6.151.9...hypothesis-python-6.151.10)
Updates `ruff` from 0.15.7 to 0.15.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.15.7...0.15.8)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: boto3
dependency-version: 1.42.78
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: strands-agents
dependency-version: 1.33.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: strands-agents-tools
dependency-version: 0.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: aws-opentelemetry-distro
dependency-version: 0.16.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: bedrock-agentcore
dependency-version: 1.4.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: openai
dependency-version: 2.30.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: google-genai
dependency-version: 1.69.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: hypothesis
dependency-version: 6.151.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: ruff
dependency-version: 0.15.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): downgrade cachetools to 6.2.4
- Downgrade cachetools from 7.0.5 to 6.2.4 in backend dependencies
- Resolves compatibility issues with OAuth provider management
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* chore(deps): pin fast-check to exact version 4.6.0
- Remove caret (^) version constraint from fast-check dependency
- Update package.json to use exact version 4.6.0
- Update package-lock.json to reflect pinned version
- Ensure consistent dependency resolution across environments
* feat: add fine-tuning cost dashboard and user cost breakdown (#108)
* feat: add fine-tuning cost dashboard and user cost breakdown
- Introduced new models for cost dashboard and user cost breakdown in the admin API.
- Implemented endpoint to retrieve aggregated cost data for fine-tuning jobs.
- Enhanced fine-tuning access control to support default monthly quota hours for users without explicit grants.
- Added new routes and frontend components for displaying fine-tuning costs and usage statistics.
- Updated infrastructure configuration to include default quota hours for fine-tuning.
- Added tests to ensure proper functionality of new features and configurations.
* fix(logging): improve log message formatting for cost dashboard request
* fix(logging): sanitize period string in cost dashboard log message
* check in share conversations specs
* chore(docs): update versioning documentation and release notes for v1.0.0-beta.20
- Update versioning skill and rule documentation to include README.md version badge and "Current release" text in sync script scope
- Update Kiro steering guide to document README.md and lockfile updates in version sync process
- Bump version badge in README.md from v1.0.0-beta.19 to v1.0.0-beta.20
- Update "Current release" text in README.md to v1.0.0-beta.20
- Add comprehensive release notes for v1.0.0-beta.20 with highlights on document deletion, displayText system, fine-tuning cost dashboard, and dependency updates
- Ensure all AI assistant rule files reflect current versioning workflow
* ci(frontend): remove common scripts from workflow triggers and restrict CDK jobs to non-PR events
- Remove 'scripts/common/**' from push and pull_request trigger paths
- Add condition to synth-cdk job to skip execution on pull_request events
- Update test-cdk job condition to exclude pull_request events while preserving skip_tests logic
- Prevents unnecessary CDK synthesis and testing during pull requests to reduce workflow overhead
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh (#118)
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* Purge outdated AI specs and documentation (#121)
* spring cleaning. AI spec file and outdated documentation purge
* spring cleanup --> purging old ai specs and outdated docs
---------
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* Feat/cognito first boot auth (#125)
* feat: replace multi-step auth bootstrap with Cognito first-boot experience
- Add Cognito User Pool, App Client, and Domain to CDK infrastructure
- Implement first-boot backend with race-condition-safe DynamoDB writes
- Add CognitoJWTValidator replacing GenericOIDCJWTValidator
- Add federated identity provider management via Cognito IdP APIs
- Migrate frontend to Cognito OAuth 2.0 + PKCE flow
- Add first-boot setup page with admin account creation
- Update AgentCore Runtime to single Cognito JWT authorizer
- Remove runtime-provisioner and runtime-updater Lambdas
- Remove hardcoded Entra ID configuration from CDK and scripts
- Remove auth provider seeding from bootstrap workflow
- Wire SSM parameters across stacks for Cognito config
- Update GitHub Actions workflows for Cognito context values
* FOR TESTING ONLY< REVERT BEFORE MERGING
* Feat/cognito first boot auth (#123)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDeleteUser permission for user deletion operations
- Add cognito-idp:AdminAddUserToGroup permission for group membership management
- Add cognito-idp:CreateGroup permission for group creation operations
- Enables system admin functionality for managing Cognito user pools and groups
* refactor(auth): replace user email with name in logging and events
- Replace user.email with user.name in quota event recorder metadata
- Update admin cost dashboard logging to use user.name instead of email
- Update admin users routes logging to use user.name instead of email
- Update file upload routes logging to use user.name instead of email
- Update model routes logging to use user.name instead of email
- Update tools routes logging to use user.name instead of email
- Update OAuth routes logging to use user.name instead of email
- Update user models and routes logging to use user.name instead of email
- Update auth service and user service in frontend to use name field
- Standardize user identification across backend and frontend to use name for privacy and consistency
* feat(frontend): update logos and URL-encode inference API ARN
- Update logo-dark.png and logo-light.png assets
- Add URL encoding for ARN portion in inferenceApiUrl computed signal
- Prevent URL parsing errors caused by colons and slashes in AgentCore runtime ARNs
- Improve config service documentation with encoding behavior explanation
* fix(frontend): add /invocations path to inference API endpoints
- Update preview-chat.service.ts to include /invocations path in runtime endpoint URL
- Update chat-http.service.ts to include /invocations path in runtime endpoint URL
- Fixes inference API calls by using correct endpoint path with qualifier parameter
* feat(inference-api): add Authorization header to ALB request configuration
- Add requestHeaderConfiguration to ALB listener rule
- Include Authorization header in requestHeaderAllowlist
- Enable proper header propagation for authenticated requests to inference API
* refactor(auth): consolidate RBAC to AppRole-based authorization
- Replace multiple role-checking functions with single require_app_roles dependency
- Remove require_roles, require_all_roles, has_any_role, has_all_roles, and role-specific decorators (require_faculty, require_staff, require_developer, require_aws_ai_access)
- Update rbac.py to resolve permissions through AppRoleService instead of hardcoded JWT groups
- Simplify auth module exports to only expose require_app_roles and require_admin
- Update admin routes to remove unused role imports
- Add comprehensive docstring explaining AppRole system as single source of truth for permissions
- Update tests to reflect new authorization flow via AppRoleService
* feat(inference-api): add SSM parameters and environment variables to AgentCore runtime
- Import DynamoDB table names from SSM parameters for users, RBAC, auth, OAuth, quota, cost tracking, and file uploads
- Import S3 bucket and vector index names for RAG functionality
- Import gateway URL and frontend CORS origins from SSM parameters
- Add comprehensive environment variables to AgentCore runtime configuration including DynamoDB table mappings, authentication settings, OAuth configuration, AgentCore resource IDs, and directory paths
- Enable authentication and quota enforcement in runtime environment
- Configure frontend URL and CORS origins for cross-origin requests
* feat(inference-api): remove gateway URL parameter and simplify CORS origins
- Remove SSM parameter import for gateway URL from InferenceApiStack
- Remove GATEWAY_URL environment variable from AgentCore runtime configuration
- Replace SSM-imported CORS origins with config-based construction to avoid circular dependency between InferenceApiStack and FrontendStack
- Construct CORS origins dynamically from config.domainName (https://{domain}) with localhost fallback for development
- Eliminates circular dependency: InferenceApiStack ↔ FrontendStack by removing reliance on FrontendStack SSM parameters
* chore(frontend): update favicon and logo assets
- Remove redundant favicon PNG variants (android-chrome, apple-touch-icon, favicon-16x16, favicon-32x32)
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Consolidate favicon assets to reduce redundancy and improve maintainability
* feat(inference-api): add AWS Marketplace permissions for Bedrock model access
- Add MarketplaceModelAccess policy statement to runtime execution role
- Grant aws-marketplace:ViewSubscriptions and aws-marketplace:Subscribe actions
- Enable foundation model access for marketplace-gated models like Anthropic Claude
- Required for subscription validation before Bedrock model invocation
* Release 1.0.0-beta.19: Conversation sharing, session compaction, fine-tuning enhancements, CI optimization
## Features
- Conversation sharing with public/email-restricted access via shareable URLs
- Session compaction enabled by default (100K token threshold, 3 protected turns)
- Fine-tuning: drag-and-drop dataset upload, custom HuggingFace model support
## Security
- Resolve all CodeQL clear-text logging alerts (secrets, tokens, ARNs redacted)
- OAuth redirect URL validation to prevent open redirects
- Explicit read-only permissions on all 13 GitHub Actions workflows
## Performance
- Frontend production build optimized: 8.85 MB → 4.96 MB (871 KB gzipped)
- PR workflows trimmed: skip Docker builds, CDK synth, and redundant jobs
## Infrastructure
- New shared-conversations DynamoDB table with SessionShare and OwnerShare GSIs
- Bedrock prompt caching temporarily disabled due to provider limitations
## Bug Fixes
- Google Fonts moved to index.html to fix CI build failure
- Private sharing support (owner-only shares)
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* refactor(inference-api): remove underscore prefix from containerImageUri variable
- Remove underscore prefix from containerImageUri variable name
- Improve code clarity by following standard naming conventions
- Variable is used throughout the stack and should follow public naming patterns
* chore(deps): add cognitoidp moto extra and update infrastructure tests
- Add cognitoidp extra to moto dependency in uv.lock for Cognito IDP mocking support
- Update moto dependency extras to include both cognitoidp and dynamodb
- Refactor IAM policy assertions in inference-api-stack tests to search both inline and managed policies
- Simplify policy verification logic to use findResources and filter by policy attributes
- Remove S3 bucket and S3 Vector Store test sections from app-api-stack tests
- Update test assertions to be more flexible with policy resource types
* chore(frontend): update favicon and logo assets
- Add Android Chrome favicon variants (192x192 and 512x512)
- Add Apple Touch Icon for iOS devices
- Add favicon sizes for 16x16 and 32x32 resolutions
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Update logo-light.png with refreshed branding
- Improve cross-platform icon support and visual consistency
* fix(auth-providers): remove OIDC discovery endpoint and add JSON parsing error handling
- Remove POST /discover endpoint for OIDC endpoint discovery from admin routes
- Add try-except blocks to handle JSON parsing errors in AuthProviderRepository
- Gracefully default to empty dict when SecretString is invalid or malformed
- Improve resilience when retrieving auth provider secrets from AWS Secrets Manager
---------
Co-authored-by: Colin <colin@colin-os>
* Feat/cognito first boot auth (#124)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDeleteUser permissio…
* Release/v1.0.0 beta.25 (#282)
* Potential fix for pull request finding 'Unused local variable'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for pull request finding 'Unused local variable'
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* docs(readme): update version badges and tech stack to v1.0.0-beta.18
- Update release badge from v1.0.0-beta.17 to v1.0.0-beta.18
- Bump Tailwind CSS version from v4.1 to v4.2 in all references
- Update current release version in release notes section
- Reflect latest dependency versions in architecture and tech stack documentation
* feat(embeddings): add optional token validation bypass for search queries
- Add skip_token_validation parameter to generate_embeddings function
- Allow skipping tiktoken-based token validation for short inputs where tiktoken may not be installed
- Update search_assistant_knowledgebase to skip validation for query embeddings
- Enables embedding generation in environments where tiktoken is unavailable (e.g., search Lambda)
* refactor(embeddings): extract shared embedding logic to separate module
- Move core embedding generation and vector store operations to apis.shared.embeddings
- Create new shared bedrock_embeddings module with generate_embeddings, store_embeddings_in_s3, search_assistant_knowledgebase, and delete_vectors_for_document
- Extract vector search logic to new apis.shared.assistants.vector_search module
- Keep ingestion-specific token validation (tiktoken-based) in app_api embeddings module
- Update ingestion embeddings module to re-export shared functions for backward compatibility
- Simplify bedrock_embeddings in ingestion pipeline to focus on chunk validation and splitting
- Update imports across documents routes and rag_service to use new shared modules
- Reduces code duplication and establishes clear separation between shared RAG infrastructure and ingestion-specific concerns
* docs(release-notes): document v1.0.0-beta.19 features and fixes
- Add Angular production build optimization section explaining minification and tree-shaking enablement
- Document embeddings refactor extracting shared logic to apis.shared.embeddings module
- Add skip_token_validation parameter documentation for generate_embeddings function
- Update highlights section to mention Angular production build optimization
- Clarify CodeQL workflow improvements and unused import/variable cleanup
- Enable optimization flag in angular.json production configuration for reduced bundle size
* docs(release-notes): remove Angular optimization section and revert config
- Remove "Frontend Production Build Optimization" section from release notes
- Revert optimization flag removal from angular.json production configuration
- Align documentation with actual production build configuration state
* feat: add API Keys section to README for programmatic access to AI models
* fix(model_config): comment out caching configuration due to Bedrock limitations
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* feat: refactor session compaction and enable by default (#86)
* feat: update compaction configuration and enhance session manager tests
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(create-training-job): enhance file upload with drag-and-drop support and update dataset upload instructions
* feat(create-training-job): add support for custom HuggingFace models and enhance model search functionality
* fix(test_model_config): remove caching mock and update test for Bedrock config caching behavior
* feat(create-training-job): add tests for custom HuggingFace model selection and submission
* fix: update tests for compaction defaults and commented-out caching
- Update compaction model test to expect enabled=True and protected_turns=3
- Fix caching test to reflect cache_config being commented out due to Bedrock limitations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Signed-off-by: Phil Merrell <philmerrell@boisestate.edu>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* test(to_bedrock_config): add missing result assignment in caching disabled test
* Potential fix for code scanning alert no. 41: Clear-text logging of s… (#85)
* Potential fix for code scanning alert no. 41: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* ci: Add explicit read-only permissions to all workflows
- Add `permissions: contents: read` to 13 GitHub Actions workflows
- Workflows updated: app-api, bootstrap-data-seeding, codeql, frontend, gateway, inference-api, infrastructure, nightly-deploy-pipeline, nightly, rag-ingestion, release, sagemaker-fine-tuning, version-check
- Implements principle of least privilege by explicitly declaring minimal required permissions
- Improves security posture and aligns with GitHub Actions best practices
* fix(security): Redact sensitive information from logs
- Mask client ID in seed_auth_provider output, showing only first 8 characters
- Redact full Secrets ARN in seed_auth_provider, displaying only resource name
- Replace full exception objects with error codes in seed_bootstrap_data error messages
- Downgrade MCP client configuration logging from info to debug level
- Remove user ID from OAuth token retrieval and re-auth status log messages
- Add URL validation to OAuth callback redirect to prevent open redirect vulnerabilities
- Prevents accidental exposure of credentials and sensitive identifiers in application logs
* fix(security): Resolve remaining CodeQL clear-text logging alerts
- seed_auth_provider: Fully redact Secrets Manager ARN from output
- external_mcp_client: Remove server URL from logs, decouple oauth_token from log expressions
- oauth_tool_service: Isolate decrypted token into _try_get_token() to prevent taint bleed, use lazy log formatting
- config.ts: Remove AWS account ID and CORS origins from CDK config log output
* Potential fix for code scanning alert no. 499: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 496: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 498: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Potential fix for code scanning alert no. 497: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
---------
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* feat(frontend): enable production optimization, branch-aware BUILD_CONFIG
- Remove optimization: false from base options (was blocking prod override)
- Production: optimization, no source maps, extract licenses
- Fix anyComponentStyle budget from 4kB to 200kB for Tailwind
- BUILD_CONFIG: main→production, develop→development, dispatch→manual input
Production build: 4.96 MB initial (871 KB gzip) vs 8.85 MB unoptimized
* fix: move Google Fonts import to index.html to prevent CI build failure
* ci: skip docker builds and CDK synth on pull requests
* implement conversation sharing. (#87)
* implement conversation sharing.
* Potential fix for code scanning alert no. 509: Log Injection
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: ofilson <SuperScorer911@gmail.com>
* Potential fix for code scanning alert no. 510: Log Injection
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: ofilson <SuperScorer911@gmail.com>
* fix github warnings
* fix log issue
---------
Signed-off-by: ofilson <SuperScorer911@gmail.com>
Co-authored-by: Oscar Filson <OSCARFILSON@boisestate.edu>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Allow for private share (only with yourself)
* release: v1.0.0-beta.19
* fix float error on sharing
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* ci: skip redundant stack dependency checks on PRs (keep infrastructure only)
* ci: skip install on PRs for rag-ingestion (no downstream jobs)
* ci: revert check-stack-deps skip on workflows with PR jobs, skip entire gateway/sagemaker on PRs
* fix(security): resolve CodeQL log-injection, unused-import, and unused-variable alerts
- Remove user-controlled values from 180 log f-strings (py/log-injection)
- Remove 87 unused Python imports (py/unused-import)
- Remove 27 unused JS/TS variables (js/unused-local-variable)
- Fix 3 useless assignments (js/useless-assignment-to-local)
- Fix 1 incompatible type comparison (js/comparison-between-incompatible-types)
* fix(tests): remove stale AgentCoreMemorySessionManager patch from session factory tests
The CodeQL commit removed the unused AgentCoreMemorySessionManager import
from session_factory.py, breaking two tests that patched it at that path.
Removed the unnecessary patch decorator since TurnBasedSessionManager was
already being patched separately.
* chore(docker): add shared embeddings module to rag-ingestion Lambda image
- Copy shared embeddings package to Lambda task root directory
- Add apis/__init__.py to ensure proper Python package structure
- Enable ingestion embeddings to access re-exported shared embeddings module
- Resolves import errors when bedrock_embeddings.py loads shared embeddings
* fix(quality): resolve all open CodeQL findings on develop
Empty excepts (5 fixes):
- url_fetcher: narrow bare except to Exception, add comment
- code_interpreter_diagram_tool: narrow bare except to Exception
- tool_result_processor: add explanatory comment to JSONDecodeError catch
- users/service: log warning on invalid pagination cursor
- event_formatter: log warning instead of silently swallowing errors
Catch BaseException (2 fixes):
- url_fetcher: narrowed to Exception (same fix as empty except)
- code_interpreter_diagram_tool: narrowed to Exception
Unreachable code (1 fix):
- stream_processor: remove dead if result_seen: break (never set to True)
Redundant assignment (1 fix):
- fine_tuning/routes: remove unused job = on create_inference_job
Print during import (1 fix):
- inference_api/main: replace print() with logging
Commented-out code (1 fix):
- inference_api/chat/models: remove commented InvocationRequest class
Unnecessary lambdas (2 fixes):
- job_repository, inference_repository: lambda v: int(v) → int
Unused local variables (13 fixes):
- Remove or rename: period, user_id, error_msg, matches, requested_set,
exception_type, updated, limit, preferences, execution_output,
next_month, next_year across 10 files
Unused imports (3 fixes):
- compaction_models: remove unused field import
- bedrock_embeddings: remove dead re-exports, clean up __init__.py
- timezone: use find_spec for pytz availability check
Cyclic import (1 fix):
- Move get_metadata_storage() factory from metadata_storage.py to
storage/__init__.py, breaking the metadata_storage ↔ dynamodb_storage
cycle. Update 3 callers to import from apis.app_api.storage.
Dismissed as false positives (11 alerts):
- 9x untrusted-checkout on nightly workflows (schedule/dispatch only)
- 1x non-iterable for-loop (Enum is iterable)
- 1x unused global _generic_validator_initialized (global stmt tracking)
* fix(deps): patch Dependabot security vulnerabilities
- requests 2.32.5 → 2.33.0 (insecure temp file reuse, CVE)
- picomatch 4.0.3 → 4.0.4 (frontend, ReDoS + method injection, via override)
- picomatch 2.3.1 → 2.3.2 (infrastructure, method injection, via override)
- diff 4.0.x → patched (infrastructure, DoS in parsePatch, via audit fix)
Unfixable:
- yaml 1.10.2 bundled inside aws-cdk-lib 2.244.0 (latest) — awaiting AWS CDK update
- Pygments 2.19.2 (latest) — no patched version released yet
* fix(rag-ingestion): ensure Lambda uses latest image digest on deploy
- Add FUNCTION_NAME variable to capture Lambda function identifier
- Update Lambda function code explicitly after image push to force digest refresh
- Add wait condition to ensure function update completes before deployment succeeds
- Remove outdated next steps logging that duplicated deployment completion message
- Resolve issue where CDK's SSM-resolved image tags don't trigger updates when underlying image layers change, causing CloudFormation to report no changes despite fresh image push
* fix share issues and icon tweaks
* release: v1.0.0-beta.20
* fix(rag-ingestion): restore shared embedding re-exports for Lambda handler
The CodeQL fix removed re-exports from bedrock_embeddings.py, but the
RAG ingestion Lambda handler imports generate_embeddings and
store_embeddings_in_s3 from embeddings.bedrock_embeddings (Lambda task
root path). Restored re-exports with __all__ and explanatory comments.
* feat(documents): add upload failure reporting and assistant cleanup
- Add ReportUploadFailureRequest model for client-side upload error reporting
- Implement POST /{document_id}/upload-failed endpoint to mark documents as failed
- Add update_document_status service function to update document status and error details
- Implement background cleanup of vectors and S3 objects when assistant is deleted
- Add delete_vectors_for_assistant function to remove embeddings from vector store
- Update document routes to import new models and service functions
- Add start.sh to .gitignore
- Update bedrock_embeddings to support vector deletion by assistant ID
- Enhance frontend document service to handle upload failure reporting
- Improve assistant deletion flow with proper resource cleanup and error handling
* feat(assistants): remove archive functionality and simplify deletion
- Remove archive_assistant service function and endpoint
- Simplify delete operation to single hard delete without archive option
- Remove include_archived query parameter from list assistants endpoint
- Remove ARCHIVED status from assistant status enum
- Update frontend assistant model and services to remove archive references
- Simplify assistant lifecycle by consolidating soft and hard delete into single delete operation
- Update API documentation and test examples to reflect deletion changes
* feat(frontend): upgrade Analog.js testing dependencies and remove vitest config
- Add @analogjs/vite-plugin-angular and @analogjs/vitest-angular v3.0.0-alpha.18
- Update package-lock.json with new dependency tree and transitive dependencies
- Remove vitest.config.ts in favor of Analog.js configuration
- Update app.config.spec.ts and tool-rail.component.spec.ts test files
- Modernize Angular testing setup with latest Analog.js tooling
* feat(documents): implement reliable deletion with soft-delete and cleanup retries
- Add deleting status to document lifecycle and TTL field for auto-expiry
- Create cleanup_service.py with retry logic for S3 vectors and source file deletion
- Implement soft-delete pattern: mark documents as deleting, return immediately, cleanup asynchronously
- Update search path to filter out non-complete documents and prevent stale results
- Add batch soft-delete for assistant deletion with background cleanup
- Implement deterministic vector key generation for reliable cleanup
- Add comprehensive property-based and integration tests for deletion flows
- Update RAG service to cross-check document status during search
- Configure DynamoDB TTL as backstop for failed cleanups (7-day expiry)
- Add Kiro spec documentation for reliable document deletion design
* test(assistants): remove archive assistant test and fix package dependencies
- Remove test_archive_assistant test case as archive functionality was removed
- Update package-lock.json to fix dependency flags for Angular DevKit and related packages
- Change chokidar dev flag to devOptional to reflect optional development dependency
- Remove unnecessary dev flags from multiple dependencies (ajv, chalk, cli-cursor, fast-deep-equal, and others)
- Align package metadata with current project configuration
* chore(frontend): pin Analog.js dependencies to exact versions
- Remove caret (^) version specifiers from @analogjs/vite-plugin-angular
- Remove caret (^) version specifiers from @analogjs/vitest-angular
- Lock both packages to 3.0.0-alpha.18 for consistent builds
- Prevent unexpected minor/patch updates that could introduce breaking changes
* chore(frontend): pin Analog.js devDependencies to exact versions
- Update @analogjs/vite-plugin-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Update @analogjs/vitest-angular from ^3.0.0-alpha.18 to 3.0.0-alpha.18
- Remove caret (^) prefix to lock exact versions and ensure consistent builds
* feat(fine-tuning-dashboard): add informational section about fine-tuning and update icons
* chore(deps)(deps): bump the frontend-minor-patch group (#101)
Bumps the frontend-minor-patch group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@ng-icons/core](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [@ng-icons/heroicons](https://github.com/ng-icons/ng-icons) | `33.1.0` | `33.2.0` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.33` | `0.16.44` |
| [marked](https://github.com/markedjs/marked) | `17.0.3` | `17.0.5` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.3` | `11.13.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.1` | `4.2.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.18` | `4.1.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.1` | `4.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.2` |
Updates `@ng-icons/core` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `@ng-icons/heroicons` from 33.1.0 to 33.2.0
- [Release notes](https://github.com/ng-icons/ng-icons/releases)
- [Changelog](https://github.com/ng-icons/ng-icons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ng-icons/ng-icons/commits/v33.2.0)
Updates `katex` from 0.16.33 to 0.16.44
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](https://github.com/KaTeX/KaTeX/compare/v0.16.33...v0.16.44)
Updates `marked` from 17.0.3 to 17.0.5
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](https://github.com/markedjs/marked/compare/v17.0.3...v17.0.5)
Updates `mermaid` from 11.12.3 to 11.13.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...mermaid@11.13.0)
Updates `@tailwindcss/postcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-postcss)
Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/coverage-v8)
Updates `postcss` from 8.5.6 to 8.5.8
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.8)
Updates `tailwindcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/tailwindcss)
Updates `vitest` from 4.0.18 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)
---
updated-dependencies:
- dependency-name: "@ng-icons/core"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@ng-icons/heroicons"
dependency-version: 33.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: katex
dependency-version: 0.16.44
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: marked
dependency-version: 17.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: mermaid
dependency-version: 11.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: "@tailwindcss/postcss"
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
- dependency-name: postcss
dependency-version: 8.5.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: tailwindcss
dependency-version: 4.2.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: frontend-minor-patch
- dependency-name: vitest
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: frontend-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the aws-cdk group (#90)
Bumps the aws-cdk group in /infrastructure with 2 updates: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).
Updates `aws-cdk-lib` from 2.244.0 to 2.245.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.245.0/packages/aws-cdk-lib)
Updates `aws-cdk` from 2.1113.0 to 2.1115.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1115.0/packages/aws-cdk)
---
updated-dependencies:
- dependency-name: aws-cdk-lib
dependency-version: 2.245.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: aws-cdk
- dependency-name: aws-cdk
dependency-version: 2.1115.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: aws-cdk
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump actions/setup-node from 5.0.0 to 6.3.0 (#100)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5.0.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/a0853c24544627f65ddf259abe73b1d18a591444...53b83947a5a98c8d113130e565377fae1a50d02f)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump github/codeql-action (#95)
Bumps the actions-minor-patch group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).
Updates `github/codeql-action` from 4.34.1 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/38697555549f1db7851b81482ff19f1fa5c4fedc...c10b8064de6f491fea524254123dbe5e09572f13)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump @types/node in /infrastructure (#94)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.10.1 to 25.5.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.5.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump jsdom in /frontend/ai.client (#102)
Bumps [jsdom](https://github.com/jsdom/jsdom) from 27.4.0 to 29.0.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](https://github.com/jsdom/jsdom/compare/v27.4.0...v29.0.1)
---
updated-dependencies:
- dependency-name: jsdom
dependency-version: 29.0.1
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump ng2-charts in /frontend/ai.client (#105)
Bumps [ng2-charts](https://github.com/valor-software/ng2-charts) from 8.0.0 to 10.0.0.
- [Release notes](https://github.com/valor-software/ng2-charts/releases)
- [Commits](https://github.com/valor-software/ng2-charts/compare/v8.0.0...v10.0.0)
---
updated-dependencies:
- dependency-name: ng2-charts
dependency-version: 10.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the angular group (#97)
Bumps the angular group in /frontend/ai.client with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@angular/cdk](https://github.com/angular/components) | `21.2.3` | `21.2.4` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.5` | `21.2.6` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.5` | `21.2.6` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.5` | `21.2.6` |
| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.5` | `21.2.6` |
| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.5` | `21.2.6` |
| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.5` | `21.2.6` |
| [@angular/build](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.3` | `21.2.5` |
| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.5` | `21.2.6` |
Updates `@angular/cdk` from 21.2.3 to 21.2.4
- [Release notes](https://github.com/angular/components/releases)
- [Changelog](https://github.com/angular/components/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/components/compare/v21.2.3...v21.2.4)
Updates `@angular/common` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/common)
Updates `@angular/compiler` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler)
Updates `@angular/core` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/core)
Updates `@angular/forms` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/forms)
Updates `@angular/platform-browser` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/platform-browser)
Updates `@angular/router` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/router)
Updates `@angular/build` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/cli` from 21.2.3 to 21.2.5
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular-cli/compare/v21.2.3...v21.2.5)
Updates `@angular/compiler-cli` from 21.2.5 to 21.2.6
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.6/packages/compiler-cli)
---
updated-dependencies:
- dependency-name: "@angular/cdk"
dependency-version: 21.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/common"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/core"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/forms"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/platform-browser"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/router"
dependency-version: 21.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/build"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/cli"
dependency-version: 21.2.5
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
- dependency-name: "@angular/compiler-cli"
dependency-version: 21.2.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: angular
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps-dev): bump jest and @types/jest in /infrastructure (#92)
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) and [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest). These dependencies needed to be updated together.
Updates `jest` from 29.7.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)
Updates `@types/jest` from 29.5.14 to 30.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)
---
updated-dependencies:
- dependency-name: jest
dependency-version: 30.3.0
dependency-type: direct:development
update-type: version-update:semver-major
- dependency-name: "@types/jest"
dependency-version: 30.0.0
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* add conversation deleting handling for shared conversations + bug fix
* chore(deps)(deps): bump constructs (#91)
Bumps the infra-minor-patch group in /infrastructure with 1 update: [constructs](https://github.com/aws/constructs).
Updates `constructs` from 10.5.1 to 10.6.0
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.5.1...v10.6.0)
---
updated-dependencies:
- dependency-name: constructs
dependency-version: 10.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: infra-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(messages): displayText support for RAG-augmented and file attachment messages (#107)
* feat(messages): add displayText support for RAG-augmented messages
- Add original_message parameter to stream_async and StreamCoordinator to preserve user input before RAG augmentation
- Store displayText in message metadata when original message differs from augmented version
- Add display_text field to MessageMetadata model with displayText alias for JSON serialization
- Update chat_stream route to pass original message when RAG augmentation is applied
- Enhance metadata retrieval to query both cost records (C#) and display text records (D#) from DynamoDB
- Add store_user_display_text function to persist original message text for clean UI display
- Update .gitignore to exclude local dev scripts (start.sh)
- Improves user experience by showing original unaugmented messages in conversation UI while maintaining RAG-enhanced context for agent processing
* feat(messages): add displayText support for file attachments and local runtime override
- Add LOCAL_RUNTIME_ENDPOINT_URL environment variable support for development runtime override in auth routes
- Extend displayText storage to handle file attachment content block modifications, not just RAG augmentation
- Add message_will_be_modified logic to determine when original message should be stored as displayText
- Implement showDebugOutput local settings signal for toggling debug information display
- Update user message component to display original text when displayText is available
- Add debug output toggle to chat preferences settings page
- Update session metadata documentation to clarify displayText usage for all prompt modifications
- Ensure original user message is preserved for UI display while augmented prompt remains in AgentCore Memory
* test(metadata): add displayText (D# record) tests for store and retrieval
* chore(deps): bump fast-check from 3.23.2 to 4.6.0
- Update fast-check to version 4.6.0 with caret constraint for minor/patch updates
- Update pure-rand dependency to 4.6.0's requirement of ^8.0.0 (from ^6.1.0)
- Increase minimum Node.js requirement from 8.0.0 to 12.17.0
- Migrate auth-pbt.spec.ts to use fast-check 4.x API (stringOf → string with unit parameter)
* chore(deps)(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#99)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 (#98)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps)(deps): bump the python-minor-patch group in /backend with 10 updates (#96)
* chore(deps)(deps): bump the python-minor-patch group
Bumps the python-minor-patch group in /backend with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.35.0` | `0.42.0` |
| [boto3](https://github.com/boto/boto3) | `1.42.73` | `1.42.78` |
| [strands-agents](https://github.com/strands-agents/sdk-python) | `1.32.0` | `1.33.0` |
| [strands-agents-tools](https://github.com/strands-agents/tools) | `0.2.23` | `0.3.0` |
| [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.14.2` | `0.16.0` |
| [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.4.7` | `1.4.8` |
| [openai](https://github.com/openai/openai-python) | `2.29.0` | `2.30.0` |
| [google-genai](https://github.com/googleapis/python-genai) | `1.68.0` | `1.69.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.151.9` | `6.151.10` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.8` |
Updates `uvicorn` from 0.35.0 to 0.42.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.35.0...0.42.0)
Updates `boto3` from 1.42.73 to 1.42.78
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.42.73...1.42.78)
Updates `strands-agents` from 1.32.0 to 1.33.0
- [Release notes](https://github.com/strands-agents/sdk-python/releases)
- [Commits](https://github.com/strands-agents/sdk-python/compare/v1.32.0...v1.33.0)
Updates `strands-agents-tools` from 0.2.23 to 0.3.0
- [Release notes](https://github.com/strands-agents/tools/releases)
- [Commits](https://github.com/strands-agents/tools/compare/v0.2.23...v0.3.0)
Updates `aws-opentelemetry-distro` from 0.14.2 to 0.16.0
- [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases)
- [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-observability/aws-otel-python-instrumentation/compare/v0.14.2...v0.16.0)
Updates `bedrock-agentcore` from 1.4.7 to 1.4.8
- [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases)
- [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws/bedrock-agentcore-sdk-python/compare/v1.4.7...v1.4.8)
Updates `openai` from 2.29.0 to 2.30.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.29.0...v2.30.0)
Updates `google-genai` from 1.68.0 to 1.69.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googleapis/python-genai/compare/v1.68.0...v1.69.0)
Updates `hypothesis` from 6.151.9 to 6.151.10
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](https://github.com/HypothesisWorks/hypothesis/compare/hypothesis-python-6.151.9...hypothesis-python-6.151.10)
Updates `ruff` from 0.15.7 to 0.15.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.15.7...0.15.8)
---
updated-dependencies:
- dependency-name: uvicorn
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: boto3
dependency-version: 1.42.78
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: strands-agents
dependency-version: 1.33.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: strands-agents-tools
dependency-version: 0.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: aws-opentelemetry-distro
dependency-version: 0.16.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: bedrock-agentcore
dependency-version: 1.4.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: openai
dependency-version: 2.30.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: google-genai
dependency-version: 1.69.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-minor-patch
- dependency-name: hypothesis
dependency-version: 6.151.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
- dependency-name: ruff
dependency-version: 0.15.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): downgrade cachetools to 6.2.4
- Downgrade cachetools from 7.0.5 to 6.2.4 in backend dependencies
- Resolves compatibility issues with OAuth provider management
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* chore(deps): pin fast-check to exact version 4.6.0
- Remove caret (^) version constraint from fast-check dependency
- Update package.json to use exact version 4.6.0
- Update package-lock.json to reflect pinned version
- Ensure consistent dependency resolution across environments
* feat: add fine-tuning cost dashboard and user cost breakdown (#108)
* feat: add fine-tuning cost dashboard and user cost breakdown
- Introduced new models for cost dashboard and user cost breakdown in the admin API.
- Implemented endpoint to retrieve aggregated cost data for fine-tuning jobs.
- Enhanced fine-tuning access control to support default monthly quota hours for users without explicit grants.
- Added new routes and frontend components for displaying fine-tuning costs and usage statistics.
- Updated infrastructure configuration to include default quota hours for fine-tuning.
- Added tests to ensure proper functionality of new features and configurations.
* fix(logging): improve log message formatting for cost dashboard request
* fix(logging): sanitize period string in cost dashboard log message
* check in share conversations specs
* chore(docs): update versioning documentation and release notes for v1.0.0-beta.20
- Update versioning skill and rule documentation to include README.md version badge and "Current release" text in sync script scope
- Update Kiro steering guide to document README.md and lockfile updates in version sync process
- Bump version badge in README.md from v1.0.0-beta.19 to v1.0.0-beta.20
- Update "Current release" text in README.md to v1.0.0-beta.20
- Add comprehensive release notes for v1.0.0-beta.20 with highlights on document deletion, displayText system, fine-tuning cost dashboard, and dependency updates
- Ensure all AI assistant rule files reflect current versioning workflow
* ci(frontend): remove common scripts from workflow triggers and restrict CDK jobs to non-PR events
- Remove 'scripts/common/**' from push and pull_request trigger paths
- Add condition to synth-cdk job to skip execution on pull_request events
- Update test-cdk job condition to exclude pull_request events while preserving skip_tests logic
- Prevents unnecessary CDK synthesis and testing during pull requests to reduce workflow overhead
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
Signed-off-by: Colin Smith <7762103+colinmxs@users.noreply.github.com>
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh (#118)
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* Purge outdated AI specs and documentation (#121)
* spring cleaning. AI spec file and outdated documentation purge
* spring cleanup --> purging old ai specs and outdated docs
---------
Co-authored-by: colinmxs <colinmxs@users.noreply.github.com>
* Feat/cognito first boot auth (#125)
* feat: replace multi-step auth bootstrap with Cognito first-boot experience
- Add Cognito User Pool, App Client, and Domain to CDK infrastructure
- Implement first-boot backend with race-condition-safe DynamoDB writes
- Add CognitoJWTValidator replacing GenericOIDCJWTValidator
- Add federated identity provider management via Cognito IdP APIs
- Migrate frontend to Cognito OAuth 2.0 + PKCE flow
- Add first-boot setup page with admin account creation
- Update AgentCore Runtime to single Cognito JWT authorizer
- Remove runtime-provisioner and runtime-updater Lambdas
- Remove hardcoded Entra ID configuration from CDK and scripts
- Remove auth provider seeding from bootstrap workflow
- Wire SSM parameters across stacks for Cognito config
- Update GitHub Actions workflows for Cognito context values
* FOR TESTING ONLY< REVERT BEFORE MERGING
* Feat/cognito first boot auth (#123)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDeleteUser permission for user deletion operations
- Add cognito-idp:AdminAddUserToGroup permission for group membership management
- Add cognito-idp:CreateGroup permission for group creation operations
- Enables system admin functionality for managing Cognito user pools and groups
* refactor(auth): replace user email with name in logging and events
- Replace user.email with user.name in quota event recorder metadata
- Update admin cost dashboard logging to use user.name instead of email
- Update admin users routes logging to use user.name instead of email
- Update file upload routes logging to use user.name instead of email
- Update model routes logging to use user.name instead of email
- Update tools routes logging to use user.name instead of email
- Update OAuth routes logging to use user.name instead of email
- Update user models and routes logging to use user.name instead of email
- Update auth service and user service in frontend to use name field
- Standardize user identification across backend and frontend to use name for privacy and consistency
* feat(frontend): update logos and URL-encode inference API ARN
- Update logo-dark.png and logo-light.png assets
- Add URL encoding for ARN portion in inferenceApiUrl computed signal
- Prevent URL parsing errors caused by colons and slashes in AgentCore runtime ARNs
- Improve config service documentation with encoding behavior explanation
* fix(frontend): add /invocations path to inference API endpoints
- Update preview-chat.service.ts to include /invocations path in runtime endpoint URL
- Update chat-http.service.ts to include /invocations path in runtime endpoint URL
- Fixes inference API calls by using correct endpoint path with qualifier parameter
* feat(inference-api): add Authorization header to ALB request configuration
- Add requestHeaderConfiguration to ALB listener rule
- Include Authorization header in requestHeaderAllowlist
- Enable proper header propagation for authenticated requests to inference API
* refactor(auth): consolidate RBAC to AppRole-based authorization
- Replace multiple role-checking functions with single require_app_roles dependency
- Remove require_roles, require_all_roles, has_any_role, has_all_roles, and role-specific decorators (require_faculty, require_staff, require_developer, require_aws_ai_access)
- Update rbac.py to resolve permissions through AppRoleService instead of hardcoded JWT groups
- Simplify auth module exports to only expose require_app_roles and require_admin
- Update admin routes to remove unused role imports
- Add comprehensive docstring explaining AppRole system as single source of truth for permissions
- Update tests to reflect new authorization flow via AppRoleService
* feat(inference-api): add SSM parameters and environment variables to AgentCore runtime
- Import DynamoDB table names from SSM parameters for users, RBAC, auth, OAuth, quota, cost tracking, and file uploads
- Import S3 bucket and vector index names for RAG functionality
- Import gateway URL and frontend CORS origins from SSM parameters
- Add comprehensive environment variables to AgentCore runtime configuration including DynamoDB table mappings, authentication settings, OAuth configuration, AgentCore resource IDs, and directory paths
- Enable authentication and quota enforcement in runtime environment
- Configure frontend URL and CORS origins for cross-origin requests
* feat(inference-api): remove gateway URL parameter and simplify CORS origins
- Remove SSM parameter import for gateway URL from InferenceApiStack
- Remove GATEWAY_URL environment variable from AgentCore runtime configuration
- Replace SSM-imported CORS origins with config-based construction to avoid circular dependency between InferenceApiStack and FrontendStack
- Construct CORS origins dynamically from config.domainName (https://{domain}) with localhost fallback for development
- Eliminates circular dependency: InferenceApiStack ↔ FrontendStack by removing reliance on FrontendStack SSM parameters
* chore(frontend): update favicon and logo assets
- Remove redundant favicon PNG variants (android-chrome, apple-touch-icon, favicon-16x16, favicon-32x32)
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Consolidate favicon assets to reduce redundancy and improve maintainability
* feat(inference-api): add AWS Marketplace permissions for Bedrock model access
- Add MarketplaceModelAccess policy statement to runtime execution role
- Grant aws-marketplace:ViewSubscriptions and aws-marketplace:Subscribe actions
- Enable foundation model access for marketplace-gated models like Anthropic Claude
- Required for subscription validation before Bedrock model invocation
* Release 1.0.0-beta.19: Conversation sharing, session compaction, fine-tuning enhancements, CI optimization
## Features
- Conversation sharing with public/email-restricted access via shareable URLs
- Session compaction enabled by default (100K token threshold, 3 protected turns)
- Fine-tuning: drag-and-drop dataset upload, custom HuggingFace model support
## Security
- Resolve all CodeQL clear-text logging alerts (secrets, tokens, ARNs redacted)
- OAuth redirect URL validation to prevent open redirects
- Explicit read-only permissions on all 13 GitHub Actions workflows
## Performance
- Frontend production build optimized: 8.85 MB → 4.96 MB (871 KB gzipped)
- PR workflows trimmed: skip Docker builds, CDK synth, and redundant jobs
## Infrastructure
- New shared-conversations DynamoDB table with SessionShare and OwnerShare GSIs
- Bedrock prompt caching temporarily disabled due to provider limitations
## Bug Fixes
- Google Fonts moved to index.html to fix CI build failure
- Private sharing support (owner-only shares)
* Release 1.0.0-beta.20: Document soft-delete, displayText, fine-tuning costs, CodeQL remediation, dependency refresh
Reliable document deletion, displayText for RAG-augmented messages,
fine-tuning cost dashboard, assistant archive removal, and a full
dependency refresh across Python, npm, and GitHub Actions.
Features:
- Soft-delete document lifecycle with background cleanup, retry logic,
DynamoDB TTL backstop, and search filtering for mid-deletion docs
- Upload failure reporting endpoint for client-side error tracking
- DisplayText system preserving original user messages when RAG
augmentation or file attachments modify the prompt sent to the agent
- Debug output toggle in chat preferences for prompt inspection
- Fine-tuning cost dashboard with per-user breakdowns and default
monthly quota hours
- Shared conversation cascade deletion on session delete
Removals:
- Assistant archive functionality (ARCHIVED status, archive endpoint,
include_archived parameter) replaced with single delete operation
Security & Code Quality:
- All CodeQL findings resolved (180 log injection fixes, 5 silent
exception fixes, cyclic import elimination, 13 unused variables)
- Four Dependabot security patches (requests, picomatch, diff)
CI/CD:
- CDK synth skipped on PRs for app-api and frontend workflows
- scripts/common/** removed from frontend workflow path triggers
- GitHub Actions bumped (upload-artifact v7, download-artifact v8,
setup-node v6, codeql-action latest)
Testing:
- Analog.js testing migration for frontend (vitest config removed)
- fast-check v4.6.0 added for property-based frontend tests
- 4,200+ lines of new backend tests for document deletion flows
Tooling:
- sync-version.sh now auto-updates README badge and current release text
- Versioning steering docs updated across Kiro, Cursor, and Claude
- Release notes steering doc added (fileMatch on RELEASE_NOTES.md)
Dependencies:
- Python: uvicorn 0.42.0, strands-agents 1.33.0, strands-agents-tools
0.3.0, aws-opentelemetry-distro 0.16.0, bedrock-agentcore 1.4.8,
openai 2.30.0, cachetools downgraded to 6.2.4 for compatibility
- Frontend: Angular 21.2.6, @angular/cdk 21.2.4
- Infrastructure: aws-cdk group bumped, constructs bumped
* refactor(inference-api): remove underscore prefix from containerImageUri variable
- Remove underscore prefix from containerImageUri variable name
- Improve code clarity by following standard naming conventions
- Variable is used throughout the stack and should follow public naming patterns
* chore(deps): add cognitoidp moto extra and update infrastructure tests
- Add cognitoidp extra to moto dependency in uv.lock for Cognito IDP mocking support
- Update moto dependency extras to include both cognitoidp and dynamodb
- Refactor IAM policy assertions in inference-api-stack tests to search both inline and managed policies
- Simplify policy verification logic to use findResources and filter by policy attributes
- Remove S3 bucket and S3 Vector Store test sections from app-api-stack tests
- Update test assertions to be more flexible with policy resource types
* chore(frontend): update favicon and logo assets
- Add Android Chrome favicon variants (192x192 and 512x512)
- Add Apple Touch Icon for iOS devices
- Add favicon sizes for 16x16 and 32x32 resolutions
- Update favicon.ico with new design
- Update logo-dark.png with refreshed branding
- Update logo-light.png with refreshed branding
- Improve cross-platform icon support and visual consistency
* fix(auth-providers): remove OIDC discovery endpoint and add JSON parsing error handling
- Remove POST /discover endpoint for OIDC endpoint discovery from admin routes
- Add try-except blocks to handle JSON parsing errors in AuthProviderRepository
- Gracefully default to empty dict when SecretString is invalid or malformed
- Improve resilience when retrieving auth provider secrets from AWS Secrets Manager
---------
Co-authored-by: Colin <colin@colin-os>
* Feat/cognito first boot auth (#124)
* test(auth-sweep): add system status endpoints to public route patterns
- Add /system/status to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- Add /system/first-boot to PUBLIC_ROUTE_PATTERNS for unauthenticated access
- These endpoints should be accessible without authentication for system initialization and health checks
* chore(deps): add cognitoidp extra to moto dev dependency
- Add cognitoidp extra to moto[dynamodb] in pyproject.toml dev dependencies
- Update uv.lock to include cognitoidp extra across all moto references
- Add joserfc package as transitive dependency for cognitoidp support
- Enable Cognito IDP mocking capabilities for development and testing
* test(auth-guard,config-service): add missing service mocks and config properties
- Add SystemService mock to auth.guard.spec.ts test setup
- Import SystemService dependency in auth guard test file
- Add checkStatus mock method to systemService test double
- Register SystemService provider in TestBed configuration
- Add inferenceApiUrl property to validConfig test fixture in config.service.spec.ts
- Ensure test doubles accurately reflect service dependencies for proper test isolation
* feat(system-admin): add JWT role mapping for system_admin Cognito group
- Add JWT_MAPPING#system_admin item to DynamoDB during bootstrap seeding
- Update system_admin role jwtRoleMappings to include "system_admin" group
- Implement add_user_to_group method in CognitoService to manage group membership
- Add user to system_admin Cognito group during first_boot with rollback on failure
- Update test assertions to verify JWT mapping creation and role configuration
- Enables Cognito to include system_admin group in JWT cognito:groups claim for RBAC resolution
* feat(infrastructure): add Cognito user and group management permissions
- Add cognito-idp:AdminDelete…
Bump version 1.0.0 -> 1.0.1 across manifests and lockfiles, and write
1.0.1 release notes / changelog covering the two unreleased features:
- Save conversations to connected apps ("Save to...", Google Drive
export target) (#507, #508, #509, #510, #511)
- External (cross-account) Route53 hosted zones via the optional
manageDnsRecords / CDK_MANAGE_DNS_RECORDS flag (#512)
Adds a top-of-notes callout pointing beta operators to the 1.0.0
single-stack upgrade guide given the quick 1.0.0 -> 1.0.1 turnaround.
The 1.0.0 release reached main as a single squash commit (#506), while develop carries the same 1.0.0 as individual commits; their last shared ancestor was beta.24, so a normal merge produced spurious add/add conflicts on the 1.0.0 files. release/1.0.1 is a verified content-superset of main (git diff origin/main release/1.0.1 == the 1.0.1 features only), so this merge keeps our tree and simply records main's HEAD as a parent, restoring shared ancestry so release/1.0.1 -> main merges cleanly.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return messages | ||
| logger.warning( | ||
| "Export for session %s hit the %d-page cap; transcript may be truncated", | ||
| session_id, |
| ) | ||
| except ExportTargetError as err: | ||
| logger.warning( | ||
| "create_document failed for connector %s: %s", request.connector_id, err |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
|
||
| from __future__ import annotations | ||
|
|
||
| from typing import List, Optional |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
see release notes