feat(update): port CLI self-updater command to refactor architecture by jariy17 · Pull Request #2151 · aws/agentcore-cli

jariy17 · 2026-08-31T20:03:49Z

What

Ports the agentcore update command from the old CLI (main) into the refactored Handler/Router (Bun) architecture. update checks the npm registry for a newer @aws/agentcore and runs npm install -g; update --check reports availability without installing.

The refactor branch had resource-level update subcommands (gateway, harness, eval…) but no top-level self-updater — this adds it.

Changes

src/handlers/update/action.ts (new) — fetchLatestVersion, compareVersions, installArgv, handleUpdate. The install runs through an injectable ProcessRunner (defaults to the shared runProcess from src/io/exec.ts), so the install path is testable without spawning a real npm.
src/handlers/update/index.tsx (new) — createUpdateHandler; always renders the UpdateResult as JSON (matching the resource-command convention); npm progress streams to io.stderr so stdout stays a clean, pipeable JSON result; SilentCLIError for a non-zero exit on failed install.
src/handlers/index.tsx — mounts the handler at the root (2 lines).
src/handlers/update/update.test.ts (new) — compareVersions table, fetchLatestVersion fetch spy (200/404), and handleUpdate branches (up-to-date / newer-local / update-available / updated / update-failed) via an injected fake runner.

CLI surface

agentcore update           # check and install
agentcore update --check   # report availability only

Verification

bun test src/handlers/update/ → 21 pass / 0 fail
bunx tsc --noEmit → clean
Live: update --help, update --check, update --check --json all correct

Notes

Faithful port of the old command's behavior (bare update installs; --check only checks). A separate adversarial bug bash surfaced pre-existing gaps carried over from the old CLI (dist-tag check/install channel mismatch, no CI/TTY install guard, unvalidated registry JSON) — not addressed here to keep this a clean port; happy to follow up.

agentcore-devx-automation · 2026-08-31T20:06:35Z

Claude Security Review: no high-confidence findings. (run)

codecov-commenter · 2026-08-31T20:07:12Z

Codecov Report

❌ Patch coverage is 91.37931% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.15%. Comparing base (f431dce) to head (079ed69).
⚠️ Report is 41 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/update/index.tsx	91.07%	5 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2151      +/-   ##
============================================
- Coverage     97.16%   97.15%   -0.02%     
============================================
  Files           495      496       +1     
  Lines         32676    32734      +58     
============================================
+ Hits          31751    31804      +53     
- Misses          925      930       +5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

agentcore-devx-automation

AgentCore Harness Review

Verdict: Looks good

Clean port of agentcore update into the refactored Handler/Router architecture. Nicely scoped:

Business logic (fetchLatestVersion, compareVersions, handleUpdate) is separated from the handler shell.
ProcessRunner is injected so the install path is covered without spawning real npm — mocking is at the true I/O boundary (matches the repo's guidance).
fetch is spied via spyOn(globalThis, "fetch") and restored in afterEach — appropriately hermetic.
renderJson is called before the SilentCLIError throw, so the JSON result reaches stdout even on a failed install, and the non-zero exit still surfaces to scripts.
Telemetry is auto-instrumented at the router (cli.command_run with command_path), so no per-handler wiring is needed.

Known follow-ups already called out in the PR description (which I agree are out of scope for a "clean port"):

installArgv() uses distTag() (@preview vs @latest), but fetchLatestVersion() always queries the /latest endpoint. For a preview build the check and the install target disagree — the check compares against stable, then installs from preview.
No guard against running npm install -g in non-interactive/CI contexts, and the registry JSON isn't schema-validated.

Non-blocking observations for a future pass:

PACKAGE_NAME = "@aws/agentcore" is hardcoded while the current package.json name on refactor is agentcore. Fine if this reflects the intended published name, but worth confirming before the branch actually ships.
Test file is update.test.ts while the rest of src/handlers/ uses co-located index.test.ts. Minor.
In the "newer-local" test (handleUpdate(false) with no injected runner), the branch returns before invoking the runner, so it's safe today, but passing a mock runner would make the test robust to future refactors of handleUpdate.

Nothing here needs to block merge.

agentcore-devx-automation · 2026-08-31T20:15:15Z

Claude Security Review: no high-confidence findings. (run)

Ports the `agentcore update` command from the old CLI into the refactored Handler/Router (Bun) architecture. It checks the npm registry for a newer @aws/agentcore and runs `npm install -g` (`--check` reports without installing). - src/handlers/update/action.ts: fetchLatestVersion + compareVersions + handleUpdate, with an injectable ProcessRunner (defaults to the shared runProcess) so the install path is testable without spawning npm. - src/handlers/update/index.tsx: createUpdateHandler, always renders the UpdateResult as JSON (resource-command convention); npm progress streams to stderr so stdout stays pipeable. - Mounted in src/handlers/index.tsx. - 21 bun tests (compareVersions table, fetch spy, injected runner); tsc clean.

agentcore-devx-automation · 2026-08-31T21:40:11Z

Claude Security Review: no high-confidence findings. (run)

AlexanderRichey · 2026-09-01T02:19:38Z

+export async function fetchLatestVersion(): Promise<string> {
+  const response = await fetch(`${REGISTRY_URL}/${PACKAGE_NAME}/latest`);
+  if (!response.ok) {
+    throw new Error(`Failed to fetch latest version: ${response.statusText}`);


This should be an AgentCoreCLIError. I think we should create a NetworkingError to cover this and other cases.

We already have a NetworkingError (ref). I'll just use that.

AlexanderRichey · 2026-09-01T02:20:26Z

+  }
+
+  return 0;
+}


This is looking a little gnarly! Can we not use semver?

I didn't realize it was a library. I'll use that instead.

jariy17 · 2026-09-01T14:46:33Z

CI note: the only red check is unit-test / Test (macOS), which fails solely on src/io/watchFile.test.ts → "debounces a burst of edits into a single callback and stops on abort" — a timing-sensitive debounce test unrelated to this PR (not in the diff; Linux + Windows run the same test and pass). Everything owned by this change is green: check, unit-test Linux/Windows, e2e, all builds, CodeQL, Analyze.

Replace the hand-rolled compareVersions with semver.compare (semver was already resolved transitively; added as a direct dep + @types/semver). Fixes the edge cases the hand-rolled parser mishandled (build metadata, v-prefix/non-numeric -> NaN treated as equal, 4th segment ignored, mixed numeric/alphanumeric prerelease precedence). Addresses review feedback.

agentcore-devx-automation · 2026-09-01T16:27:13Z

Claude Security Review: no high-confidence findings. (run)

- fetchLatestVersion throws the existing NetworkingError on both a non-OK registry response and a fetch reject (offline), instead of a raw Error / undici TypeError. - update-failed now carries the caught error message in UpdateResult.error, so the always-JSON output explains the failure even when npm produced no stderr (e.g. npm missing -> ENOENT before any output streams). Addresses review feedback.

agentcore-devx-automation · 2026-09-01T16:44:46Z

Claude Security Review: no high-confidence findings. (run)

Throw a plain AgentCoreCLIError carrying the captured failure reason instead of SilentCLIError, so a failed self-update always prints why (incl. npm missing) and exits non-zero.

agentcore-devx-automation · 2026-09-01T16:48:17Z

Claude Security Review: no high-confidence findings. (run)

agentcore-devx-automation · 2026-09-01T16:51:59Z

Claude Security Review: no high-confidence findings. (run)

Drop the catch/rethrow around the install. runProcess already throws a ProcessFailedError (an AgentCoreCLIError carrying the command, exit code, and captured npm output), so let it bubble to the root instead of flattening it into a generic error. Removes the update-failed status and error field.

agentcore-devx-automation · 2026-09-01T17:04:06Z

Claude Security Review: no high-confidence findings. (run)

Regenerate bun.lock from the base branch so it keeps lockfileVersion 3, the nested @aws-cdk/toolkit-lib yaml override, and the pinned @opentelemetry/core 2.10.0. An older bun had rewritten all three while adding semver, which broke 'bun install --frozen-lockfile' in CI. Net change is now just the semver and @types/semver entries.

agentcore-devx-automation · 2026-09-01T22:59:02Z

Claude Security Review: no high-confidence findings. (run)

Hweinstock · 2026-09-02T03:19:40Z

CI note: the only red check is unit-test / Test (macOS), which fails solely on src/io/watchFile.test.ts → "debounces a burst of edits into a single callback and stops on abort" — a timing-sensitive debounce test unrelated to this PR (not in the diff; Linux + Windows run the same test and pass). Everything owned by this change is green: check, unit-test Linux/Windows, e2e, all builds, CodeQL, Analyze.

known flaky test: #2140 :(

Hweinstock · 2026-09-02T03:22:09Z

+
+export type UpdateStatus = "up-to-date" | "newer-local" | "update-available" | "updated";
+
+export interface UpdateResult {


should this be a type since it represents a concrete grouping of data?

Yes I'll fix this in a follow up

Hweinstock · 2026-09-02T03:26:12Z

+  if (!response.ok) {
+    throw new NetworkingError(`Failed to fetch latest version: ${response.statusText}`);
+  }
+  const data = (await response.json()) as { version: string };


should these two lines lines also be wrapped in networking error? My understanding is that fetch doesn't consume the body until the .json call.

Yes, ill fix this in a follow up

Hweinstock · 2026-09-02T03:29:38Z

+
+describe("fetchLatestVersion", () => {
+  afterEach(() => {
+    spyOn(globalThis, "fetch").mockRestore();


could we avoid the direct mocking by making the http fetch injectable?

Yeah, I'll look into doing that in a follow up pr.

github-actions Bot added the size/m PR size: M label Aug 31, 2026

agentcore-devx-automation Bot added agentcore-harness-reviewing AgentCore Harness review in progress claude-security-reviewing Claude Code /security-review in progress labels Aug 31, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 31, 2026

agentcore-devx-automation Bot reviewed Aug 31, 2026

View reviewed changes

agentcore-devx-automation Bot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 31, 2026

jariy17 force-pushed the feat/update-command branch from c07c1ce to 26875ea Compare August 31, 2026 20:12

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Aug 31, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Aug 31, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 31, 2026

jariy17 force-pushed the feat/update-command branch from 26875ea to 3003400 Compare August 31, 2026 21:37

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Aug 31, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Aug 31, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Aug 31, 2026

AlexanderRichey requested changes Sep 1, 2026

View reviewed changes

github-actions Bot added size/m PR size: M and removed size/m PR size: M labels Sep 1, 2026

agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Sep 1, 2026

agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Sep 1, 2026

agentcore-devx-automation Bot added claude-security-reviewing Claude Code /security-review in progress and removed claude-security-reviewing Claude Code /security-review in progress labels Sep 1, 2026

fix(update): report a failed install as a non-silent error

1b7f642

Throw a plain AgentCoreCLIError carrying the captured failure reason instead of SilentCLIError, so a failed self-update always prints why (incl. npm missing) and exits non-zero.