feat(dev): add Agent Inspector HTTP layer (server, security, assets)

.gitignore

@@ -7,6 +7,9 @@ dist
 *.tgz
 *.bun-build
 
+# staged Agent Inspector SPA (copied from @aws/agent-inspector at build time)
+src/assets/agent-inspector/
+
 # code coverage
 coverage
 *.lcov

package.json

@@ -62,6 +62,7 @@
     "@aws-sdk/client-cloudwatch-logs": "^3.1092.0",
     "@aws-sdk/client-iam": "^3.1080.0",
     "@aws-sdk/client-sts": "^3.1092.0",
+    "@aws/agent-inspector": "0.6.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.221.0",
     "@opentelemetry/otlp-transformer": "0.213.0",

scripts/build.ts

@@ -36,6 +36,29 @@ function discoverAssets(): string[] {
   return files.sort().map((relativePath) => join(ASSETS_DIR, relativePath));
 }
 
+/**
+ * Stage the prebuilt Agent Inspector SPA into the asset tree (gitignored) so
+ * both distribution paths ship it through the ordinary asset machinery:
+ * `bundle` mirrors it into dist/assets/, `compile` embeds it in the binary.
+ * Every file gains a neutral `.asset` suffix — compile passes assets as
+ * Bun.build entrypoints, and a bare .html entrypoint would be bundled through
+ * Bun's HTML-imports pipeline instead of embedded verbatim. InspectorAssets
+ * strips the suffix when reading.
+ */
+async function stageInspectorAssets(): Promise<void> {
+  const source = join(REPO_ROOT, "node_modules", "@aws", "agent-inspector", "dist-assets");
+  if (!(await Bun.file(join(source, "index.html")).exists())) {
+    throw new Error("@aws/agent-inspector is not installed — run `bun install` before building.");
+  }
+  const target = join(ASSETS_DIR, "agent-inspector");
+  await $`rm -rf ${target}`;
+  await $`mkdir -p ${target}`;
+  const files = [...new Bun.Glob("**/*").scanSync({ cwd: source, onlyFiles: true })];
+  for (const file of files) {
+    await $`cp ${join(source, file)} ${join(target, `${file}.asset`)}`;
+  }
+}
+
 /** Force asset files through the file loader so template .ts/.js are embedded as bytes, not compiled. */
 function assetLoaderPlugin(): Bun.BunPlugin {
   return {
@@ -89,6 +112,7 @@ async function assertAssetsAreText(assets: string[]): Promise<void> {
 // Bun.build rejects with an AggregateError on failure (throw defaults to true),
 // so build errors propagate to runWithExitCode like any other.
 async function bundle(): Promise<void> {
+  await stageInspectorAssets();
   await Bun.build({
     entrypoints: [ENTRYPOINT],
     outdir: DIST,
@@ -105,6 +129,7 @@ async function bundle(): Promise<void> {
 }
 
 async function compile(target: string): Promise<void> {
+  await stageInspectorAssets();
   const assets = discoverAssets();
   await assertAssetsAreText(assets);
 

src/core/dev/inspector/respond.ts

@@ -0,0 +1,53 @@
+/** Small response and parsing helpers shared by the Inspector route modules. */
+import type { HttpResponse } from "../../../io/httpServer";
+
+export function json(status: number, body: unknown): HttpResponse {
+  return {
+    status,
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  };
+}
+
+export function apiError(status: number, error: string): HttpResponse {
+  return json(status, { success: false, error });
+}
+
+/** Parse a JSON request body, or undefined when it is not valid JSON. */
+export function parseJsonBody(body: Buffer): Record<string, unknown> | undefined {
+  try {
+    const parsed: unknown = JSON.parse(body.toString());
+    if (parsed && typeof parsed === "object") return parsed as Record<string, unknown>;
+  } catch {
+    // fall through
+  }
+  return undefined;
+}
+
+/**
+ * Parse an optional epoch-milliseconds query parameter. Returns the value (or
+ * undefined when absent) or an error response matching the reference wording.
+ */
+export function parseTimeParam(
+  url: URL,
+  name: string,
+): { value: number | undefined; error?: HttpResponse } {
+  const raw = url.searchParams.get(name);
+  if (raw === null) return { value: undefined };
+  const value = Number(raw);
+  if (Number.isNaN(value)) {
+    return {
+      value: undefined,
+      error: apiError(400, `${name} must be a number (epoch milliseconds)`),
+    };
+  }
+  return { value };
+}
+
+export function asString(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+export function errorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}