fix(amazon-bedrock-agentcore-mcp-server): expire cached browser clients to pick up refreshed credentials

[kevin-orellana]

Fixes stale-credential behavior in the AgentCore browser MCP server.

Summary

Changes

get_browser_client cached a BrowserClient per region at module level and never invalidated it. The wrapped boto3 clients resolve credentials at construction time, so a long-lived MCP server kept using the credentials captured at first use — after rotation (ada credentials update, IAM role rotation, expired STS session) every browser call failed until the process was restarted.

This change adds TTL-based cache expiry:

• Cache entries older than the TTL are discarded and rebuilt on the next call, forcing credential re-resolution
• Default TTL 300s, configurable via AGENTCORE_BROWSER_CLIENT_TTL_SECONDS; a non-positive value disables caching entirely
• Invalid TTL input logs a warning and falls back to the default
• Uses a monotonic clock, so wall-clock changes can't wedge the cache

User experience

Before: after credential rotation, browser tools return auth errors until the MCP server process is restarted.
After: within one TTL window (≤5 min by default) the client is rebuilt with fresh credentials automatically; no restart needed.

Checklist

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested — tests/browser/test_unit_browser_client.py: 11 passed, including the regression guard test_recreates_client_after_ttl_expiry (monotonic clock mocked past TTL asserts a second construction) and invalid-TTL fallback cases
• Changes are documented — CHANGELOG entry + module docstrings

Is this a breaking change? (N)

RFC issue number: N/A

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.04%. Comparing base (536db49) to head (355316d).
⚠️ Report is 73 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4369      +/-   ##
==========================================
- Coverage   93.05%   93.04%   -0.01%     
==========================================
  Files        1031     1031              
  Lines       86905    86928      +23     
  Branches    14019    14022       +3     
==========================================
+ Hits        80866    80886      +20     
  Misses       3658     3658              
- Partials     2381     2384       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.