chore: record merge point with main by notgitika · Pull Request #1237 · aws/agentcore-cli

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

notgitika · 2026-05-13T19:14:52Z

Records git merge ancestry so the sync-preview workflow knows main's commits are already incorporated (via squash-merged #1226). Also includes the workflow fix from #1235 (disambiguate sync-from-public branch checkout). Merge with 'Create a merge commit'.

Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key.

…sions to docs (#1113)

Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases)

Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY.

fix: bump versions to resolve security audit failure

…ient)

…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

* feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com>

…1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type

) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline

#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

After 'git remote add public' fetches the same branches that already exist on origin, 'git checkout <branch>' becomes ambiguous and fails with: fatal: 'preview' matched multiple (2) remote tracking branches Both sync jobs now use 'git checkout -B <branch> origin/<branch>' which explicitly resets the local branch from origin's tracking ref, removing the ambiguity and combining the previous 'checkout + reset --hard' into one step. Last 4 scheduled runs of 'Sync from Public Repo' all failed with this error; the workflow has been silently broken since the public/origin branches collided.

fix: disambiguate sync-from-public branch checkout

agentcore-cli-automation

LGTM — this is exactly what it claims to be: a no-op merge commit (tree identical to preview HEAD, parents = preview HEAD + main HEAD) that records ancestry between preview and main so the sync-preview workflow stops re-syncing main commits that are already incorporated via the squash-merge in #1226.

Verified:

git diff 99239f44..24dfc8e9 is empty (zero file changes)
Both parent trees resolve to the same SHA 698ddc51
Parents are preview tip (99239f44) and main tip (95032396)
This addresses the merge-base check in .github/workflows/sync-preview.yml which uses git merge-base HEAD origin/main to decide whether sync is needed

⚠️ Reminder (already in the PR description, but worth re-emphasizing because getting it wrong silently undoes the fix): this must be merged with "Create a merge commit". Squash-merging would collapse the two-parent commit into a single linear commit and lose the ancestry to main, putting us right back in the state #1226 left us in. If repo settings allow squash as the default, double-check the dropdown before clicking merge.

notgitika · 2026-05-13T19:17:17Z

wait I am making a change

agentcore-cli-automation

The previously-approved version of this PR was a clean no-op merge commit. Since then a second commit (e1dc74c1, "fix: disambiguate sync-from-public branch checkout") has been added that cherry-picks the fix from #1235, which changes the picture. Flagging two concerns inline.

To be clear: the cherry-picked workflow change itself is correct and matches what was already approved/merged into main in #1235. The concerns are about how it's being layered into this "record merge point" PR, and a stale ancestry reference that partially defeats the stated purpose.

github-actions · 2026-05-13T19:24:22Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.5%	10019 / 23029
🔵	Statements	42.77%	10647 / 24893
🔵	Functions	40.38%	1691 / 4187
🔵	Branches	40.24%	6501 / 16154

Generated in workflow #2922 for commit 3d9a8a4 by the Vitest Coverage Report Action

Hweinstockand others added 16 commits May 11, 2026 13:56

docs: add telemetry instrumentation guide (#1197)
340878c

fix: add batch eval, recommendation, and CloudWatch Logs write permis…
ce50d52
…sions to docs (#1113)

fix: bump versions to resolve security audit failure
f1788bc

Merge pull request#1211from Hweinstock/fix/old-deps
a15c756
fix: bump versions to resolve security audit failure

revert: keep pr-title.yml using GITHUB_TOKEN (read-only access suffic…
0e6d577
…ient)

Merge pull request#1210from aws/chore/replace-github-token-with-app…
6dc4b7f
…-token chore: replace all github.token/GITHUB_TOKEN with GitHub App token

feat: instrument telemetry for deploy command (CLI + TUI) (#1206)
ce00f57

Merge pull request#1235from aws/fix/sync-from-public-ambiguous-preview
9503239
fix: disambiguate sync-from-public branch checkout

github-actionsBot added the agentcore-harness-reviewing AgentCore Harness review in progress label May 13, 2026

agentcore-cli-automation approved these changes May 13, 2026
View reviewed changes

github-actionsBot removed the agentcore-harness-reviewing AgentCore Harness review in progress label May 13, 2026

notgitika closed this May 13, 2026

notgitika reopened this May 13, 2026

notgitika requested a review from a teamMay 13, 2026 19:17

github-actionsBot added the agentcore-harness-reviewing AgentCore Harness review in progress label May 13, 2026

notgitika force-pushed the fix/record-merge-point-v2 branch from 4a40c0c to e1dc74cCompare May 13, 2026 19:18

chore: record merge point with main (synced via#1226)
60872bc

notgitika force-pushed the fix/record-merge-point-v2 branch from e1dc74c to 60872bcCompare May 13, 2026 19:19

fix: disambiguate sync-from-public branch checkout (#1235)
3d9a8a4

agentcore-cli-automation suggested changes May 13, 2026
View reviewed changes

Comment thread.github/workflows/sync-from-public.yml
Comment thread.github/workflows/sync-from-public.yml

github-actionsBot removed the agentcore-harness-reviewing AgentCore Harness review in progress label May 13, 2026

notgitika requested a review from agentcore-cli-automation May 13, 2026 19:24

tejaskash approved these changes May 13, 2026
View reviewed changes

notgitika merged commit 53928e7 into previewMay 13, 2026
19 checks passed

notgitika deleted the fix/record-merge-point-v2 branch May 13, 2026 20:44