CLI deploy of a browser agent fails: missing StartBrowserSession in the generated role, and lost exec bit on the Playwright driver
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
这个 Issue 还没有评估数据。
描述
Deploying a LangChain Deep Agent that uses AgentCore Browser through the CLI fails at two points. Both are in the deployment path rather than in the agent, and together they blocked me from using the CLI at all: I fell back to a boto3 deploy script, which is roughly 220 lines a sample should not need to carry.
1. The generated execution role is missing browser permissions.
An agent that calls AgentCore Browser needs bedrock-agentcore:StartBrowserSession. The role the CLI creates does not include it, so the deploy succeeds and the first invocation fails:
AccessDeniedException: User: arn:aws:sts::<account>:assumed-role/<generated-role>/...
is not authorized to perform: bedrock-agentcore:StartBrowserSession
The same agent works when the role is created by hand with that action added. Code interpreter agents are unaffected, so this looks specific to the browser tool actions being absent from the generated policy.
2. The deployment zip drops the executable bit on the Playwright driver.
With the role fixed, the browser still does not start:
PermissionError: [Errno 13] Permission denied:
'/var/task/playwright/driver/node'
playwright ships a bundled node binary that must stay executable. The zip the CLI builds appears not to preserve file modes, so the extracted binary is not executable in the runtime. Anything with a bundled executable in its wheel hits this, not only Playwright.
Reproduce
An agent built with create_deep_agent from deepagents, with subagents using create_browser_toolkit from langchain-aws, deployed with the CLI. Dependencies: langchain-aws[tools]>=1.7.6, deepagents>=0.7.13, bedrock-agentcore>=1.23.0, aws-opentelemetry-distro, opentelemetry-instrumentation-langchain. Region us-west-2, CLI 0.29.0.
Separately: --include-domains is missing for the web search connector.
translateWebSearch in src/cli/operations/connectors/translators.ts builds parameterValues.domainFilter from excludeDomains only, and there is no includeDomains anywhere in src/. The SDK's GatewayClient.create_web_search_target() accepts both include and exclude lists, so a target that restricts search to a set of trusted domains cannot be created through the CLI today. Restricting to trusted sources is the more common of the two filters in my experience.
- 主要语言
- TypeScript
- 星标
- 304
- 派生
- 105
- 平均合并
- 16 小时 14 分钟
- 30 天内合并 PR
- 186
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aws/agentcore-cli 的其他 Issue
-
`agentcore dev` container fails with LoginTokenLoadError when using `aws login` credentials可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭bug
难度 2/5 1-3 小时 新手友好度 80/100
aws/agentcore-cli#2606 · 4 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
aws/agentcore-cli#2538 ·
维护者通常 1 天内回复
-
[Refactor] project add credentials payment does not match Connector regex可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 68/100
aws/agentcore-cli#2533 · 3 条评论 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
aws/agentcore-cli#2520 ·
维护者通常 1 天内回复
-
bug(policy): add policy --target generates an undeployable Cedar statement (wrong action id suffix, resource scope not narrowed)可能已有人在做 @rksharma-owg 于 21 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 70/100
aws/agentcore-cli#2395 ·
维护者通常 1 天内回复
查看 aws/agentcore-cli 的全部 Issue
相似的 Issue
-
[Android] Nested transforms are composed in reverse order可能已有人在做 @Danyalo 今天认领。 未关闭Repro provided
难度 2/5 1-3 小时 新手友好度 74/100
software-mansion/react-native-svg#3090 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
radix-ui/primitives#4228 ·
维护者通常 1 天内回复
-
bug
难度 1/5 1 小时以内 新手友好度 95/100
rocketride-org/rocketride-server#2705 · 1 条评论 ·
维护者通常 1 天内回复
-
archon-ready archon-size-s archon-type-bug area: web
难度 2/5 1-3 小时 新手友好度 82/100
coleam00/Archon#4707 · 1 条评论 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 70/100
HarperFast/grafana-datasource#177 ·