test(integ): expand harness config-shape coverage

[tejaskash]

Summary

Expands the harness integration test suite (integ-tests/add-remove-harness.test.ts) to cover the harness configuration surface that was previously untested at the integration layer. Follow-up to #1598, which made harness the default create path and brought the harness flows into the GA build.

All new cases are local — no AWS. They exercise the CLI flag → action → validate → spec-write wiring that schema unit tests don't reach.

Coverage added

• model: lite_llm (+--api-base/--additional-params), bedrock --api-format, plus api-format provider-gating rejections (open_ai/gemini)
• tools (add tool): remote_mcp, agentcore_code_interpreter, agentcore_gateway (awsIam), inline_function, plus required-config rejections
• skills (add skill): path / s3 / git (+auth credential)
• memory modes (gated): managed + strategies, existing-by-name + tuning, plus by-arn / no-ref / gated-off rejections
• truncation: summarization
• VPC network-mode validation (no deploy)
• CUSTOM_JWT inbound authorizer + missing-config rejection

Notes

• Fast by design. All cases share a single project (one create spawn instead of one per block) and rejection groups use it.each tables. Each runCLI is a real ~1.3s process spawn, so the suite is kept tight.
• No duplication. Pure schema refinements already covered by src/schema/schemas/primitives/__tests__/harness.test.ts (top-k / api-base provider gating, skill URI-scheme rejection) are intentionally not re-tested here.
• Out of scope: E2E additions (lite_llm deploy, harness-with-tool deploy, CUSTOM_JWT + fetch access) — tracked separately.

Testing

• vitest run --project integ integ-tests/add-remove-harness.test.ts → 35 passed (16 existing + 19 new).
• eslint, prettier, secretlint, and tsc --noEmit clean.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.20.2.tgz

How to install

gh release download pr-1608-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.2.tgz

[agentcore-cli-automation]

Tests are well-structured and pragmatically scoped — sharing one project, real CLI spawns, and it.each rejection tables strikes a good balance. One concern below worth addressing before merge.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	36.98%	13516 / 36546
🔵	Statements	36.25%	14369 / 39631
🔵	Functions	31.59%	2317 / 7334
🔵	Branches	30.76%	8905 / 28944

Generated in workflow #3755 for commit 26bb9e9 by the Vitest Coverage Report Action

[tejaskash]

Good catch — verified and fixed in 26bb9e9.

You're right on all three points: isGatedFeaturesEnabled() is a strict === '1', cleanSpawnEnv only strips AGENTCORE_TELEMETRY_DISABLED (not ENABLE_GATED_FEATURES), so the gated-off case inherited the host value and would flip if a shell/CI had it exported.

I went with option 1 (force the gate off for that one case via env: { ENABLE_GATED_FEATURES: '' }) rather than stripping it globally in cleanSpawnEnv. Reason: add-remove-config-bundle.test.ts:113 deliberately reads process.env.ENABLE_GATED_FEATURES to predict the spawned CLI's behavior — a global strip would make the CLI always-off while that test still computed expectedBranch='feature-branch' in a gated-on shell, breaking it. Option 1 is self-contained and touches no shared infra.

Verified the memory-modes block passes both with the gate unset and with ENABLE_GATED_FEATURES=1 exported (before the fix, the gated-off case failed in the latter).

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)