feat(project): implement add functionality. by Hweinstock · Pull Request #2004 · aws/agentcore-cli

Hweinstock · 2026-08-14T19:51:16Z

Problem

Add functionality is not implemented.

Solution

nest project spec attributes within spec so project.managedBy becomes project.spec.managedBy to make updating the spec more ergonomic. We keep name at the top level.
implement add for harness using the generator pattern (will be more relevant for runtime).
swap to a discriminated union vs a flag config for more ergonomic typing. This allows a single parameter, and allows TS to fully infer the shape.

Testing

added unit tests that verify all the flags work as expected.
tested e2e by creating a project and adding a harness.

codecov-commenter · 2026-08-14T19:53:52Z

Codecov Report

❌ Patch coverage is 99.29078% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 97.03%. Comparing base (01eb60b) to head (05f3268).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/core/project/templates.ts	95.45%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2004      +/-   ##
============================================
+ Coverage     97.01%   97.03%   +0.02%     
============================================
  Files           368      368              
  Lines         21630    21745     +115     
============================================
+ Hits          20984    21100     +116     
+ Misses          646      645       -1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Hweinstock · 2026-08-14T20:47:42Z

 // endpoint, ...).
 export interface AwsClients {
-  control(config: ClientConfig): BedrockAgentCoreControlClient
+  control(config: ClientConfig): BedrockAgentCoreControlClient;


perhaps a rebase issue, but this is failing ci on main https://github.com/aws/agentcore-cli/actions/runs/31832012548/job/94869692163.

Hweinstock · 2026-08-14T20:47:48Z

 const RESULT: EvaluateResult = {
  sessionsRequested: 1,
  sessionsEvaluated: 1,
-  results: [{ evaluatorId: "Builtin.Helpfulness", value: 0.9 } as EvaluateResult["results"][number]],


same as above.

Hweinstock · 2026-08-14T20:48:28Z

+      resourceConfig: z.input<typeof HarnessSpecSchema>;
+    }
+  | {
+      resourceType: "runtime";


added runtime just to start the pattern.

tejaskash

I found a few cases where the new add path reports success but writes a project that will not behave as requested. I left the details inline.

tejaskash · 2026-08-14T21:14:40Z

+      case "harness": {
+        yield { message: `Scaffolding harness in project` };
+        const harnessPath = await this.scaffoldHarness(project.rootPath, input.resourceConfig);
+        newResources.push({ name: input.resourceConfig.name, path: harnessPath });


Could we keep this path relative to the project root? scaffoldHarness returns an absolute path, so this writes the developer's local path into agentcore.json. It works on that machine, but after the project is moved or cloned, CDK still tries to read the old path. Writing app/${name} here would match the existing project format and keep the project portable.

good catch, let me swap that to the relative path.

tejaskash · 2026-08-14T21:14:40Z

+  spec: z.input<typeof HarnessSpecSchema>,
+): Promise<FsTreeNode> {
+  return FsTreeNode.createDirectory(".", [
+    FsTreeNode.createFile("harness.json", async () => json(HarnessSpecSchema.parse(spec))),


I think the Dockerfile needs to be handled as part of this scaffold too. Right now --dockerfile only puts the filename in harness.json; this tree creates harness.json and system-prompt.md, but never copies the Dockerfile into app/<harness>. The command succeeds, then CDK uses this directory as the build context and cannot find the file. Can we validate and copy the source Dockerfile here, and store its basename like the existing CLI does?

wasn't aware thats how it worked, but that makes sense since it keeps the project portable. let me add that.

tejaskash · 2026-08-14T21:14:40Z

-        harnessConfig,
-      )) {
+      for await (const event of config.projectManager.addResource(project, {
+        resourceType: "harness",


One part of the requested tool configuration gets lost before this call. For an agentcore_gateway tool, toTool copies gatewayArn but drops outboundAuth. For example, asking for { none: {} } produces a harness config with no outbound auth, which changes the behavior back to the default AWS IAM mode. Could we preserve the awsIam, none, and oauth variants?

Yeah I think @notgitika spotted the same in #1998 (comment). Was going to address as follow-up, but let me bring in here.

tejaskash · 2026-08-14T21:14:40Z

-      )) {
+      for await (const event of config.projectManager.addResource(project, {
+        resourceType: "harness",
+        resourceConfig: harnessConfig,


Private Git skill auth has a field mismatch here. The SDK input gives us a credentialArn, but toSkill writes that value into credentialName. During synth, CDK treats credentialName as a project credential key, so it cannot resolve the ARN-shaped value and deployment fails. Could we either accept a project credential name for this project command, or carry the ARN separately instead of renaming it?

I think adding it as a new field makes sense (with them being mutually exclusive). That allows us to support credentials from outside the project with minimal extra effort. We can comeback to supporting credentialName since its already in the schema.

tejaskash · 2026-08-14T21:14:40Z

-        "harness",
-        harnessConfig,
-      )) {
+      for await (const event of config.projectManager.addResource(project, {


There is currently no way to add a Dockerfile-backed harness in VPC mode. The environment conversion carries subnets and security groups, but the harness schema also requires networkConfig.vpcId for Dockerfile builds, and this handler has no --vpc-id input. The command always fails validation for that combination. Could we add an explicit VPC ID option and thread it into the resource config?

wow great edge case find, was not aware vpc id was required with VPC + docker. Let me add the explicit flag for this and make it clear.

tejaskash · 2026-08-14T21:14:40Z

+        newResources.push({ name: input.resourceConfig.name, path: harnessPath });
+        break;
+      }
+      // TODO: add limited special casing for runtime and default for other resources that proxy directly to spec changes.


Could we either implement the runtime branch here or leave runtime out of AddResourceInput for now? At the moment a runtime call falls through this switch, emits the Updating project spec message, writes the unchanged runtime list, and returns successfully. That silent success will be hard for callers to diagnose.

I think that's fine right? assuming we are implementing add runtime right after this.

Going to be the next PR, but understand the current behavior is confusing. I'll have it throw early.

notgitika · 2026-08-14T21:42:07Z

+  return FsTreeNode.createDirectory(".", [
+    FsTreeNode.createFile("harness.json", async () => json(HarnessSpecSchema.parse(spec))),
+    FsTreeNode.createFile(
+      "system-prompt.md",


are we making the changes on the cdk side as well? resolveSystemPrompt() on there uses the inline systemPrompt first and onlyl reads system-prompt.md when that field is absent. so there are these 2 input sources. did we want that behavior to still exist?

what we are losing here is that there is no way a user will be warned if they make changes in their local md file here if they don't update the value from harness.json.

oh, good callout, was not aware of that behavior. I feel like having two sources of system prompts might be unnecessary and confusing if we scaffold a system-prompt.md for them so I think stripping the system prompt field from the json to maintain backwards compatibility, and treat the file as source of truth might be the simplest path forward.

notgitika · 2026-08-14T21:44:54Z

+    }
+
+    yield { message: `Updating project spec file at '${agentCoreSpecPath}'` };
+    const newProjectSpec = await this.json.write(agentCoreSpecPath, {


so the order of operations here is:
create harness.json -> create system-prompt.md -> update agentcore.json

if the write fails, the harness files remain and retrying would fail because it "already exists". can we add some cleanup to address this edge case?

…redentials

…e edgecase

…e of truth

Hweinstock added 6 commits August 13, 2026 18:45

feat(project): implement add harness scaffolding

7dc2d57

chore: merge in refactor branch

b575a30

refactor(test): clean up tests

bb093ca

refactor(project): rename add to addResource

d9138cd

feat(project): implement full add functionality for harness

53f7b5d

chore: merge in refactor

a80d21c

github-actions Bot added the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 14, 2026

github-actions Bot removed the agentcore-harness-reviewing AgentCore Harness review in progress label Aug 14, 2026

feat(project): finish add implementation

efd9c85

Hweinstock changed the title ~~feat(project): implement core add functionality.~~ feat(project): implement add functionality. Aug 14, 2026

refactor(proj): config --> spec

8025178

Hweinstock commented Aug 14, 2026

View reviewed changes

Hweinstock marked this pull request as ready for review August 14, 2026 20:48

Hweinstock requested review from notgitika and tejaskash August 14, 2026 21:13

tejaskash reviewed Aug 14, 2026

View reviewed changes

Hweinstock added 2 commits August 14, 2026 21:31

fix(proj): fail runtime early

fae3141

fix(proj): swap to relative path for harness.json path reference

77b169a

notgitika requested changes Aug 14, 2026

View reviewed changes

Hweinstock added 8 commits August 14, 2026 21:51

feat(proj): wire up dockerfile support

8722d84

fix(proj): wire in gateway outbound auth

ec740c6

feat(schemas): add credentialArn for harness skills for non-project c…

98c9fd8

…redentials

fix(harness): add flag for explicit vpc id to support vpc + dockerfil…

ee86add

…e edgecase

feat(proj): handle partial failures of harnesss scaffolding

10d631a

fix(harness): strip system prompt from config to ensure file is sourc…

22444ca

…e of truth

fix(test): use path module to build path for windows support

52c734c

test(harness): add case for unrecognized add flags

05f3268

Uh oh!

Conversation

Hweinstock commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Testing

Uh oh!

codecov-commenter commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tejaskash left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hweinstock Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hweinstock Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Hweinstock Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Hweinstock commented Aug 14, 2026 •

edited

Loading

codecov-commenter commented Aug 14, 2026 •

edited

Loading

Hweinstock Aug 14, 2026 •

edited

Loading

Hweinstock Aug 14, 2026 •

edited

Loading

Hweinstock Aug 15, 2026 •

edited

Loading