AWS AgentCore Plugin

npm install @tealtiger/agentcore-plugin

import { TealTigerAgentCorePlugin } from '@tealtiger/agentcore-plugin';
import { TealEngine } from 'tealtiger';

const engine = new TealEngine({
  policy: myPolicy,
  freeze: myFreezeRules,
  modules: [/* ... */],
  nhi: { enabled: true, enforceScopes: true }
});

const plugin = new TealTigerAgentCorePlugin({
  engine,
  hooks: {
    onCreate: {
      enabled: true,
      requireNHIRegistration: true,
      requireAttestation: true,
      defaultScopes: ['read:*'],
      maxSessionDuration: '8h'
    },
    onExecute: {
      enabled: true,
      evaluateEveryAction: true,
      costTracking: true
    },
    onTool: {
      enabled: true,
      scopeEnforcement: true,
      driftDetection: true
    },
    onTerminate: {
      enabled: true,
      revokeNHI: true,
      emitEvidence: true,
      cleanupResources: true
    }
  }
});

// Register plugin with AgentCore
agentCore.registerPlugin(plugin);

interface OnCreateHook {
  enabled: boolean;

  /** Require NHI registration before agent can execute */
  requireNHIRegistration: boolean;

  /** Require cryptographic attestation */
  requireAttestation: boolean;

  /** Default scopes for new agents */
  defaultScopes: string[];

  /** Maximum session duration */
  maxSessionDuration: string;

  /** Custom validation logic */
  validator?: (agentConfig: AgentConfig) => Promise<ValidationResult>;
}

// What happens during agent creation:
// 1. AgentCore creates agent instance
// 2. TealTiger plugin intercepts creation
// 3. Registers NHI identity with scopes
// 4. Validates attestation credentials
// 5. Sets session TTL
// 6. Emits 'agent.created' evidence event
// 7. Agent is ready to execute (or blocked if validation fails)

interface OnExecuteHook {
  enabled: boolean;

  /** Evaluate every action (vs. sampling) */
  evaluateEveryAction: boolean;

  /** Track costs per execution */
  costTracking: boolean;

  /** Check session TTL validity */
  checkSessionTTL: boolean;

  /** Temporal constraints */
  temporalChecks: boolean;
}

interface OnToolHook {
  enabled: boolean;

  /** Enforce NHI scopes on tool calls */
  scopeEnforcement: boolean;

  /** Monitor for behavioral drift */
  driftDetection: boolean;

  /** Classify tool parameters for sensitive content */
  contentClassification: boolean;

  /** Tool-specific policies */
  toolPolicies?: Record<string, ToolPolicy>;
}

interface OnTerminateHook {
  enabled: boolean;

  /** Revoke NHI identity on termination */
  revokeNHI: boolean;

  /** Emit final evidence summary */
  emitEvidence: boolean;

  /** Clean up agent-owned resources */
  cleanupResources: boolean;

  /** Seal governance passport */
  sealPassport: boolean;
}

// Evidence events emitted:
{
  'agent.created': { agentId, scopes, attestation, timestamp },
  'agent.action.evaluated': { agentId, action, decision, correlationId },
  'agent.tool.invoked': { agentId, tool, params, decision },
  'agent.drift.detected': { agentId, driftScore, deviations },
  'agent.session.expired': { agentId, sessionId, duration },
  'agent.terminated': { agentId, reason, totalActions, totalCost, passport }
}

interface AgentCorePluginOptions {
  /** TealEngine instance */
  engine: TealEngine;

  /** Lifecycle hook configuration */
  hooks: {
    onCreate: OnCreateHook;
    onExecute: OnExecuteHook;
    onTool: OnToolHook;
    onTerminate: OnTerminateHook;
  };

  /** Evidence export configuration */
  evidence?: {
    /** S3 bucket for evidence */
    bucket: string;
    /** Export format */
    format: 'json' | 'sarif';
    /** Real-time streaming to EventBridge */
    eventBridge?: boolean;
  };

  /** CloudWatch metrics */
  metrics?: {
    enabled: boolean;
    namespace: string;
  };
}