exec: --runtime <arn> requires --region, and otherwise demands a project + aws-targets.json + a deploy

[notgitika]

What happened

agentcore exec --runtime <full-arn> fails outside an AgentCore project unless --region is also passed:

$ agentcore exec --it --runtime arn:aws:bedrock-agentcore:us-east-1:111122223333:runtime/MyRuntime-abc123 --session-id <id>
AWS Targets config file not found at: /path/to/cwd/agentcore/aws-targets.json

Adding --region us-east-1 to the identical command in the identical directory clears the error entirely, so the region is the only thing missing — and it is already field 3 of the ARN that was just supplied.

Working around it by creating the config produces a chain of further walls, none of which exec actually needs:

1. AWS Targets config file not found at: .../agentcore/aws-targets.json
2. after creating that → State config file not found at: .../agentcore/.cli/deployed-state.json
3. with an empty state file → No deployed targets found. Run 'agentcore deploy' first.

Net effect: to exec against a runtime you already have the ARN for, the CLI demands you create a project, hand-write aws-targets.json, and complete a deploy through this CLI. That rules out exec for anyone whose runtimes are deployed by CDK, a pipeline, or a personal stack — i.e. the CLI cannot be adopted for exec alone.

Root cause

loadExecContext in src/cli/commands/exec/action.ts. The "explicit ARN, skip deployed state" short-circuit is gated on both flags:

if (options.runtimeArn?.startsWith('arn:') && options.region) {
  return assertInteractiveHarnessUnsupported(options, { region: options.region, runtimeArn: options.runtimeArn });
}

Without --region it falls through to readAWSDeploymentTargets() / readDeployedState(), which throw before anything else runs. The --harness <arn> short-circuit a few lines below has the identical gate.

There is already a branch labelled "--runtime <arn> with no --region" further down, but it sits after the config reads and only uses config for options.region ?? targetConfig.region — a value the ARN already carries. So the config reads exist purely to recover something the caller supplied.

exec --help gives no hint either; it lists --region <region> AWS region as though optional.

Expected

A full ARN should resolve with no project and no config on disk. Only a name should need deployed state.

Fix

Derive the region from ARN field 3 and drop the && options.region conjunct from both short-circuits, so config is read only when a name has to be resolved. A region-less or malformed ARN should still fall through to config as a last resort.

PR: #1996