diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 000000000..7a0c53ffb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,73 @@ +name: Bug Report +description: Report a bug or unexpected behavior +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report a bug. Please fill out the sections below so we can reproduce and fix the issue. + + - type: textarea + id: description + attributes: + label: Description + description: A clear and concise description of the bug. + placeholder: Describe what happened... + validations: + required: true + + - type: textarea + id: steps + attributes: + label: Steps to Reproduce + description: Steps to reproduce the behavior. + placeholder: | + 1. Run `agentcore ...` + 2. Select ... + 3. Observe ... + validations: + required: true + + - type: textarea + id: expected + attributes: + label: Expected Behavior + description: What you expected to happen. + validations: + required: true + + - type: textarea + id: actual + attributes: + label: Actual Behavior + description: What actually happened. + validations: + required: true + + - type: input + id: cli-version + attributes: + label: CLI Version + description: Output of `agentcore --version` + placeholder: "1.0.0" + validations: + required: false + + - type: dropdown + id: os + attributes: + label: Operating System + options: + - macOS + - Windows + - Linux + validations: + required: true + + - type: textarea + id: context + attributes: + label: Additional Context + description: Any other context, screenshots, or logs that might help. + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 000000000..3ba13e0ce --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1 @@ +blank_issues_enabled: false diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 000000000..ee6674818 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,36 @@ +name: Feature Request +description: Suggest a new feature or enhancement +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Thanks for suggesting a feature. Please describe what you'd like and why it would be useful. + + - type: textarea + id: description + attributes: + label: Description + description: A clear description of the feature or enhancement you'd like. + placeholder: Describe the feature... + validations: + required: true + + - type: textarea + id: acceptance-criteria + attributes: + label: Acceptance Criteria + description: What does "done" look like? List concrete, testable criteria. + placeholder: | + - [ ] ... + - [ ] ... + validations: + required: true + + - type: textarea + id: context + attributes: + label: Additional Context + description: Any other context, screenshots, mockups, or examples. + validations: + required: false diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 000000000..fdd01da54 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,49 @@ +## Description + + + +## Related Issue + + + +Closes # + +## Documentation PR + + + +## Type of Change + + + +- [ ] Bug fix +- [ ] New feature +- [ ] Breaking change +- [ ] Documentation update +- [ ] Other (please describe): + +## Testing + +How have you tested the change? + +- [ ] I ran `bun test` +- [ ] I ran the relevant end-to-end tests with `bun run test:e2e`, or explained why they are not applicable +- [ ] I ran `bun run typecheck` +- [ ] I ran `bun run lint:check` +- [ ] I ran `bun run format:check` +- [ ] I ran `bun run build` +- [ ] If I modified `src/assets/`, I updated affected snapshots with `bun test --update-snapshots` and committed them + +## Checklist + +- [ ] I have read the CONTRIBUTING document +- [ ] I have added any necessary tests that prove my fix is effective or my feature works +- [ ] I have updated the documentation accordingly +- [ ] I have added an appropriate example to the documentation to outline the feature, or no new docs are needed +- [ ] My changes generate no new warnings +- [ ] Any dependent changes have been merged and published + +--- + +By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the +terms of your choice. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 000000000..dd5678398 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,5 @@ +## Code of Conduct + +This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). For more +information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact +opensource-codeofconduct@amazon.com with any additional questions or comments. diff --git a/LICENSE b/LICENSE new file mode 100644 index 000000000..67db85882 --- /dev/null +++ b/LICENSE @@ -0,0 +1,175 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. diff --git a/NOTICE b/NOTICE new file mode 100644 index 000000000..c33b914b1 --- /dev/null +++ b/NOTICE @@ -0,0 +1,148 @@ +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. + +------ + +This product includes the following third-party software/licensing: + +** @aws-cdk/toolkit-lib - https://github.com/aws/aws-cdk-cli +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-application-signals - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-bedrock-agent - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-bedrock-agentcore - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-bedrock-agentcore-control - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-cloudformation - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-cloudwatch-logs - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-iam - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-sts - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/client-xray - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/credential-providers - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws-sdk/util-endpoints - https://github.com/aws/aws-sdk-js-v3 +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @aws/agent-inspector - https://github.com/aws/agent-inspector +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @opentelemetry/api, @opentelemetry/exporter-metrics-otlp-http, + @opentelemetry/otlp-transformer, @opentelemetry/resources, + @opentelemetry/sdk-metrics - https://github.com/open-telemetry/opentelemetry-js +License: Apache-2.0 + +** @smithy/core - https://github.com/smithy-lang/smithy-typescript +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @smithy/shared-ini-file-loader - https://github.com/smithy-lang/smithy-typescript +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** @tanstack/react-query - https://github.com/TanStack/query +Copyright (c) 2021-present Tanner Linsley +License: MIT + +** bedrock-agentcore - https://github.com/aws/bedrock-agentcore-sdk-typescript +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. +License: Apache-2.0 + +** cli-truncate - https://github.com/sindresorhus/cli-truncate +Copyright (c) Sindre Sorhus (https://sindresorhus.com) +License: MIT + +** commander - https://github.com/tj/commander.js +Copyright (c) 2011 TJ Holowaychuk +License: MIT + +** handlebars - https://github.com/handlebars-lang/handlebars.js +Copyright (C) 2011-2019 by Yehuda Katz +License: MIT + +** ink - https://github.com/vadimdemedes/ink +Copyright (c) Vadym Demedes (https://github.com/vadimdemedes) +Copyright (c) Sindre Sorhus (https://sindresorhus.com) +License: MIT + +** ink-scroll-view - https://github.com/ByteLandTechnology/ink-scroll-view +Copyright (c) 2025 ByteLand Technology Limited +License: MIT + +** InkUI (vendored components in src/components/ui/) - https://github.com/kamlesh723/InkUI +Copyright (c) 2024 Kamlesh Yadav +License: MIT + +** lodash - https://github.com/lodash/lodash +Copyright OpenJS Foundation and other contributors +Based on Underscore.js, copyright Jeremy Ashkenas, +DocumentCloud and Investigative Reporters & Editors +License: MIT + +** react, react-devtools-core - https://github.com/facebook/react +Copyright (c) Meta Platforms, Inc. and affiliates. +License: MIT + +** react-router - https://github.com/remix-run/react-router +Copyright (c) React Training LLC 2015-2019 +Copyright (c) Remix Software Inc. 2020-2021 +Copyright (c) Shopify Inc. 2022-2023 +License: MIT + +** semver - https://github.com/npm/node-semver +Copyright (c) Isaac Z. Schlueter and Contributors +License: ISC + +** string-width - https://github.com/sindresorhus/string-width +Copyright (c) Sindre Sorhus (https://sindresorhus.com) +License: MIT + +** winston - https://github.com/winstonjs/winston +Copyright (c) 2010 Charlie Robbins +License: MIT + +** winston-daily-rotate-file - https://github.com/winstonjs/winston-daily-rotate-file +Copyright (c) 2015-2024 winstonjs +License: MIT + +** yaml - https://github.com/eemeli/yaml +Copyright Eemeli Aro +License: ISC + +** zod - https://github.com/colinhacks/zod +Copyright (c) 2025 Colin McDonnell +License: MIT + +** Bun (standalone executables) - https://github.com/oven-sh/bun +License: MIT for Bun itself; bundled components have separate licenses, +including LGPL for JavaScriptCore/WebKit. +See https://github.com/oven-sh/bun/blob/bun-v1.4.0/LICENSE.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..6e85efd76 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,119 @@ +# Security Policy + +## Reporting Security Issues + +At AWS, we take security seriously. We appreciate your efforts to responsibly disclose your findings and will make every +effort to acknowledge your contributions. + +To report a security issue, please use one of the following methods: + +### Option 1: Report through AWS Security + +Please report security issues to AWS Security via: + +- **Email**: [aws-security@amazon.com](mailto:aws-security@amazon.com) +- **Web**: [AWS Vulnerability Reporting](https://aws.amazon.com/security/vulnerability-reporting/) + +### Option 2: Create a Private Security Advisory + +For non-critical issues, you may also use GitHub's private security advisory feature: + +1. Go to the Security tab of this repository +2. Click on "Report a vulnerability" +3. Fill out the form with details about the vulnerability + +## What to Include in Your Report + +Please include the following information to help us better understand the nature and scope of the issue: + +- **Type of issue** (e.g., buffer overflow, SQL injection, cross-site scripting, credential exposure, etc.) +- **Full paths of source file(s) related to the issue** +- **Location of the affected source code** (tag/branch/commit or direct URL) +- **Any special configuration required to reproduce the issue** +- **Step-by-step instructions to reproduce the issue** +- **Proof-of-concept or exploit code** (if possible) +- **Impact of the issue**, including how an attacker might exploit it +- **Any potential mitigations you've identified** + +## Response Timeline + +We will acknowledge receipt of your vulnerability report within **3 business days** and send a more detailed response +within **7 business days** indicating the next steps in handling your report. After the initial reply to your report, we +will keep you informed of the progress towards a fix and full announcement. + +## Supported Versions + +We provide security updates for the following versions: + +| Version | Supported | +| ---------------------- | --------- | +| Latest release | ✅ | +| Previous minor release | ✅ | +| Older versions | ❌ | + +## Security Best Practices + +When using the AgentCore CLI: + +### 1. **Credential Management** + +- Never hardcode AWS credentials in your code +- Use AWS IAM roles and instance profiles when possible +- Rotate credentials regularly +- Use AWS Secrets Manager or Parameter Store for sensitive configuration + +### 2. **OAuth Token Security** + +- Store OAuth tokens securely using appropriate secret management services +- Never log or expose OAuth tokens +- Implement token rotation where supported +- Use short-lived tokens when possible + +### 3. **Container Security** + +- Keep base images updated with security patches +- Scan container images for vulnerabilities before deployment +- Use minimal base images to reduce attack surface +- Never store secrets in container images + +### 4. **IAM Best Practices** + +- Follow the principle of least privilege for execution roles +- Use session tags for fine-grained access control +- Regularly audit and review IAM permissions +- Use service control policies (SCPs) where applicable + +### 5. **Network Security** + +- Use VPC endpoints when available +- Implement proper security group rules +- Enable VPC Flow Logs for monitoring +- Use TLS 1.2 or higher for all communications + +## Vulnerability Disclosure Policy + +- Security vulnerabilities will be disclosed via GitHub Security Advisories +- We will provide credit to security researchers who responsibly disclose vulnerabilities (unless they prefer to remain + anonymous) +- We request a 90-day disclosure timeline to allow for patching and distribution + +## Security Updates + +Security updates will be released as: + +- **Critical**: Immediate patch release +- **High**: Within 30 days +- **Medium**: Within 60 days +- **Low**: Next regular release cycle + +Subscribe to our security announcements by watching this repository and enabling security alerts. + +## Additional Resources + +- [AWS Security Center](https://aws.amazon.com/security/) +- [AWS Well-Architected Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html) +- [Bedrock Security Best Practices](https://docs.aws.amazon.com/bedrock/latest/userguide/security.html) + +--- + +**Note**: This repository is maintained by AWS. Please report issues through the channels described above.