fix(policy): correct INSULTS content-filter enum and validate --form-filters#1576
Merged
Merged
Conversation
…filters CONTENT_FILTER_FILTERS listed 'INSULT' (singular); the service enum is 'INSULTS' (plural). The TUI offered the bad value and the non-interactive CLI accepted any string for --form-filters, so both only failed at `agentcore deploy` with an opaque CFN ValidationException. Fix the enum (also fixes the TUI, which derives its options from it) and add client-side validation of --form-filters against the per-category enums already defined in types.ts, turning a deploy-time failure into an immediate, clear error. Closes #1571 Constraint: Validation scoped to form-filter enums the TUI/CLI already offers, per maintainer guidance — not blanket validation of every flag Rejected: New per-category filter constants in PolicyPrimitive | duplicates the source of truth already in types.ts Confidence: high Scope-risk: narrow
jesseturner21
temporarily deployed
to
e2e-testing
GitHub Actions
Inactive
github-actions
Bot
added
the
agentcore-harness-reviewing
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Contributor
Package TarballHow to installgh release download pr-1576-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.1.tgz |
agentcore-cli-automation
approved these changes
Jun 18, 2026
agentcore-cli-automation
left a comment
agentcore-cli-automation
left a comment
There was a problem hiding this comment.
LGTM. Clean, focused bug fix.
Verified:
- Typo fix
INSULT→INSULTSinCONTENT_FILTER_FILTERSflows through to the TUI automatically sinceGUARDRAIL_CATEGORY_OPTIONSreferences the constant (AddPolicyScreen.tsxconsumes it). - No other source/test/doc references to the legacy singular
INSULTremain (grep -rn INSULT src/ test/is clean apart from the regression test). FILTERS_BY_CATEGORYreuses the per-category enums as the single source of truth — no duplication.- New validation in
PolicyPrimitiveruns inside the existingrunCliCommand('add.policy', ...)block, so theValidationErroris captured by telemetry without extra instrumentation. - The category cast on line 418 is safe because
allowedCategoriesis checked at lines 405–410 just above. - Tests are pure-function tests with no mocking — exactly the right level for what's being validated. The
#1571regression guard forINSULTis a nice touch.
github-actions
Bot
removed
the
agentcore-harness-reviewing
Contributor
Coverage Report
|
Drop three tests that padded coverage without exercising distinct behavior: the constant-literal INSULTS assertion (already covered by the regression guard through the helper), the cross-category case (same code path as the unknown-filter test), and the FILTERS_BY_CATEGORY wiring assertion (structure, not behavior). Keep happy-path, unknown-filter, and the #1571 regression guard. Confidence: high Scope-risk: narrow
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
Contributor
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
jesseturner21
temporarily deployed
to
e2e-testing
GitHub Actions
Inactive
notgitika
approved these changes
Jun 18, 2026
notgitika
left a comment
notgitika
left a comment
Contributor
There was a problem hiding this comment.
LGTM, just a question for follow up
|
|
||
| export type GuardrailCategoryType = 'contentFilter' | 'promptAttack' | 'sensitiveInformation'; | ||
|
|
||
| export const CONTENT_FILTER_FILTERS = ['VIOLENCE', 'HATE', 'SEXUAL', 'MISCONDUCT', 'INSULT'] as const; |
Contributor
There was a problem hiding this comment.
maybe as a future follow up, can we inherit these types from the sdk?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
agentcore add policy --form-category contentFilter --form-filters INSULTsucceeded locally butagentcore deployfailed at the CFN service with an opaqueValidationException(Valid categories: VIOLENCE, HATE, SEXUAL, MISCONDUCT, INSULTS).Two root causes, both fixed here:
CONTENT_FILTER_FILTERSlisted'INSULT'(singular); the service enum is'INSULTS'(plural). The TUI offered the bad value because its options derive from this constant. Fixed insrc/cli/tui/screens/policy/types.ts— one-word change that also fixes the TUI.--form-filters. The non-interactive path split the flag and passed raw values straight tosynthesizeCedar, so any string (e.g.NOTAREAL) was accepted and only failed at deploy. AddedFILTERS_BY_CATEGORY+invalidFiltersForCategory()helpers intypes.ts(reusing the per-category enums already defined there as the single source of truth) and wired validation intoPolicyPrimitive, throwing aValidationErrorwith a clear message listing the invalid filter(s) and the allowed set.Per maintainer guidance on the issue, validation is scoped to the form-filter enums the TUI/CLI already offers — not a blanket validation of every flag.
Related Issue
Closes #1571
Type of Change
Testing
npm run test:unit(24 policy tests pass, incl. new regression coverage)npm run typecheck(zero errors)npm run lint(passes via pre-commit hooks)New tests:
types.test.ts— valid filters per category pass; unknown filter rejected; cross-category filter rejected; regression guard thatINSULTSis accepted whileINSULTis rejected.synthesize-cedar.test.ts— added anINSULTScase to lock in the canonical name.Checklist