[DO NOT MERGE] Feat/harness implementation

.github/workflows/codeql.yml

@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
+      actions: read
       security-events: write
       contents: read
 

.github/workflows/e2e-tests-full.yml

@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'main' }}
+          ref: main
       - uses: actions/setup-node@v6
         with:
           node-version: '20.x'
@@ -49,7 +49,7 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        uses: aws-actions/aws-secretsmanager-get-secrets@v2
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}

.github/workflows/e2e-tests.yml

@@ -73,7 +73,7 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        uses: aws-actions/aws-secretsmanager-get-secrets@v2
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}

.github/workflows/slack-issue-notification.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send issue details to Slack
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@v2.1.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
           webhook-type: webhook-trigger

.github/workflows/slack-open-prs-notification.yml

@@ -40,7 +40,7 @@ jobs:
             );
 
       - name: Send open PRs summary to Slack
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@v2.1.1
         with:
           webhook: ${{ secrets.SLACK_OPEN_PRS_WEBHOOK_URL }}
           webhook-type: webhook-trigger

.github/workflows/sync-from-public.yml

@@ -0,0 +1,104 @@
+name: Sync from Public Repo
+
+on:
+  schedule:
+    - cron: '0 */6 * * *' # Every 6 hours
+  workflow_dispatch: # Manual trigger via Actions tab
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch public main
+        run: |
+          git remote add public https://github.com/aws/agentcore-cli.git
+          git fetch public main
+
+      - name: Sync main with public/main
+        run: |
+          git checkout main
+          git reset --hard origin/main
+
+          # Check if public/main is already merged
+          if git merge-base --is-ancestor public/main HEAD; then
+            echo "✅ main is already up to date with public/main"
+            exit 0
+          fi
+
+          # Merge but exclude .github/workflows/ (GITHUB_TOKEN lacks workflow permission)
+          if git merge public/main --no-commit --no-ff; then
+            git checkout HEAD -- .github/workflows/ 2>/dev/null || true
+            git commit -m "chore: sync main with public/main"
+            git push origin main
+            echo "✅ main synced successfully"
+          else
+            echo "⚠️  Conflict detected in main"
+
+            # Capture conflicted files before aborting
+            conflicted_files=$(git diff --name-only --diff-filter=U 2>/dev/null || echo "Unable to determine conflicted files")
+            git merge --abort
+
+            # Check if a sync PR already exists
+            existing_pr=$(gh pr list --base "main" --search "Merge public/main" --state open --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+            if [ -n "$existing_pr" ]; then
+              echo "ℹ️  PR #$existing_pr already exists, skipping"
+              exit 0
+            fi
+
+            conflict_branch="sync-conflict-main-$(date +%Y%m%d-%H%M%S)"
+            git checkout -b "$conflict_branch"
+
+            git merge public/main --no-commit --no-ff || true
+            git checkout HEAD -- .github/workflows/ 2>/dev/null || true
+            git add -A
+            git commit -m "chore: sync main with public/main (conflicts present)
+
+          This automated sync detected merge conflicts that require manual resolution.
+
+          Source: public/main (https://github.com/aws/agentcore-cli)
+          Target: main
+
+          Please resolve conflicts and merge this PR." || true
+
+            git push origin "$conflict_branch"
+
+            gh pr create \
+              --title "🔀 [Sync Conflict] Merge public/main → main" \
+              --body "## Automated Sync Conflict
+
+          This PR was automatically created because merging \`public/main\` into \`main\` encountered conflicts.
+
+          **Source:** \`main\` from [aws/agentcore-cli](https://github.com/aws/agentcore-cli)
+          **Target:** \`main\`
+
+          ### Action Required
+          1. \`git fetch origin && git checkout $conflict_branch\`
+          2. Resolve merge conflicts
+          3. \`git add . && git commit\`
+          4. \`git push origin $conflict_branch\`
+          5. Merge this PR
+
+          ### Files with Conflicts
+          \`\`\`
+          $conflicted_files
+          \`\`\`" \
+              --base "main" \
+              --head "$conflict_branch" || echo "⚠️  Failed to create PR"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -2,6 +2,102 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.0-preview.1.0] - 2026-04-22
+
+### Added
+- feat: upgrade @aws/agentinspector to 0.2.0 (#919) (35ec0c1)
+- feat: remove inline_function tool approval — all tools execute automatically (#119) (06deb79)
+- feat: make update command aware of preview dist-tag (#118) (b8691c3)
+- feat: add Custom JWT inbound auth support for harnesses (#109) (54b3f4e)
+- feat: skip deploy when project config unchanged (#111) (fc764a6)
+- feat: add --with-invoke-script and tools in TUI wizard (#105) (25466d3)
+- feat: auto-deploy resources before dev server starts (#101) (202b7e9)
+- feat: add session storage support for harnesses (#102) (c1d97f8)
+- feat: add tool management commands for harnesses (#100) (26ea7b1)
+- feat: add --harness support to traces and logs commands (#98) (765f9d5)
+- feat: display harnesses in status screen (#96) (7a5305c)
+- feat: add session filesystem storage support (#893) (b97e337)
+- feat: add container support to harness create/add (#93) (10d8dd8)
+- feat: add harness validation to validate command (#91) (08e4f2f)
+- feat: add harness invoke support to CLI and TUI (#89) (c87c8af)
+- feat: harness create/add with deploy and bug fixes (#90) (e77dc2d)
+- feat: harness deploy support (#87) (cf762bd)
+- feat: add shared SigV4 API client and Harness HTTP operations (#84) (89fed85)
+- feat: add sync workflow (d15ce2e)
+
+### Fixed
+- fix: update asset snapshots and fix useDevDeploy skip test (#921) (1bde086)
+- fix: use nullish coalescing operator in CreateScreen (#918) (e850c9e)
+- fix: revert vended CDK dep to ^0.1.0-alpha.19 (#910) (34b41e7)
+- fix: show tools in harness review screen and wire up invoke --tools (#127) (7889e84)
+- fix: align harness networkConfiguration with Smithy model (#126) (5f6f98c)
+- fix: align harness model config with Smithy API and add invoke overrides (#122) (34b7639)
+- fix: harness bug bash fixes — status duplicate, provider names, session storage, fetch access (#123) (3115e02)
+- fix: avoid double JSON parse in harness invocation, extract parseToolResponseRequest (#125) (969cfe6)
+- fix: add deploy hash check to CLI deploy path (#120) (4fe3ab7)
+- fix: harness add bugs - no deploy, project name prefix, interactive mode (#116) (1c74d43)
+- fix: auto-populate aws-targets.json on dev deploy (#117) (df03fe5)
+- fix: harness TUI copy and usability improvements (#113) (ddfbfdb)
+- fix: add harness to TUI remove flow and CLI status output (#112) (5d625a5)
+- fix: TUI deploy not persisting deployed state (#110) (c2e206e)
+- fix: add default memory strategies to harness memory creation (#108) (d9d1f81)
+- fix: harness deploy bugfixes and model update (#99) (47882d0)
+- fix: propagate sessionId as A2A contextId in Inspector proxy (#892) (08d452e)
+- fix: make harnesses field optional in AgentCoreProjectSpec (#86) (62c432c)
+- fix: codeql permissions (05258f3)
+- fix: only sync to main branch (2acb841)
+- fix: formatting (7d35986)
+
+### Documentation
+- docs: add harness documentation and fix inline_function help text (#124) (1a1de9b)
+
+### Other Changes
+- chore: bump version to 1.0.0-preview.0 and pin agentcore-cdk to alpha.20 (#128) (2c42299)
+- Move Memory out of Advanced settings in harness wizard (#121) (5917220)
+- removing bad files (971004c)
+- fix(tui): polish harness wizard ordering, help text, and summary (#115) (dd2c8b1)
+- avi harness progress (#114) (aa4e8b9)
+- Merge origin/feat/harness-implementation and fix eslint errors (2ea3b6b)
+- Merge remote-tracking branch 'origin/main' into feat/harness-implementation (5046f61)
+- chore: sync main with public/main (7e836e4)
+- fix(invoke): pass session ID to local invoke log files (#894) (e966cb6)
+- chore(schema): regenerate JSON schema with harnesses registry (902c95c)
+- feat(schema): add harnesses[] registry to AgentCoreProjectSpec (9eab540)
+- chore: sync main with public/main (49932f2)
+- feat(schema): add Harness primitive schema definitions (#85) (9151a14)
+- chore: sync main with public/main (c5e80ca)
+- chore: sync main with public/main (d3ad7f8)
+- chore: sync main with public/main (874814a)
+- chore: sync main with public/main (7877ead)
+- chore: sync main with public/main (eeb444c)
+- chore: sync main with public/main (ff86dc1)
+- chore: sync main with public/main (50b389a)
+- chore: sync main with public/main (b1f9711)
+- chore: sync main with public/main (5d4bd38)
+- chore: sync main with public/main (e9ab06e)
+- chore: sync main with public/main (08872f5)
+- chore: sync main with public/main v0.8.0 (63e05fd)
+- chore: sync main with public/main (493e1f9)
+- chore: sync main with public/main (5af06f5)
+- chore: sync main with public/main (832a5c3)
+- chore: sync main with public/main (584fd0e)
+- fix(ci): exclude .github/workflows/ from public repo sync (#54) (37a0ff8)
+- Merge remote-tracking branch 'public/main' (d3f6c81)
+- chore: sync main with public/main (c2121ec)
+- chore: sync main with public/main (d0c495f)
+- chore: sync main with public/main (93d7bbc)
+- chore: sync main with public/main (cfd1cdb)
+- Merge remote-tracking branch 'origin/main' (ee71ff3)
+- chore: sync main with public/main (4c2c674)
+- chore: sync main with public/main (1d64fd8)
+- chore: sync main with public/main (11ec86e)
+- chore: sync main with public/main (6054e95)
+- chore: sync main with public/main (cc83d81)
+- chore: sync main with public/main (1a361af)
+- Merge remote-tracking branch 'public/main' (c2bef91)
+- chore: sync main with public/main (c6099d4)
+- Merge pull request #1 from aws/aalpert/workflow (216140f)
+
 ## [0.9.1] - 2026-04-17
 
 ## [0.9.0] - 2026-04-17

create-bundle.mjs

@@ -0,0 +1,53 @@
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { SignatureV4 } from '@aws-sdk/signature-v4';
+import { randomUUID } from 'crypto';
+
+const region = 'us-east-1';
+const endpoint = `https://gamma.${region}.elcapcp.genesis-primitives.aws.dev`;
+
+const body = JSON.stringify({
+  bundleName: 'test_rec_bundle',
+  description: 'Test bundle for recommendation',
+  clientToken: randomUUID(),
+  components: {
+    ['arn:aws:bedrock-agentcore:us-east-1:998846730471:runtime/myproject_MyAgent-QMd093Gl4O']: {
+      configuration: {
+        system_prompt: 'You are a helpful assistant that helps users.',
+        modelId: 'anthropic.claude-sonnet-4-20250514',
+      },
+    },
+  },
+  branchName: 'mainline',
+  commitMessage: 'Initial version for rec test',
+});
+
+const signer = new SignatureV4({
+  credentials: defaultProvider(),
+  region,
+  service: 'bedrock-agentcore-control',
+  sha256: Sha256,
+});
+
+const url = new URL('/configuration-bundles/create', endpoint);
+const request = {
+  method: 'POST',
+  hostname: url.hostname,
+  path: url.pathname,
+  headers: {
+    'content-type': 'application/json',
+    host: url.hostname,
+  },
+  body,
+};
+
+const signed = await signer.sign(request);
+const resp = await fetch(`${endpoint}/configuration-bundles/create`, {
+  method: 'POST',
+  headers: signed.headers,
+  body,
+});
+
+const data = await resp.text();
+console.log(`Status: ${resp.status}`);
+console.log(data);