fix(cli): Populate the runtime invoke URL for AWS_IAM agents in `ag... (#1593)

[aidandaly24]

Refs aws#1593

Issues

• bug(fetch): fetch command lists agents with IAM inbound auth aws/agentcore-cli#1593 — agentcore fetch access lists IAM-authenticated agents and gateways in the resource picker, then on selecting an IAM agent shows only "Auth: IAM" plus a SigV4 message — no token (expected, IAM has none) and, worse, no invoke URL and no example command, because the IAM agent path hard-codes url:''. Users see resources they expect to "fetch" only to be told there is nothing to fetch. Cosmetic/UX friction; the resources still work via SigV4.

Root cause

By design, the list functions return all deployed resources including IAM ones. listAgents pushes every deployed runtime and defaults authType to 'AWS_IAM' (src/cli/operations/fetch-access/list-agents.ts:25-28); listGateways includes AWS_IAM gateways (list-gateways.ts:27-31), which list-gateways.test.ts:60-64 asserts as intended ('gw-iam' returned). useFetchAccessFlow.ts:64-67 merges both into one picker; FetchAccessScreen.tsx:108-119 renders them with [IAM] labels (authLabel line 13). On selecting an IAM AGENT, fetchAgentAccess returns url:'' + SigV4 message + no token (useFetchAccessFlow.ts:9-15); the empty url suppresses the URL block (FetchAccessScreen.tsx:159) and Example block (line 208), so the result screen is near-empty. IAM GATEWAYS fare better — fetch-gateway-token.ts:51-56 returns a non-empty gatewayUrl, so the URL + aws curl example DO render (the strictly-degraded case is the IAM agent). Code introduced by aws#657 (runtime inbound auth) atop the fetch command from aws#627; unchanged and unfixed at v0.20.2. No PR/commit references aws#1593. Entire trace is local CLI code reading ConfigIO; no backend call reached on the IAM path.

The fix

Design decision required. Option (a): filter AWS_IAM resources out of the picker (skip authType==='AWS_IAM' in useFetchAccessFlow.ts:64-67 or in list-agents/list-gateways) — but this hides legitimate resources users may still want the invoke URL for, and would require updating list-gateways.test.ts and the non-interactive availableGateways path in action.ts:24-31. Option (b, recommended): keep IAM resources but make selection useful — populate the runtime invoke URL for IAM agents instead of url:'' (useFetchAccessFlow.ts:10) so the URL + aws curl example render exactly as the IAM-gateway path already does, and optionally dim/annotate IAM rows in the picker (FetchAccessScreen.tsx:117) as "SigV4, no token". Option (b) brings the agent path to parity with the gateway path and is the higher-value, low-risk fix. CLI-only, small.

Files touched: src/cli/tui/screens/fetch-access/useFetchAccessFlow.ts:8-15,64-67; src/cli/tui/screens/fetch-access/FetchAccessScreen.tsx:108-119,159,208-219; src/cli/operations/fetch-access/list-agents.ts:21-29; src/cli/operations/fetch-access/list-gateways.ts:23-43; src/cli/operations/fetch-access/fetch-gateway-token.ts:51-56 (reference for parity); and src/cli/commands/fetch/action.ts:22-40 if IAM filtering (option a) is chosen. Tests: src/cli/operations/fetch-access/tests/list-gateways.test.ts.

Validation evidence

The fix was verified by reproducing the original symptom and re-running after the change:

BEFORE: On HEAD, useFetchAccessFlow.ts routed runtime selection through fetchTokenAccess(resource, fetchRuntimeToken), whose AWS_IAM branch hard-coded url: '' (lines 24-29). I proved this with a throwaway repro test mirroring the original branch: result.url === '' and, per FetchAccessScreen.tsx gating ({result.url && ...} at lines ~161 URL block and ~210 Example block), both blocks are suppressed (urlBlock=false, exampleBlock=false) — the dead-end the issue reports. By contrast the AWS_IAM gateway test (fetch-gateway-token.test.ts:124-136) asserts a populated url=GATEWAY_URL, which is why that path renders usefully — confirming the IAM agent was the strictly-degraded case.

AFTER: The fix adds src/cli/operations/fetch-access/fetch-runtime-access.ts (fetchRuntimeAccess) which reads deployed runtimeArn + targetConfig.region and builds the URL via the existing buildRuntimeInvocationUrl(region, runtimeArn) (status/constants.ts:18). useFetchAccessFlow.ts now routes runtime selection to fetchRuntimeAccess(resource.name). New unit test fetch-runtime-access.test.ts (mock ConfigIO with runtimeArn+region) PASSES: result.url === 'https://bedrock-agentcore.us-east-1.amazonaws.com/runtimes//invocations', result.authType === 'AWS_IAM', result.token === undefined, message contains 'SigV4'. With url populated, FetchAccessScreen renders the URL block and the aws curl <url>/ AWS_IAM Example block — parity with the gateway path, no token shown (correct for IAM).

Test suite: green.

---

Staged on the fork as a draft for human review. Promote to aws/agentcore-cli after vetting.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	37.18%	13613 / 36605
🔵	Statements	36.46%	14474 / 39698
🔵	Functions	31.82%	2336 / 7340
🔵	Branches	31.12%	9013 / 28955

Generated in workflow #120 for commit 1bfb0e1 by the Vitest Coverage Report Action