feat(dev): collect local OTEL traces in project dev

[tejaskash]

What this does

When you run agentcore project dev, your agent now gets local tracing out of the box. The CLI starts a small local trace receiver, tells the agent's OpenTelemetry SDK to send traces to it (via environment variables), and saves everything to files under agentcore/.cli/traces/. So while you develop, every invocation of your agent leaves a trace on disk you can inspect — model calls, tool calls, timings.

Nothing is sent anywhere: the receiver only listens on 127.0.0.1 and writes to your project folder. If you don't want it, pass --no-traces or set instrumentation.enableOtel: false on the runtime.

Why we need it

This is the plumbing for the Agent Inspector (the local web UI from the current CLI). The Inspector's trace view reads exactly these files — without this PR there is nothing for it to show. It also stands alone: even before the Inspector lands, you get trace files you can cat/jq while debugging an agent.

Where the code comes from

This is a port of what the current agentcore-cli already ships in src/cli/operations/dev/otel/ — same mechanism, same on-disk format, same env vars. Differences from the original are structural, to fit the rewrite's layering:

• The old OtelCollector class (HTTP + persistence + queries in one) is split into an HTTP receiver, a TraceStore, and pure transform functions — each independently testable.
• The old CLI scans for a free port starting at 4318; here the OS assigns one, since the agent learns the address from an env var anyway.
• The Python quirk is ported as-is: uvicorn's --reload respawns workers, so instrumentation is injected via sitecustomize.py on PYTHONPATH rather than the opentelemetry-instrument wrapper (which would only instrument the parent process, and traces would silently stop after the first hot reload).
• Containers can't reach the host's 127.0.0.1, so their endpoint is rewritten to host.docker.internal — same as the original.

One dependency is added, pinned exactly: @opentelemetry/otlp-transformer@0.213.0. Agents send traces in protobuf (the Python SDK supports nothing else over HTTP), and this is the last version that ships the protobuf request decoders — the same version the current CLI uses. Don't let dependabot bump it.

Stack

Targets #1966 (feat/project-dev-handler); retarget to refactor after it merges. PR B (the Agent Inspector web UI) builds on this.

Verification

• bun test (1487 pass), typecheck, lint, format all clean
• bun run build + smoke test: node dist/index.js project dev --help shows --no-traces
• protobuf decoding verified under all three ways we ship: bun from source, the Node npm bundle, and a compiled standalone binary

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.58065% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.07%. Comparing base (94f890c) to head (aabb87f).

Files with missing lines	Patch %	Lines
src/core/dev/otel/transforms.ts	97.32%	6 Missing ⚠️
src/io/httpServer.ts	90.62%	6 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #1980      +/-   ##
============================================
+ Coverage     97.06%   97.07%   +0.01%     
============================================
  Files           374      378       +4     
  Lines         22542    23033     +491     
============================================
+ Hits          21880    22359     +479     
- Misses          662      674      +12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.