Merge main into feature/beta

.github/CODEOWNERS

@@ -1 +1 @@
-* @aws/flare
+* @Amazon-Q-Developer/sync-team-dae-production-eng-team

.github/workflows/create-agentic-github-prerelease.yml

@@ -26,15 +26,23 @@ jobs:
 
             # if user ran this action manually
             - if: github.event_name == 'workflow_dispatch'
+              env:
+                  # Pass untrusted event data through the environment instead of
+                  # interpolating it directly into the script body.
+                  INPUT_TAG_NAME: ${{ github.event.inputs.tag_name }}
               run: |
-                  echo "TAG_NAME=${{ github.event.inputs.tag_name }}" >> $GITHUB_ENV
-                  echo "PRERELEASE_NAME=${{ github.event.inputs.tag_name }}" >> $GITHUB_ENV
+                  echo "TAG_NAME=$INPUT_TAG_NAME" >> $GITHUB_ENV
+                  echo "PRERELEASE_NAME=$INPUT_TAG_NAME" >> $GITHUB_ENV
 
             # Otherwise a push to a branch triggered this action.
             # Set TAG_NAME and PRERELEASE_NAME based on branch name
             - if: github.event_name != 'workflow_dispatch'
+              env:
+                  # Branch names are attacker-controllable, so read the value from the
+                  # environment instead of interpolating it into the script body.
+                  HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
               run: |
-                  BRANCH_NAME="${{ github.event.workflow_run.head_branch }}"
+                  BRANCH_NAME="$HEAD_BRANCH"
                   if [[ "$BRANCH_NAME" == "main" ]]; then
                       echo "TAG_NAME=agentic-alpha" >> $GITHUB_ENV
                       echo "PRERELEASE_NAME=alpha" >> $GITHUB_ENV
@@ -53,6 +61,8 @@ jobs:
 
             # Make a sever version that is "decorated" as prerelease
             - name: Create SERVER_VERSION
+              env:
+                  HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
               run: |
                   # example: 1.0.999-pre-main.commitid
                   # SERVER_VERSION - we're making "imitation" manifests that are accessible
@@ -61,7 +71,7 @@ jobs:
                   # in the version.json file.
 
                   AGENTIC_VERSION=$(jq -r '.agenticChat' app/aws-lsp-codewhisperer-runtimes/src/version.json)
-                  COMMIT_SHORT=$(echo "${{ github.event.workflow_run.head_sha }}" | cut -c1-8)
+                  COMMIT_SHORT=$(echo "$HEAD_SHA" | cut -c1-8)
                   echo "SERVER_VERSION=$AGENTIC_VERSION-$PRERELEASE_NAME.$COMMIT_SHORT" >> $GITHUB_ENV
 
             - name: Export outputs

.github/workflows/create-release-candidate-branch.yml

@@ -53,9 +53,13 @@ jobs:
               id: release-version
               env:
                   VERSION_FILE: app/aws-lsp-codewhisperer-runtimes/src/version.json
+                  # Bind workflow inputs via env so they are passed as data, not
+                  # expanded into the script source (prevents script injection).
+                  CUSTOM_VERSION: ${{ inputs.customVersion }}
+                  VERSION_INCREMENT: ${{ inputs.versionIncrement }}
               run: |
-                  customVersion="${{ inputs.customVersion }}"
-                  versionIncrement="${{ inputs.versionIncrement }}"
+                  customVersion="$CUSTOM_VERSION"
+                  versionIncrement="$VERSION_INCREMENT"
 
                   # Read current version
                   currentVersion=$(jq -r '.agenticChat' "$VERSION_FILE")

.github/workflows/integration-tests.yml

@@ -52,26 +52,37 @@ jobs:
             - name: Configure AWS Credentials
               uses: aws-actions/configure-aws-credentials@v4
               with:
-                  role-to-assume: arn:aws:iam::964765661569:role/GitHubActionsTokenRefresherRole
-                  role-session-name: language-servers-github
+                  # DEXP-owned GitHub-OIDC read role in the gamma-IAD canary account (550160095699):
+                  # least-privilege (GetSecretValue on SSOTokenSecret + kms:Decrypt on its key), no lambda.
+                  role-to-assume: arn:aws:iam::550160095699:role/LanguageServersGitHubActionsReadRole
+                  role-session-name: lsp-integ-ci
                   aws-region: us-east-1
             - name: Build
               run: |
                   npm ci
                   npm run compile
-            - name: Refresh Token
-              run: aws lambda invoke --function-name TokenRefresherLambda --region us-east-1 --payload '{}' response.json
             - name: Get SSO Token
-              uses: aws-actions/aws-secretsmanager-get-secrets@v2
-              with:
-                  secret-ids: |
-                      ,SsoTokenSecret
-                  parse-json-secrets: true
+              # SSOTokenSecret is minted by the canary SSORefreshTokenLambda and self-refreshes
+              # every ~5 min, so no lambda invoke is needed. Public repo: mask the token in logs.
+              run: |
+                  SECRET_JSON="$(aws secretsmanager get-secret-value \
+                    --secret-id SSOTokenSecret \
+                    --region us-east-1 \
+                    --query SecretString --output text)"
+                  TEST_SSO_TOKEN="$(printf '%s' "$SECRET_JSON" | jq -r '.createTokenResponseByUser["canaryGammaIAD"].accessToken')"
+                  if [ -z "$TEST_SSO_TOKEN" ] || [ "$TEST_SSO_TOKEN" = "null" ]; then
+                    echo "::error::Failed to extract accessToken for canaryGammaIAD from SSOTokenSecret"
+                    exit 1
+                  fi
+                  echo "::add-mask::$TEST_SSO_TOKEN"
+                  echo "TEST_SSO_TOKEN=$TEST_SSO_TOKEN" >> "$GITHUB_ENV"
             - name: Run Integration Tests
               run: |
                   npm run test-integ -w integration-tests/q-agentic-chat-server
               env:
-                  TEST_SSO_TOKEN: ${{ env.SSOTOKEN }}
-                  TEST_SSO_START_URL: ${{ secrets.TEST_SSO_START_URL }}
-                  TEST_PROFILE_ARN: ${{ secrets.TEST_PROFILE_ARN }}
+                  TEST_SSO_TOKEN: ${{ env.TEST_SSO_TOKEN }}
+                  TEST_SSO_START_URL: ${{ secrets.INTEG_TEST_SSO_START_URL }}
+                  TEST_PROFILE_ARN: ${{ secrets.INTEG_TEST_PROFILE_ARN }}
                   TEST_RUNTIME_FILE: ${{ github.workspace }}/downloaded-artifacts/aws-lsp-codewhisperer.js
+                  # Tags LSP CI traffic so RTS ServiceMetrics/dashboards can segment or exclude it (BI).
+                  AWS_SDK_UA_APP_ID: lsp-integ-ci

.release-please-manifest.json

@@ -1,9 +1,9 @@
 {
-    "chat-client": "0.1.41",
-    "core/aws-lsp-core": "0.0.16",
-    "server/aws-lsp-antlr4": "0.1.20",
-    "server/aws-lsp-codewhisperer": "0.0.88",
-    "server/aws-lsp-json": "0.1.21",
-    "server/aws-lsp-partiql": "0.0.18",
-    "server/aws-lsp-yaml": "0.1.21"
+    "chat-client": "0.1.56",
+    "core/aws-lsp-core": "0.0.22",
+    "server/aws-lsp-antlr4": "0.1.26",
+    "server/aws-lsp-codewhisperer": "0.0.128",
+    "server/aws-lsp-json": "0.1.27",
+    "server/aws-lsp-partiql": "0.0.24",
+    "server/aws-lsp-yaml": "0.1.27"
 }

CONTRIBUTING.md

@@ -38,6 +38,12 @@ To send us a pull request, please:
 GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
 [creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
 
+## Chat Client Host Environments
+
+The chat client (`./chat-client`) is rendered inside a webview that is embedded differently by each IDE host (VS Code, JetBrains, Visual Studio, Eclipse, and SageMaker JupyterLab). These hosts use different browser engines, and for Eclipse the engine differs by operating system (Edge WebView2 on Windows, WebKit / WebKitGTK on macOS/Linux). As a result, browser-level behavior — most notably the `event.origin` seen on inbound `window.postMessage` events — is **not** uniform across hosts. For example, Eclipse on Windows injects the chat HTML via `browser.setText()`, which Edge WebView2 treats as an opaque origin (the empty string `""` or the literal `"null"`).
+
+Because of this, any change that affects inbound message handling, origin validation, or the webview message bridge in `chat-client` (for example `chat-client/src/client/chat.ts`) **must be reviewed and validated against every supported host environment — not only the same-origin hosts.** Pay particular attention to Eclipse on Windows, which is the only host that delivers an opaque/empty origin, since a same-origin assumption there can silently drop all inbound messages while the backend still returns HTTP 200. See the JSDoc on `handleInboundMessage` in `chat-client/src/client/chat.ts` for the per-host origin behavior.
+
 ## Finding contributions to work on
 
 Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.

app/aws-lsp-antlr4-runtimes/package.json

@@ -12,7 +12,7 @@
         "webpack": "webpack"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-antlr4": "*",
         "antlr4-c3": "^3.4.2",
         "antlr4ng": "^3.0.14"

app/aws-lsp-antlr4-runtimes/src/serverWithCustomization.ts

@@ -26,4 +26,6 @@ const props: RuntimeProps = {
     servers: [ANTLR4LanguageServer],
     name: 'PostgreSQL',
 }
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-antlr4-runtimes/src/serverWithoutCustomization.ts

@@ -14,4 +14,6 @@ const props: RuntimeProps = {
     ],
     name: 'PostgreSQL',
 }
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-buildspec-runtimes/package.json

@@ -7,7 +7,7 @@
         "compile": "tsc --build"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-buildspec": "^0.0.1"
     }
 }

app/aws-lsp-buildspec-runtimes/src/index.ts

@@ -23,7 +23,8 @@ const props: BuildspecServerProps = {
 }
 
 async function getFileAsync(url: string): Promise<string> {
-    return await httpsUtils.requestContent(url)
+    const response = await httpsUtils.requestContent(url)
+    return response.content
 }
 
 export const server = new BuildspecServer(props)

app/aws-lsp-cloudformation-runtimes/package.json

@@ -7,7 +7,7 @@
         "compile": "tsc --build"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-cloudformation": "^0.0.1"
     }
 }

app/aws-lsp-cloudformation-runtimes/src/index.ts

@@ -49,7 +49,8 @@ const props: CloudFormationServerProps = {
 }
 
 async function getFileAsync(url: string): Promise<string> {
-    return await httpsUtils.requestContent(url)
+    const response = await httpsUtils.requestContent(url)
+    return response.content
 }
 
 export const server = new CloudFormationServer(props)

app/aws-lsp-codewhisperer-runtimes/package.json

@@ -23,7 +23,7 @@
         "local-build": "node scripts/local-build.js"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-codewhisperer": "*",
         "copyfiles": "^2.4.1",
         "cross-env": "^7.0.3",

app/aws-lsp-codewhisperer-runtimes/src/agent-standalone.ts

@@ -6,6 +6,8 @@ import {
     CodeWhispererServer,
     QAgenticChatServerProxy,
     QConfigurationServerTokenProxy,
+    TransformConfigurationServerTokenProxy,
+    AtxNetTransformServerTokenProxy,
     QLocalProjectContextServerProxy,
     QNetTransformServerTokenProxy,
     WorkspaceContextServerTokenProxy,
@@ -40,8 +42,13 @@ const props = {
         // LspToolsServer,
         AmazonQServiceServerIAM,
         AmazonQServiceServerToken,
+        // ATX Servers
+        TransformConfigurationServerTokenProxy,
+        AtxNetTransformServerTokenProxy,
     ],
     name: 'AWS CodeWhisperer',
 } as RuntimeProps
 
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-codewhisperer-runtimes/src/iam-standalone.ts

@@ -1,7 +1,10 @@
 import { standalone } from '@aws/language-server-runtimes/runtimes'
 import { CodeWhispererServerIAM, QChatServerIAMProxy } from '@aws/lsp-codewhisperer'
 import { createIAMRuntimeProps } from './standalone-common'
+import { RuntimeProps } from '@aws/language-server-runtimes/runtimes/runtime'
 
-const props = createIAMRuntimeProps('0.1.0', [CodeWhispererServerIAM, QChatServerIAMProxy])
+const props = createIAMRuntimeProps('0.1.0', [CodeWhispererServerIAM, QChatServerIAMProxy]) as RuntimeProps
 
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-codewhisperer-runtimes/src/token-standalone.ts

@@ -4,12 +4,15 @@ import {
     CodeWhispererServerTokenProxy,
     QChatServerTokenProxy,
     QConfigurationServerTokenProxy,
+    TransformConfigurationServerTokenProxy,
+    AtxNetTransformServerTokenProxy,
     QNetTransformServerTokenProxy,
     QLocalProjectContextServerProxy,
     WorkspaceContextServerTokenProxy,
 } from '@aws/lsp-codewhisperer'
 import { IdentityServer } from '@aws/lsp-identity'
 import { createTokenRuntimeProps } from './standalone-common'
+import { RuntimeProps } from '@aws/language-server-runtimes/runtimes/runtime'
 
 const MAJOR = 0
 const MINOR = 1
@@ -25,6 +28,11 @@ const props = createTokenRuntimeProps(VERSION, [
     IdentityServer.create,
     QLocalProjectContextServerProxy,
     WorkspaceContextServerTokenProxy,
-])
 
-standalone(props)
+    TransformConfigurationServerTokenProxy,
+    AtxNetTransformServerTokenProxy as any,
+]) as RuntimeProps
+
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-codewhisperer-runtimes/src/version.json

@@ -1,3 +1,3 @@
 {
-    "agenticChat": "1.43.0"
+    "agenticChat": "1.79.0"
 }

app/aws-lsp-identity-runtimes/package.json

@@ -7,7 +7,7 @@
         "compile": "tsc --build"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-identity": "^0.0.1"
     }
 }

app/aws-lsp-identity-runtimes/src/standalone.ts

@@ -8,4 +8,6 @@ const props: RuntimeProps = {
     name: 'Identity Server',
 }
 
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-json-runtimes/package.json

@@ -11,7 +11,7 @@
         "webpack": "webpack"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-json": "*"
     },
     "devDependencies": {

app/aws-lsp-json-runtimes/src/serverWithCustomization.ts

@@ -32,4 +32,6 @@ const props: RuntimeProps = {
     servers: [JsonLanguageServer],
     name: 'AWS JSON server With Custom JsonLanguageServer',
 }
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-json-runtimes/src/serverWithoutCustomization.ts

@@ -10,4 +10,6 @@ const props: RuntimeProps = {
     servers: [JsonLanguageServer],
     name: 'AWS JSON server',
 }
-standalone(props)
+;(async () => {
+    await standalone(props)
+})()

app/aws-lsp-notification-runtimes/package.json

@@ -7,7 +7,7 @@
         "compile": "tsc --build"
     },
     "dependencies": {
-        "@aws/language-server-runtimes": "^0.3.1",
+        "@aws/language-server-runtimes": "^0.3.14",
         "@aws/lsp-notification": "^0.0.1"
     }
 }