agentcore-cli 0.31.1__py3-none-any.whl

agentcore/primitives/_harness_wizard.py

@@ -0,0 +1,726 @@
+"""Interactive add-harness wizard: prompt-based port of tui/screens/harness (AddHarnessScreen,
+useAddHarnessWizard, AddHarnessFlow).
+
+Step order (upstream ``allSteps``): name -> model provider -> API format (bedrock/open_ai) -> API key
+ARN (non-bedrock) -> API base + additional params (lite_llm) -> custom environment (+ URI/Dockerfile)
+-> memory mode (+ existing reference) -> advanced settings -> tools -> skills -> auth -> network ->
+memory tuning -> allowed tools -> lifecycle -> execution & sampling -> truncation -> filesystem
+storage -> confirm.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import TYPE_CHECKING, Any
+
+import typer
+
+from agentcore.cli import interactive
+from agentcore.cli.commands.add._common import first_issue
+from agentcore.cli.commands.shared.arn_utils import ARN_VALIDATION_MESSAGE, is_valid_arn
+from agentcore.cli.errors import get_error_message
+from agentcore.cli.naming import generate_unique_name
+from agentcore.lib.schemas.io.config_io import ConfigIO, to_jsonable
+from agentcore.operations.deploy.managed_memory_notice import MANAGED_MEMORY_ADD_NOTICE
+from agentcore.primitives.credential_utils import compute_managed_oauth_credential_name
+
+if TYPE_CHECKING:
+    from agentcore.primitives.harness import HarnessPrimitive
+
+C = interactive.Choice
+
+MODEL_PROVIDER_OPTIONS = (
+    ("bedrock", "Amazon Bedrock", "Default: global.anthropic.claude-sonnet-4-6"),
+    ("open_ai", "OpenAI", "Default: gpt-5 (requires API key ARN)"),
+    ("gemini", "Google Gemini", "Default: gemini-2.5-flash (requires API key ARN)"),
+    ("lite_llm", "LiteLLM", "Default: anthropic/claude-sonnet-4-5 (API key ARN optional)"),
+)
+BEDROCK_API_FORMAT_OPTIONS = (
+    ("converse_stream", "Converse Stream", "Standard Bedrock Converse API (default)"),
+    ("responses", "Responses", "OpenAI Responses API via Bedrock Mantle"),
+    ("chat_completions", "Chat Completions", "OpenAI Chat Completions API via Bedrock Mantle"),
+)
+OPENAI_API_FORMAT_OPTIONS = (
+    ("responses", "Responses", "OpenAI Responses API (default)"),
+    ("chat_completions", "Chat Completions", "OpenAI Chat Completions API"),
+)
+TRUNCATION_STRATEGY_OPTIONS = (
+    ("sliding_window", "Sliding window", "Keep most recent messages"),
+    ("summarization", "Summarization", "Compress older context"),
+    ("none", "None", "Disable truncation"),
+)
+ADVANCED_SETTING_OPTIONS = (
+    ("tools", "Tools", "Add browser, code interpreter, MCP, or gateway tools"),
+    ("skills", "Skills", "Add agent skills"),
+    ("memory-managed-tuning", "Memory tuning", "Managed memory: strategies, event retention, encryption key"),
+    (
+        "memory-existing-tuning",
+        "Memory tuning",
+        "Existing memory: actor ID, messages count, retrieval (topK, relevance)",
+    ),
+    ("allowed-tools", "Allowed tools", "Restrict which tools the agent may invoke"),
+    ("auth", "Authentication", "Inbound auth: AWS_IAM or Custom JWT"),
+    ("network", "Network", "Deploy inside a VPC with custom subnets and security groups"),
+    ("lifecycle", "Lifecycle", "Set idle timeout and max session lifetime"),
+    ("execution", "Execution & sampling", "Cap iterations, tokens, timeout; tune temperature, topP, topK"),
+    ("truncation", "Truncation", "Choose how context is managed when it exceeds limits"),
+    (
+        "session-storage",
+        "Filesystem Storage",
+        "Mount session storage, EFS, or S3 Files persistent storage (requires VPC)",
+    ),
+)
+MEMORY_MODE_OPTIONS = (
+    ("disabled", "No memory", "Default"),
+    ("managed", "Managed", "AgentCore creates and manages memory for this harness"),
+    ("existing", "Existing", "Reference an existing memory by name or ARN"),
+)
+MANAGED_STRATEGY_OPTIONS = (
+    ("SEMANTIC", "Semantic", "Extract and retrieve semantic facts"),
+    ("SUMMARIZATION", "Summarization", "Summarize conversation history"),
+    ("USER_PREFERENCE", "User preference", "Track user preferences"),
+    ("EPISODIC", "Episodic", "Recall past episodes/sessions"),
+)
+CONTAINER_MODE_OPTIONS = (
+    ("none", "Default Environment", "Includes Python, Bash, File tools"),
+    ("uri", "Container URI", "Use a pre-built container image (ECR URI)"),
+    ("dockerfile", "Dockerfile", "Bring your own Dockerfile"),
+)
+TOOL_SELECT_OPTIONS = (
+    ("agentcore_browser", "AgentCore Browser", "Web browsing and automation"),
+    ("agentcore_code_interpreter", "AgentCore Code Interpreter", "Sandboxed code execution"),
+    ("agentcore_gateway", "AgentCore Gateway", "Connect via gateway"),
+    ("remote_mcp", "Remote MCP Server", "Connect to an MCP server"),
+)
+NETWORK_MODE_OPTIONS = (("PUBLIC", "Public", "Internet-facing"), ("VPC", "VPC", "Deploy within a VPC"))
+AUTHORIZER_TYPE_OPTIONS = (
+    ("AWS_IAM", "AWS IAM", "Use AWS IAM authentication (default)"),
+    ("CUSTOM_JWT", "Custom JWT", "Use a custom JWT authorizer (OIDC)"),
+)
+GATEWAY_OUTBOUND_AUTH_OPTIONS = (
+    ("awsIam", "AWS IAM (default)", "SigV4 signing with the harness execution role"),
+    ("none", "None", "No authentication headers"),
+    ("oauth", "OAuth", "Bearer token via AgentCore Identity credential provider"),
+)
+SKILL_SOURCE_TYPE_OPTIONS = (
+    ("path", "Path", "Path to an installed skill in the environment"),
+    ("s3", "S3", "S3 URI (s3://bucket/path)"),
+    ("git", "Git", "HTTPS git repository URL"),
+    ("aws_skills", "AWS Skills", "Built-in AWS skills (github.com/aws/agent-toolkit-for-aws/tree/main/skills)"),
+)
+
+SUBNET_ID_PATTERN = re.compile(r"^subnet-[0-9a-zA-Z]{8,17}$")
+SECURITY_GROUP_ID_PATTERN = re.compile(r"^sg-[0-9a-zA-Z]{8,17}$")
+_ALLOWED_TOOL = re.compile(r"^(\*|@?[^/]+(/[^/]+)?)$")
+
+
+def _choices(options: tuple[tuple[str, str, str], ...]) -> list[interactive.Choice]:
+    return [C(title, value, description) for value, title, description in options]
+
+
+def _title(options: tuple[tuple[str, str, str], ...], value: str) -> str:
+    return next((t for v, t, _ in options if v == value), value)
+
+
+def _js_int(value: str) -> int | None:
+    """``parseInt(value, 10)``; None for NaN."""
+    match = re.match(r"^\s*([+-]?\d+)", value)
+    return int(match.group(1)) if match else None
+
+
+def _js_float(value: str) -> float | None:
+    """``parseFloat(value)``; None for NaN."""
+    match = re.match(r"^\s*([+-]?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?)", value)
+    return float(match.group(1)) if match else None
+
+
+def _num(value: float | None) -> float | int | None:
+    return int(value) if isinstance(value, float) and value.is_integer() else value
+
+
+def _csv(value: str) -> list[str]:
+    return [s.strip() for s in value.split(",") if s.strip()]
+
+
+def _validate_id_list(value: str, pattern: re.Pattern[str], label: str, example: str) -> str | None:
+    ids = _csv(value)
+    if not ids:
+        return f"At least one {label} is required for VPC mode"
+    bad = next((i for i in ids if not pattern.match(i)), None)
+    return f'Invalid {label} "{bad}" (expected e.g. {example})' if bad else None
+
+
+def _err(check: Any) -> str | None:
+    return None if check is True else check
+
+
+def _int_range(lo: int, hi: int, message: str, optional: bool = False):  # type: ignore[no-untyped-def]
+    def validate(value: str) -> str | None:
+        if optional and value.strip() == "":
+            return None
+        n = _js_int(value)
+        return None if n is not None and lo <= n <= hi else message
+
+    return validate
+
+
+def _float_range(lo: float, hi: float, message: str):  # type: ignore[no-untyped-def]
+    def validate(value: str) -> str | None:
+        if value.strip() == "":
+            return None
+        n = _js_float(value)
+        return None if n is not None and lo <= n <= hi else message
+
+    return validate
+
+
+def _json_object_validator(kind: str, string_values: bool = False):  # type: ignore[no-untyped-def]
+    def validate(value: str) -> str | None:
+        trimmed = value.strip()
+        if not trimmed:
+            return None
+        try:
+            parsed = json.loads(trimmed)
+        except ValueError:
+            return f"{kind} must be valid JSON"
+        if not isinstance(parsed, dict):
+            return f"{kind} must be a JSON object"
+        if string_values:
+            for k, v in parsed.items():
+                if not isinstance(v, str):
+                    return f'Header "{k}" value must be a string'
+        return None
+
+    return validate
+
+
+def _project() -> dict[str, Any]:
+    try:
+        io = ConfigIO()
+        if io.has_project():
+            return to_jsonable(io.read_project_spec())
+    except Exception:  # noqa: BLE001
+        pass
+    return {}
+
+
+def _prompt_mounts(kind: str, maximum: int, arn_validator: Any, network_mode: str | None) -> list[dict[str, str]]:
+    from agentcore.cli.commands.shared.filesystem_utils import validate_byo_mount_path
+
+    if network_mode != "VPC":
+        typer.echo(f"⚠ {kind} mounts require VPC network mode. Press Enter to skip or Esc to go back.")
+    example = "/mnt/efs-data" if kind == "EFS" else "/mnt/s3-data"
+    mounts: list[dict[str, str]] = []
+    while len(mounts) < maximum:
+
+        def validate_arn(value: str) -> str | None:
+            if not value:
+                return None
+            if network_mode != "VPC":
+                return f"{kind} mounts require VPC network mode"
+            return _err(arn_validator(value))
+
+        arn = interactive.text(
+            f"{kind} access point ARN {len(mounts) + 1}/{maximum} (press Enter to skip):", validate=validate_arn
+        ).strip()
+        if not arn:
+            break
+        path = interactive.text(
+            f"{kind} mount path for ...{arn[-20:]} (e.g. {example}):",
+            validate=lambda v: _err(validate_byo_mount_path(v)),
+        )
+        mounts.append({"accessPointArn": arn, "mountPath": path})
+        if len(mounts) >= maximum or not interactive.confirm(f"Add another {kind} mount?", default=False):
+            break
+    return mounts
+
+
+def _prompt_skills(api_key_credentials: list[str]) -> list[dict[str, Any]]:
+    skills: list[dict[str, Any]] = []
+    while True:
+        source = interactive.select(
+            "Skill source type (Where is your skill located?)", _choices(SKILL_SOURCE_TYPE_OPTIONS)
+        )
+        if source == "path":
+            path = interactive.text(
+                "Path to an installed skill in the environment",
+                validate=lambda v: None if v.strip() else "Path is required",
+            )
+            skills.append({"path": path})
+        elif source == "s3":
+            uri = interactive.text(
+                "S3 URI (e.g., s3://my-bucket/skills/research)",
+                validate=lambda v: None if v.startswith("s3://") else "Must start with s3://",
+            )
+            skills.append({"s3Uri": uri})
+        elif source == "git":
+            git_url = interactive.text(
+                "Git repository URL (HTTPS)",
+                validate=lambda v: None if v.startswith("https://") else "Must be an HTTPS URL",
+            )
+            git_path = interactive.text("Subdirectory path within the repo (optional, press Enter to skip)")
+            credential = "skip"
+            if api_key_credentials:
+                credential = interactive.select(
+                    "Git authentication (Select a credential for private repository access)",
+                    [
+                        *[C(n, n, "Use existing API key credential") for n in api_key_credentials],
+                        C("Skip (no auth needed)", "skip", "Repository is publicly accessible"),
+                    ],
+                )
+            username = interactive.text("Username for git auth (optional, press Enter to skip)")
+            skill: dict[str, Any] = {"gitUrl": git_url}
+            if git_path:
+                skill["gitPath"] = git_path
+            if credential != "skip":
+                skill["credentialName"] = credential
+                if username:
+                    skill["username"] = username
+            skills.append(skill)
+        else:
+            paths = interactive.text(
+                "Filter paths (comma-separated globs, e.g., core-skills/* or specialized-skills/operations-skills/*) "
+                "or leave blank for all. See https://github.com/aws/agent-toolkit-for-aws/tree/main/skills"
+            )
+            skills.append({"awsSkills": _csv(paths)})
+        choice = interactive.select(
+            f"Add another skill? ({len(skills)} skill(s) configured)",
+            [
+                C("Add another skill", "add", "Add one more skill source"),
+                C("Done", "done", f"{len(skills)} skill(s) configured"),
+            ],
+        )
+        if choice != "add":
+            return skills
+
+
+def run_add_harness_wizard(primitive: HarnessPrimitive) -> None:  # noqa: C901 - one linear wizard, as upstream
+    from agentcore.cli.commands.add.agent_wizard import prompt_jwt_config
+    from agentcore.cli.commands.shared import filesystem_utils as fs
+    from agentcore.cli.commands.shared.vpc_utils import validate_vpc_id
+    from agentcore.primitives.harness import DEFAULT_BEDROCK_MANTLE_MODEL_ID, DEFAULT_MODEL_IDS
+    from agentcore.schema import MAX_EFS_MOUNTS, MAX_S3_MOUNTS, HarnessName
+
+    project = _project()
+    existing = [h["name"] for h in project.get("harnesses") or []]
+    api_key_credentials = [
+        c["name"] for c in project.get("credentials") or [] if c.get("authorizerType") == "ApiKeyCredentialProvider"
+    ]
+    cfg: dict[str, Any] = {}
+
+    cfg["name"] = interactive.text(
+        "Harness name",
+        default=generate_unique_name("MyHarness", existing),
+        validate=lambda v: first_issue(HarnessName, v) or ("Harness name already exists" if v in existing else None),
+    )
+    provider = interactive.select(
+        "Select model provider (Choose where to run your models)", _choices(MODEL_PROVIDER_OPTIONS)
+    )
+    cfg["modelProvider"] = provider
+    cfg["modelId"] = DEFAULT_MODEL_IDS[provider]
+
+    if provider in ("bedrock", "open_ai"):
+        description = (
+            "Choose the API format for OpenAI model invocation"
+            if provider == "open_ai"
+            else "Choose the API format for model invocation (Responses and ChatCompletions use Bedrock Mantle)"
+        )
+        options = OPENAI_API_FORMAT_OPTIONS if provider == "open_ai" else BEDROCK_API_FORMAT_OPTIONS
+        api_format = interactive.select(f"Select API format ({description})", _choices(options))
+        if provider == "bedrock":
+            mantle = api_format != "converse_stream"
+            if mantle:
+                cfg["apiFormat"] = api_format
+            cfg["modelId"] = DEFAULT_BEDROCK_MANTLE_MODEL_ID if mantle else DEFAULT_MODEL_IDS["bedrock"]
+        else:
+            cfg["apiFormat"] = api_format
+
+    if provider != "bedrock":
+        optional = provider == "lite_llm"
+        arn = interactive.text(
+            "API Key ARN (AgentCore Identity, optional — leave blank to skip)"
+            if optional
+            else "API Key ARN (AgentCore Identity)",
+            validate=lambda v: None if (optional and not v.strip()) or is_valid_arn(v) else ARN_VALIDATION_MESSAGE,
+        )
+        if arn:
+            cfg["apiKeyArn"] = arn
+
+    if provider == "lite_llm":
+        api_base = interactive.text("API base URL (optional — leave blank to use the provider default)")
+        if api_base:
+            cfg["apiBase"] = api_base
+        params = interactive.text(
+            'Additional params as a JSON object (optional, e.g. {"reasoning_effort":"high"})',
+            validate=_json_object_validator("Additional params"),
+        ).strip()
+        if params:
+            cfg["additionalParams"] = json.loads(params)
+
+    container_mode = interactive.select(
+        "Custom environment (Optionally provide a custom container image for the harness runtime)",
+        _choices(CONTAINER_MODE_OPTIONS),
+    )
+    if container_mode == "uri":
+        cfg["containerUri"] = interactive.text(
+            "Container image URI (e.g., 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-harness:latest)",
+            validate=lambda v: None if v.strip() else "Container URI is required",
+        )
+    elif container_mode == "dockerfile":
+        cfg["dockerfilePath"] = interactive.text(
+            "Path to Dockerfile", validate=lambda v: None if v.strip() else "Dockerfile path is required"
+        )
+
+    memory: dict[str, Any] = {
+        "mode": interactive.select("Memory (How should this harness handle memory?)", _choices(MEMORY_MODE_OPTIONS))
+    }
+    if memory["mode"] == "existing":
+
+        def validate_ref(value: str) -> str | None:
+            v = value.strip()
+            if v == "":
+                return "A memory name or ARN is required"
+            if v.startswith("arn:") and not is_valid_arn(v):
+                return ARN_VALIDATION_MESSAGE
+            return None
+
+        ref = interactive.text("Existing memory (name or ARN)", validate=validate_ref).strip()
+        memory["arn" if ref.startswith("arn:") else "name"] = ref
+
+    advanced_options = tuple(
+        o
+        for o in ADVANCED_SETTING_OPTIONS
+        if (o[0] != "memory-managed-tuning" or memory["mode"] == "managed")
+        and (o[0] != "memory-existing-tuning" or memory["mode"] == "existing")
+    )
+    advanced = interactive.checkbox(
+        "Advanced settings (optional) — Configure tools, network, lifecycle, execution limits, truncation, or "
+        "session storage",
+        _choices(advanced_options),
+    )
+
+    if "tools" in advanced:
+        selected = interactive.checkbox(
+            "Select tools for your harness (Choose built-in tools, MCP servers, or gateways)",
+            _choices(TOOL_SELECT_OPTIONS),
+        )
+        cfg["selectedTools"] = selected
+        if "remote_mcp" in selected:
+            cfg["mcpName"] = interactive.text(
+                "MCP server name", validate=lambda v: None if v.strip() else "MCP name is required"
+            )
+            cfg["mcpUrl"] = interactive.text(
+                "MCP server URL",
+                validate=lambda v: None if v.startswith(("http://", "https://")) else "Must be a valid URL",
+            )
+            headers = interactive.text(
+                'MCP request headers as a JSON object (optional, e.g. {"X-Api-Key":"abc"})',
+                validate=_json_object_validator("Headers", string_values=True),
+            ).strip()
+            if headers:
+                cfg["mcpHeaders"] = json.loads(headers)
+        if "agentcore_gateway" in selected:
+            cfg["gatewayArn"] = interactive.text(
+                "Gateway ARN", validate=lambda v: None if is_valid_arn(v) else ARN_VALIDATION_MESSAGE
+            )
+            outbound = interactive.select(
+                "Gateway outbound auth (How should the harness authenticate when calling the gateway?)",
+                _choices(GATEWAY_OUTBOUND_AUTH_OPTIONS),
+            )
+            cfg["gatewayOutboundAuth"] = outbound
+            if outbound == "oauth":
+                cfg["gatewayProviderArn"] = interactive.text(
+                    "Credential provider ARN", validate=lambda v: None if is_valid_arn(v) else ARN_VALIDATION_MESSAGE
+                )
+                cfg["gatewayScopes"] = _csv(
+                    interactive.text(
+                        "OAuth scopes (comma-separated)",
+                        validate=lambda v: None if v.strip() else "At least one scope is required",
+                    )
+                )
+
+    if "skills" in advanced:
+        cfg["skills"] = _prompt_skills(api_key_credentials)
+
+    if "auth" in advanced:
+        authorizer = interactive.select(
+            "Authorizer type (How will clients authenticate to this harness?)", _choices(AUTHORIZER_TYPE_OPTIONS)
+        )
+        cfg["authorizerType"] = authorizer
+        if authorizer == "CUSTOM_JWT":
+            cfg["jwtConfig"] = prompt_jwt_config()
+
+    if "network" in advanced:
+        network_mode = interactive.select(
+            "Network mode (Choose network deployment mode)", _choices(NETWORK_MODE_OPTIONS)
+        )
+        cfg["networkMode"] = network_mode
+        if network_mode == "VPC":
+            cfg["subnets"] = _csv(
+                interactive.text(
+                    "Subnet IDs (comma-separated)",
+                    validate=lambda v: _validate_id_list(v, SUBNET_ID_PATTERN, "subnet", "subnet-0abc123def456"),
+                )
+            )
+            cfg["securityGroups"] = _csv(
+                interactive.text(
+                    "Security Group IDs (comma-separated)",
+                    validate=lambda v: _validate_id_list(
+                        v, SECURITY_GROUP_ID_PATTERN, "security group", "sg-0abc123def456"
+                    ),
+                )
+            )
+            if container_mode == "dockerfile":
+                cfg["vpcId"] = interactive.text("VPC ID", validate=lambda v: _err(validate_vpc_id(v))).strip()
+
+    if "memory-managed-tuning" in advanced and memory["mode"] == "managed":
+        strategies = interactive.checkbox(
+            "Memory strategies (optional) — Leave all unselected to use the service default.",
+            _choices(MANAGED_STRATEGY_OPTIONS),
+        )
+        if strategies:
+            memory["strategies"] = strategies
+        expiry = interactive.text(
+            "Memory event expiry (days) — 3-365; press Enter for the default (30)",
+            validate=_int_range(3, 365, "Must be an integer between 3 and 365", optional=True),
+        )
+        if expiry.strip():
+            memory["eventExpiryDuration"] = _js_int(expiry)
+        kms = interactive.text(
+            "Memory KMS key ARN (optional)",
+            validate=lambda v: None if v.strip() == "" or is_valid_arn(v.strip()) else ARN_VALIDATION_MESSAGE,
+        ).strip()
+        if kms:
+            memory["encryptionKeyArn"] = kms
+
+    if "memory-existing-tuning" in advanced and memory["mode"] == "existing":
+        count = interactive.text(
+            "Memory messages count (optional)",
+            validate=_int_range(1, 2**53, "Must be a positive integer", optional=True),
+        )
+        if count.strip():
+            memory["messagesCount"] = _js_int(count)
+        top_k = interactive.text(
+            "Memory retrieval top K (optional)",
+            validate=_int_range(1, 2**53, "Must be a positive integer", optional=True),
+        )
+        if top_k.strip():
+            memory["topK"] = _js_int(top_k)
+        score = interactive.text(
+            "Memory relevance score (optional, 0.0-1.0)", validate=_float_range(0, 1, "Must be between 0.0 and 1.0")
+        )
+        if score.strip():
+            memory["relevanceScore"] = _num(_js_float(score))
+
+    if "allowed-tools" in advanced:
+
+        def validate_allowed(value: str) -> str | None:
+            items = _csv(value)
+            bad = next((t for t in items if len(t) > 64 or not _ALLOWED_TOOL.match(t)), None)
+            return f'Invalid pattern "{bad}" (use "*" or a tool name, max 64 chars)' if bad else None
+
+        allowed = interactive.text(
+            'Allowed tools (comma-separated, optional, e.g. "*" or "browser,code-interpreter")',
+            validate=validate_allowed,
+        )
+        if _csv(allowed):
+            cfg["allowedTools"] = _csv(allowed)
+
+    if "lifecycle" in advanced:
+        cfg["idleTimeout"] = _js_int(
+            interactive.text(
+                "Idle timeout (seconds)", default="900", validate=_int_range(60, 28800, "Must be between 60 and 28800")
+            )
+        )
+
+        def validate_lifetime(value: str) -> str | None:
+            n = _js_int(value)
+            if n is None or n < 60 or n > 28800:
+                return "Must be between 60 and 28800"
+            if cfg.get("idleTimeout") is not None and n < cfg["idleTimeout"]:
+                return f"Max lifetime must be >= idle timeout ({cfg['idleTimeout']}s)"
+            return None
+
+        cfg["maxLifetime"] = _js_int(
+            interactive.text("Max lifetime (seconds)", default="28800", validate=validate_lifetime)
+        )
+
+    if "execution" in advanced:
+        positive = _int_range(1, 2**53, "Must be a positive number")
+        cfg["maxIterations"] = _js_int(interactive.text("Max iterations", default="10", validate=positive))
+        cfg["maxTokens"] = _js_int(interactive.text("Max tokens", default="4096", validate=positive))
+        cfg["timeoutSeconds"] = _js_int(interactive.text("Timeout (seconds)", default="300", validate=positive))
+        temperature = interactive.text(
+            "Temperature (optional, 0.0-2.0)", validate=_float_range(0, 2, "Must be between 0.0 and 2.0")
+        )
+        if temperature.strip():
+            cfg["temperature"] = _num(_js_float(temperature))
+        top_p = interactive.text(
+            "Top P (optional, 0.0-1.0)", validate=_float_range(0, 1, "Must be between 0.0 and 1.0")
+        )
+        if top_p.strip():
+            cfg["topP"] = _num(_js_float(top_p))
+        if provider == "gemini":
+            top_k = interactive.text(
+                "Top K (optional, 0-500, gemini only)",
+                validate=_int_range(0, 500, "Must be an integer between 0 and 500", optional=True),
+            )
+            if top_k.strip():
+                cfg["topK"] = _js_int(top_k)
+        model_max = interactive.text(
+            "Model max tokens (optional)", validate=_int_range(1, 2**53, "Must be a positive integer", optional=True)
+        )
+        if model_max.strip():
+            cfg["modelMaxTokens"] = _js_int(model_max)
+
+    if "truncation" in advanced:
+        cfg["truncationStrategy"] = interactive.select(
+            "Truncation strategy (How to manage context when it exceeds limits)", _choices(TRUNCATION_STRATEGY_OPTIONS)
+        )
+
+    if "session-storage" in advanced:
+        cfg["sessionStoragePath"] = interactive.text(
+            "Session storage mount path (e.g., /mnt/data/)",
+            default="/mnt/data/",
+            validate=lambda v: _err(fs.validate_byo_mount_path(v)),
+        )
+        efs = _prompt_mounts("EFS", MAX_EFS_MOUNTS, fs.validate_efs_access_point_arn, cfg.get("networkMode"))
+        if efs:
+            cfg["efsAccessPoints"] = efs
+        s3 = _prompt_mounts("S3 Files", MAX_S3_MOUNTS, fs.validate_s3_files_access_point_arn, cfg.get("networkMode"))
+        if s3:
+            cfg["s3AccessPoints"] = s3
+
+    _print_summary(cfg, memory)
+    if not interactive.confirm("Create this harness?", default=True):
+        typer.echo("Cancelled.")
+        return
+
+    options = {**cfg, **_to_memory_add_options(memory)}
+    result = primitive.add(primitive.add_options_from_dict(options))
+    if not result.success:
+        typer.echo("Failed to add harness", err=True)
+        typer.echo(get_error_message(result.error), err=True)
+        raise typer.Exit(1)
+    typer.echo(f"Added harness: {cfg['name']}")
+    typer.echo("Harness config written to app/. Deploy with `agentcore deploy`.")
+    if result.value.get("memoryMode") == "managed":
+        typer.echo(f"\nNote: {MANAGED_MEMORY_ADD_NOTICE}")
+
+
+def _to_memory_add_options(memory: dict[str, Any]) -> dict[str, Any]:
+    """Port of memory-options.ts toMemoryAddOptions."""
+    if memory.get("mode") == "existing":
+        return {
+            "memoryMode": "existing",
+            "memoryName": memory.get("name"),
+            "memoryArn": memory.get("arn"),
+            "memoryActorId": memory.get("actorId"),
+            "messagesCount": memory.get("messagesCount"),
+            "memoryTopK": memory.get("topK"),
+            "memoryRelevanceScore": memory.get("relevanceScore"),
+        }
+    if memory.get("mode") == "managed":
+        return {
+            "memoryMode": "managed",
+            "memoryStrategies": memory.get("strategies"),
+            "memoryEventExpiryDays": memory.get("eventExpiryDuration"),
+            "memoryEncryptionKeyArn": memory.get("encryptionKeyArn"),
+        }
+    return {"memoryMode": "disabled"}
+
+
+def _print_summary(cfg: dict[str, Any], memory: dict[str, Any]) -> None:
+    rows: list[tuple[str, Any]] = [
+        ("Name", cfg["name"]),
+        ("Model Provider", cfg["modelProvider"]),
+        ("Model ID", cfg["modelId"]),
+        ("API Format", cfg.get("apiFormat")),
+        ("API Key ARN", cfg.get("apiKeyArn")),
+        ("API Base URL", cfg.get("apiBase")),
+        ("Additional Params", json.dumps(cfg["additionalParams"]) if cfg.get("additionalParams") else None),
+    ]
+    if memory["mode"] == "managed":
+        strategies = memory.get("strategies")
+        titled = (
+            ", ".join(s[0] + s[1:].lower().replace("_", " ", 1) for s in strategies)
+            if strategies
+            else "default strategies"
+        )
+        rows.append(("Memory", f"Managed ({titled})"))
+        if memory.get("eventExpiryDuration") is not None:
+            rows.append(("Memory Event Expiry", f"{memory['eventExpiryDuration']} days"))
+        rows.append(("Memory KMS Key", memory.get("encryptionKeyArn")))
+    elif memory["mode"] == "existing":
+        rows.append(("Memory", f"Existing ({memory.get('arn') or memory.get('name') or '—'})"))
+        rows.append(("Memory Messages Count", memory.get("messagesCount")))
+        rows.append(("Memory Retrieval Top K", memory.get("topK")))
+        rows.append(("Memory Relevance Score", memory.get("relevanceScore")))
+    else:
+        rows.append(("Memory", "No memory"))
+    if cfg.get("allowedTools"):
+        rows.append(("Allowed Tools", ", ".join(cfg["allowedTools"])))
+    if cfg.get("authorizerType"):
+        rows.append(("Auth Type", _title(AUTHORIZER_TYPE_OPTIONS, cfg["authorizerType"])))
+    jwt = cfg.get("jwtConfig")
+    if cfg.get("authorizerType") == "CUSTOM_JWT" and jwt:
+        rows.append(("Discovery URL", jwt.discovery_url))
+        for label, values in (
+            ("Allowed Audience", jwt.allowed_audience),
+            ("Allowed Clients", jwt.allowed_clients),
+            ("Allowed Scopes", jwt.allowed_scopes),
+        ):
+            if values:
+                rows.append((label, ", ".join(values)))
+        if jwt.custom_claims:
+            rows.append(("Custom Claims", f"{len(jwt.custom_claims)} claim(s) configured"))
+        if jwt.client_id:
+            rows.append(("Harness Credential", compute_managed_oauth_credential_name(cfg["name"])))
+    if cfg.get("selectedTools"):
+        rows.append(("Tools", ", ".join(_title(TOOL_SELECT_OPTIONS, t) for t in cfg["selectedTools"])))
+        if cfg.get("mcpName"):
+            rows.append(("MCP Server", f"{cfg['mcpName']} ({cfg.get('mcpUrl')})"))
+        if cfg.get("mcpHeaders"):
+            rows.append(("MCP Headers", json.dumps(cfg["mcpHeaders"])))
+        rows.append(("Gateway ARN", cfg.get("gatewayArn")))
+        if cfg.get("gatewayOutboundAuth"):
+            rows.append(("Gateway Auth", _title(GATEWAY_OUTBOUND_AUTH_OPTIONS, cfg["gatewayOutboundAuth"])))
+        if cfg.get("gatewayOutboundAuth") == "oauth":
+            rows.append(("Provider ARN", cfg.get("gatewayProviderArn")))
+            rows.append(("OAuth Scopes", ",".join(cfg.get("gatewayScopes") or [])))
+    for i, skill in enumerate(cfg.get("skills") or []):
+        aws = skill.get("awsSkills")
+        aws_label = f"aws-skills ({', '.join(aws) if aws else 'all'})" if aws is not None else None
+        rows.append((f"Skill {i + 1}", skill.get("s3Uri") or skill.get("gitUrl") or skill.get("path") or aws_label))
+    for label, key in (
+        ("Container URI", "containerUri"),
+        ("Dockerfile", "dockerfilePath"),
+        ("Network Mode", "networkMode"),
+        ("Subnets", "subnets"),
+        ("Security Groups", "securityGroups"),
+        ("VPC ID", "vpcId"),
+        ("Idle Timeout", "idleTimeout"),
+        ("Max Lifetime", "maxLifetime"),
+        ("Max Iterations", "maxIterations"),
+        ("Max Tokens", "maxTokens"),
+        ("Timeout", "timeoutSeconds"),
+        ("Temperature", "temperature"),
+        ("Top P", "topP"),
+        ("Top K", "topK"),
+        ("Model Max Tokens", "modelMaxTokens"),
+        ("Truncation", "truncationStrategy"),
+        ("Session Storage", "sessionStoragePath"),
+    ):
+        value = cfg.get(key)
+        rows.append((label, ", ".join(value) if isinstance(value, list) else value))
+    for mount in cfg.get("efsAccessPoints") or []:
+        rows.append(("EFS Mount", f"{mount['accessPointArn']} -> {mount['mountPath']}"))
+    for mount in cfg.get("s3AccessPoints") or []:
+        rows.append(("S3 Files Mount", f"{mount['accessPointArn']} -> {mount['mountPath']}"))
+    for label, value in rows:
+        if value not in (None, "", []):
+            typer.echo(f"  {label}: {value}")
+
+
+__all__ = ["run_add_harness_wizard"]