Update from upstream - 2026-07-24

Author: lambda-tooling+rie

.gitignore

@@ -7,3 +7,4 @@ tags
 .idea
 .DS_Store
 .venv
+build.log

internal/lambda-managed-instances/aws-lambda-rie/internal/invoke/rie_invoke_request.go

@@ -40,6 +40,7 @@ type rieInvokeRequest struct {
 	cognitoIdentityPoolId      string
 	clientContext              string
 	responseMode               string
+	internalInvocationID       string
 
 	functionVersionID string
 }
@@ -98,6 +99,7 @@ func NewRieInvokeRequest(request *http.Request, writer http.ResponseWriter) (*ri
 		cognitoIdentityPoolId:      cognitoIdentityPoolId,
 		clientContext:              clientContext,
 		responseMode:               request.Header.Get(invoke.ResponseModeHeader),
+		internalInvocationID:       uuid.New().String(),
 	}
 
 	return req, nil
@@ -184,3 +186,7 @@ func (r *rieInvokeRequest) UpdateFromInitData(initData interop.InitStaticDataPro
 func (r *rieInvokeRequest) FunctionVersionID() string {
 	return r.functionVersionID
 }
+
+func (r *rieInvokeRequest) InternalInvocationID() string {
+	return r.internalInvocationID
+}

internal/lambda-managed-instances/aws-lambda-rie/internal/invoke/rie_invoke_request_test.go

@@ -143,6 +143,7 @@ func TestNewRieInvokeRequest(t *testing.T) {
 			if tt.want.invokeID == "" {
 				tt.want.invokeID = got.invokeID
 			}
+			tt.want.internalInvocationID = got.internalInvocationID
 
 			assert.Equal(t, tt.want, got)
 		})

internal/lambda-managed-instances/interop/mock_invoke_request.go

@@ -143,6 +143,23 @@ func (_m *MockInvokeRequest) FunctionVersionID() string {
 	return r0
 }
 
+func (_m *MockInvokeRequest) InternalInvocationID() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for InternalInvocationID")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
 func (_m *MockInvokeRequest) InvokeID() string {
 	ret := _m.Called()
 

internal/lambda-managed-instances/interop/sandbox_model.go

@@ -302,6 +302,8 @@ type InvokeRequest interface {
 
 	UpdateFromInitData(InitStaticDataProvider) model.AppError
 	FunctionVersionID() string
+
+	InternalInvocationID() string
 }
 
 type InitStaticDataProvider interface {

internal/lambda-managed-instances/invoke/consts.go

@@ -9,6 +9,8 @@ const (
 	FunctionErrorBodyTrailer = "lambda-runtime-function-error-body"
 	ResponseModeHeader       = "invoke-response-mode"
 	TraceIdHeader            = "x-amzn-trace-id"
+
+	RuntimeInvocationIdHeader = "lambda-runtime-invocation-id"
 )
 
 type InvokeBodyResponseStatus string

internal/lambda-managed-instances/invoke/invoke_router.go

@@ -35,6 +35,8 @@ type RuntimeResponseRequest interface {
 	BodyReader() io.Reader
 
 	TrailerError() ErrorForInvoker
+
+	InvocationID() string
 }
 
 type RuntimeErrorRequest interface {
@@ -47,6 +49,8 @@ type RuntimeErrorRequest interface {
 	ReturnCode() int
 	ErrorDetails() string
 	GetXrayErrorCause() json.RawMessage
+
+	InvocationID() string
 }
 
 type runningInvoke interface {

internal/lambda-managed-instances/invoke/mock_runtime_error_request.go

@@ -171,6 +171,23 @@ func (_m *MockRuntimeErrorRequest) ReturnCode() int {
 	return r0
 }
 
+func (_m *MockRuntimeErrorRequest) InvocationID() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for InvocationID")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
 func NewMockRuntimeErrorRequest(t interface {
 	mock.TestingT
 	Cleanup(func())

internal/lambda-managed-instances/invoke/mock_runtime_response_request.go

@@ -122,6 +122,23 @@ func (_m *MockRuntimeResponseRequest) TrailerError() ErrorForInvoker {
 	return r0
 }
 
+func (_m *MockRuntimeResponseRequest) InvocationID() string {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for InvocationID")
+	}
+
+	var r0 string
+	if rf, ok := ret.Get(0).(func() string); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	return r0
+}
+
 func NewMockRuntimeResponseRequest(t interface {
 	mock.TestingT
 	Cleanup(func())

internal/lambda-managed-instances/invoke/running_invoke.go

@@ -68,6 +68,8 @@ type runningInvokeImpl struct {
 	invokeRespSender InvokeResponseSender
 	runtimeNext      http.ResponseWriter
 
+	internalInvocationID string
+
 	responderFactoryFunc ResponderFactoryFunc
 	sendInvokeToRuntime  func(context.Context, interop.InitStaticDataProvider, interop.InvokeRequest, http.ResponseWriter, string) (int64, time.Duration, time.Duration, model.AppError)
 	createTracingData    func(traceId string, tracingMode intmodel.XrayTracingMode, segmentIDGenerator func() string) (downstreamTraceId string, tracingCtx *interop.TracingCtx)
@@ -99,6 +101,8 @@ func newRunningInvoke(
 func (r *runningInvokeImpl) RunInvokeAndSendResult(ctx context.Context, initData interop.InitStaticDataProvider, invokeReq interop.InvokeRequest, metrics interop.InvokeMetrics) model.AppError {
 	downstreamTraceId, tracingCtx := r.createTracingData(invokeReq.TraceId(), initData.XRayTracingMode(), xray.GenerateSegmentID)
 
+	r.internalInvocationID = invokeReq.InternalInvocationID()
+
 	metrics.TriggerStartRequest()
 	if err := metrics.SendInvokeStartEvent(tracingCtx); err != nil {
 		logging.Error(ctx, "Failed to send InvokeStartEvent", "err", err)
@@ -290,11 +294,28 @@ func (r *runningInvokeImpl) RuntimeResponse(ctx context.Context, runtimeRespReq
 		return model.NewCustomerError(model.ErrorRuntimeInvokeResponseInProgress)
 	}
 
+	if echoedID := runtimeRespReq.InvocationID(); echoedID != "" && r.internalInvocationID != "" {
+		if echoedID != r.internalInvocationID {
+			logging.Warn(ctx, "Cross-wiring detected: invocation ID mismatch on response",
+				"expected", r.internalInvocationID, "received", echoedID)
+			r.responseState.CompareAndSwap(stateGotResponse, stateNoResponse)
+			return model.NewCustomerError(model.ErrorRuntimeInvokeTimeout)
+		}
+	}
+
 	r.runtimeResponseChan <- runtimeRespReq
 	return <-r.responseSentChan
 }
 
 func (r *runningInvokeImpl) RuntimeError(ctx context.Context, runtimeErrReq RuntimeErrorRequest) model.AppError {
+	if echoedID := runtimeErrReq.InvocationID(); echoedID != "" && r.internalInvocationID != "" {
+		if echoedID != r.internalInvocationID {
+			logging.Warn(ctx, "Cross-wiring detected: invocation ID mismatch on error",
+				"expected", r.internalInvocationID, "received", echoedID)
+			return model.NewCustomerError(model.ErrorRuntimeInvokeTimeout)
+		}
+	}
+
 	oldState := r.responseState.Swap(stateGotError)
 	if oldState == stateGotError {
 		logging.Warn(ctx, "Invalid invoke state : error in progress")