feat(cli): add consistent JSON output to project mutations

[notgitika]

Uses the existing global JsonKey / JsonRendererKey path with a shared, type-checked project mutation envelope for create, add, and remove. All project add leaves now use one runWithProgress wrapper, nested help shows inherited global options, and command guidance is returned in structured notes under --json.

Human-readable success and guidance output is preserved when --json is not used.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice, well-scoped refactor. The new ProjectMutationResult contract via src/handlers/project/output.ts is consistent across create, add *, and remove *, and the addProjectResource helper in src/handlers/project/add/shared.ts cleanly collapses the duplicated for await loops. A few small observations, none blocking:

• parentFor in add/shared.ts and the ternary chain in remove/index.ts (lines 135–142) encode the same parent-relationship knowledge in two places. If a third resource ever gains a parent, both must be updated. Consider extracting a single parentFor(resourceType, flags) helper shared by both sides — optional cleanup, not required now.
• addProjectResource hard-codes interactive: false for runWithProgress. That preserves byte-for-byte behavior of the previous for await loop, which is what the comment says is intended, so this is fine — just worth noting if you later want add commands to get the same live TaskList UI as create/deploy.
• remove always emits removedEnvironmentKeys (including [] when nothing was removed), while add/create never emit it. The contract is unambiguous, but you may want to document that shape somewhere consumer-facing (schema/docs) so tools can rely on it.

The tests use real temp-dir projects and go through run(...) end-to-end — no excessive mocking. The router showGlobalOptions: true change is small, covered by a new test, and orthogonal but reasonable to bundle here.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.03%. Comparing base (6731091) to head (3b9d6a5).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2218      +/-   ##
============================================
+ Coverage     97.02%   97.03%   +0.01%     
============================================
  Files           564      566       +2     
  Lines         39233    39397     +164     
============================================
+ Hits          38064    38228     +164     
  Misses         1169     1169              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Clean, well-scoped refactor. A few observations, all verified against the code and none blocking:

• The new ProjectMutationResult contract in src/handlers/project/output.ts is applied uniformly across create, all add * handlers, and remove (including remove all). The parent-relationship logic lives in a single parentFor helper, which remove uses via projectMutationResource(resource, name, input) — no duplicated ternary chain remains in remove/index.ts.
• add/shared.ts's addProjectResource correctly threads the returned Project back out of runWithProgress (matching addResource's AsyncGenerator<ProjectEvent, Project> signature) and the hardcoded interactive: false preserves the historical plain progress-line behavior of add commands byte-for-byte; the inline comment calls this out.
• The gateway-connector case correctly re-types the resource to "gateway-connector" via options.resourceType while still deriving the parent: { type: "gateway", ... } from the underlying resourceType: "gateway-target" input. New test covers this.
• The gateway-test-support.ts change from join(directory, name) to process.cwd() normalizes symlinks (e.g., macOS /var vs /private/var), which is necessary for the new path field in the JSON output to match. Sensible fix.
• Post-mutation stderr side-messages (.env.local guidance for credentials, "attached to N gateway(s)" for policy-engine, auto-payment warning for payment-manager) intentionally remain on stderr and are not part of the machine-readable JSON; that's the right tradeoff and preserves prior behavior.
• Secrets aren't leaked in the new --json credential result — verified by the new test asserting sk-secret-value doesn't appear in stdout.

Tests use real temp-dir projects and go through run(...) end-to-end; no excessive mocking. The unrelated showGlobalOptions: true router change is small, covered by a new test, and reasonable to include.

Prior review by the bot already noted the small readability suggestion about extracting parent-relationship knowledge into a shared helper — that's already effectively done via parentFor in output.ts. No further issues from me.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[tejaskash]

Verified locally on 67f5981: tsc, oxlint, and 668 tests under src/handlers/project and src/router pass. No behavior-breaking bugs. Inline comments below.

One note not tied to a line: the PR body says human-readable output is unchanged, but remove ... --json previously emitted { message: "removed ..." } and a stderr success line. It now emits the new envelope only and the stderr line is suppressed. That is a fine outcome, but the description should state it since this was the one pre-existing project mutation JSON contract.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)