feat: bring harness flows into latest version of cli

[avi-alpert]

Summary

The __PREVIEW__ / isPreviewEnabled() build-time flag gated harness and related flows (export, add/remove tool, add/remove skill) to preview-only builds. This PR cuts over so those flows are the only path: every preview-enabled branch is inlined as always-on, the GA-only branches are deleted, and the build-time machinery is removed.

Result: harness is now available in the standard (@latest) release — no preview build required.

Closes #1569

What changed

• Remove isPreviewEnabled() + the __PREVIEW__ esbuild define, the BUILD_PREVIEW wiring in index.ts, the build:preview npm script, and the AGENTCORE_PREVIEW CDK passthrough (wrapper.ts + vended assets/cdk/bin/cdk.ts).
• Inline all preview-gated branches across commands and TUI as always-on; delete the now-dead GA-only branches (including the old create-prompt flow).
• Dedupe scripts/bundle.mjs dual-tarball logic — GA and preview builds are now byte-identical.
• Fix the CI workflows that consumed the removed -preview tarball: e2e-tests.yml, prerelease-tarball.yml, canary.yml.
• Update README.md: harness section no longer says it requires @aws/agentcore@preview.
• Delete preview-flag.test.ts; update tests that mocked the flag.

Notes

• Preview publishing continues. We keep publishing the binary to the @preview npm tag so existing 1.0.0-preview.XX customers don't have to switch over

Testing

• Unit suite, typecheck, lint, and asset snapshots all pass.
• Harness e2e tests (formerly preview-gated) now run unconditionally in the single build.

[github-actions]

Package Tarball

aws-agentcore-0.20.2.tgz

How to install

gh release download pr-1598-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.2.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

Cutover looks correct and the production code paths are clean. Two issues that need to be addressed before merging, plus one minor follow-up:

1. computeInvokeAttrs still has a dead preview parameter

src/cli/commands/invoke/utils.ts still gates isHarnessInvoke() on options.preview:

const isHarness = options.preview && isHarnessInvoke(options);

Both call sites this PR touches now hardcode preview: true (src/cli/commands/invoke/command.tsx:384, src/cli/tui/screens/invoke/useInvokeFlow.ts:179), so the parameter no longer carries any signal. It should be removed entirely (function param + both call sites + the preview: false test cases in src/cli/commands/invoke/__tests__/utils.test.ts). Otherwise the code reads as if there is still a preview gate when there isn't, and there's a real risk of a future caller accidentally passing preview: false and silently misclassifying telemetry.

2. Harness integration tests are now silently skipped in CI

harness-e2e-helper.ts was correctly updated to drop the BUILD_PREVIEW gate, but the integration tests were missed:

• integ-tests/add-remove-harness.test.ts:9,15,90,170,197 — every describe in the file is describe.skipIf(!isPreviewBuild)
• integ-tests/create-edge-cases.test.ts:200,202 — describe.skipIf(!isPreviewBuild || ...) for the harness create flow
• integ-tests/dev-server.test.ts:178,180 — describe.skipIf(!isPreviewBuild || ...) for harness dev mode

build-and-test.yml runs npx vitest run --project integ without setting BUILD_PREVIEW, so all of these suites silently skip on every PR. After this PR the harness path is the default agentcore create flow, so it really needs integration coverage. Please drop the isPreviewBuild gate from these three files (the prereqs.npm/prereqs.git/hasUv checks should stay).

3. (Minor) Leftover BUILD_PREVIEW / __PREVIEW__ references

These are no longer consumed by anything, but they're confusing to a future reader. Worth either cleaning up here or in an immediate follow-up:

• vitest.config.ts:30 still defines __PREVIEW__ as a global — feature-flags.ts no longer declares it, so this define is dead.
• .github/workflows/e2e-tests-full.yml:33,66,115 still runs a cli-build: [preview, ga] matrix and sets BUILD_PREVIEW on the build/test steps. Since esbuild.config.mjs no longer reads it and build:preview was removed from package.json, this matrix produces two identical builds and roughly doubles full-suite runtime for no signal.
• .github/workflows/release-main-and-preview.yml:381 sets BUILD_PREVIEW: '1' on the preview-publish build, which is now a no-op.

Happy to treat #3 as a follow-up if you'd rather keep this PR scoped, but #1 and #2 should land before merge.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

The fixes from the previous review look good — the preview parameter is gone from computeInvokeAttrs, the isPreviewBuild gates are removed from the integ tests, and the leftover __PREVIEW__ / BUILD_PREVIEW references have been cleaned up.

One new issue with the new harness/agent path routing in create that I think should be addressed before merge — see the inline comment on HARNESS_ONLY_FLAGS.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[tejaskash]

Reviewed the full diff and traced control flow beyond the hunks. This is a clean, overwhelmingly mechanical cutover of the __PREVIEW__ / isPreviewEnabled() build-time gate to always-on, with the gating machinery removed.

Verified:

• Every isPreviewEnabled caller (26 files) is touched by the PR — no dangling references against the deleted export.
• harnessPrimitive is now non-optional and all ! assertions are correctly dropped.
• The canary.yml matrix exclude is the right tool — it drops the nonexistent Prerelease/Preview tarball while preserving Released/Preview (verifies the still-published @preview tag).
• getHarnessDryRunInfo is reached by the existing --defaults --dry-run tests (--defaults isn't an agent-path flag, so it routes through the harness path).
• The useAddHarnessWizard provider-routing rewrite only deletes a branch that was unreachable under the preview-gated wizard; bedrock still reaches container via the unchanged allSteps sequence — no behavior change.

LGTM.