feat(project): add TUI wizards for four project add resources

[notgitika]

What

Selecting add from the project menu now opens a resource menu, and four of the fifteen resources get a wizard: memory, gateway, policy-engine, config-bundle. The other eleven keep the not-implemented screen and are unchanged on the command line.

 agentcore → project → add → memory → adds a memory to the current project
──────────────────────────────────────────────────────────────────────────
 ✓ name ── ● strategies ── ○ retention ── ○ description ── ○ review
──────────────────────────────────────────────────────────────────────────
 what should be extracted from raw events?
 selecting none keeps short-term events only
 ╭────────────────────────────────────────────────────────────────────────╮
 │ ❯ [✓] SEMANTIC         durable facts extracted from conversations      │
 │   [ ] SUMMARIZATION    running summaries of each session               │
 │   [ ] USER_PREFERENCE  preferences the user states or implies          │
 │   [ ] EPISODIC         past episodes, plus reflections over them       │
 ╰────────────────────────────────────────────────────────────────────────╯
──────────────────────────────────────────────────────────────────────────
[↑↓] move  [space] toggle  [enter] continue  [esc] back  [ctl+c] quit

resource	steps (italic = conditional)
memory	name → strategies → retention → description → review
gateway	name → protocol → authorizer → jwt config → search → description → review
policy-engine	name → description → attach → mode → review
config-bundle	name → components → description → branch → commit → review

Design

Two pieces, each with one job.

1. A shared <Wizard> shell (components/wizard/, 277 lines). It owns the step list, position, key handling, and the form → running → success | error phases. A screen supplies only the questions, as <Step> children, and branches with a plain conditional:

{isCustomJwt && (
  <Step name="authorizer-configuration" question="paste the authorizerConfiguration">
    <TextAreaField required json schema={GatewayAuthorizerConfigurationInputSchema} … />
  </Step>
)}

React.Children.toArray drops the false a closed branch produces, so an inapplicable step is absent from the flow and the stepper alike. Position is keyed by step name, not index, so a step appearing or vanishing never moves the user. Duplicate names throw at render. Each field owns its own useInput, so the shell has no focus concept — one field per step is the invariant; a step that needs two related inputs gets a compound field, not shell-level focus management.

2. One input builder per resource, exported from the handler: toAddGatewayInput(project, input), toAddMemoryInput(input), toAddConfigBundleInput(input), toAddPolicyEngineInput(project, input). Each takes a typed XxxInput (already-parsed JSON, already-split tags) and is the only place defaults, cross-field rules, and resource assembly live. The flag handler's handle reduces to flags → XxxInput; the screen's onSubmit reduces to form values → XxxInput. Neither knows what a Gateway is.

flags ──(resolve file://, parse JSON, pair flags)──┐
                                                    ├──► toAddGatewayInput(project, input) ──► projectManager.addResource
form  ──(trim, parse, drop hidden-step answers)────┘

This is what stops the two paths drifting. It already caught one: the flag path validated --authorizer-configuration with GatewayAuthorizerConfigSchema.strict(), the first cut of the wizard used the non-strict schema, so the SDK's customJWTAuthorizer casing was rejected by flags but accepted by the wizard — and then failed at submit as a missing customJwtAuthorizer. Both now share GatewayAuthorizerConfigurationInputSchema; a screen test pins it.

The wizard convention that makes the builders' cross-field errors unreachable from the TUI: pass only the answers to steps the user saw. A JWT config typed before switching the authorizer to NONE is dropped, not sent.

Decisions worth a reviewer's attention

• Submit goes through projectManager.addResource, not handler.handle. Handlers write to a config.io.stderr captured at wiring time, which Ink's alternate screen swallows.
• Flags stay .optional(). Required-ness is a field prop; a non-optional schema lets Commander reject a bare command before the TUI middleware can open a screen (69aa0c19).
• ProjectGate resolves ProjectKey for screens the user navigated to (middleware never ran) and reports the CLI's own not-found guidance.
• Form* components omit label/help rows when passed empty strings, so a field under a <Step> renders just the control. Existing callers pass non-empty strings and are unaffected.

Testing

bun test: 2645 pass, 0 fail. tsc --noEmit, oxlint, prettier --check clean.

38 new tests. Handler flag tests are unchanged and now exercise the shared builders; screen tests exercise the same builders from the form side. add.screen.test.tsx reads its case list off the compiled Commander tree, so a resource routed later without a screen fails the suite.

Not in scope

• A bare agentcore project add memory still runs the flag path. Opening the wizard needs a per-command launcher, not the router-wide withTuiOnEmptyFlagsAndArgs.
• Migrating project create, HarnessWizard, EndpointWizard onto the shell. create's forks are expressible as {cond && <Step/>}; that's the natural next PR.
• The remaining eleven add resources. Each follows the same recipe: export XxxInput + toAddXxxInput from the handler, reduce handle to flag conversion, write a screen of <Step>s.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 98.22531% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.28%. Comparing base (27e3250) to head (e0ef09e).
⚠️ Report is 17 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/components/wizard/fields.tsx	94.51%	13 Missing ⚠️
src/components/wizard/Wizard.tsx	95.40%	8 Missing ⚠️
src/components/wizard/context.tsx	94.44%	1 Missing ⚠️
src/handlers/project/ProjectGate.tsx	98.24%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2166      +/-   ##
============================================
+ Coverage     97.25%   97.28%   +0.02%     
============================================
  Files           508      519      +11     
  Lines         33902    35073    +1171     
============================================
+ Hits          32972    34121    +1149     
- Misses          930      952      +22     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice, cohesive PR. The wizard shell is small, well-tested, and the four new screens all funnel through the same ProjectGate → core.projectManager.addResource(...) path that the flag-driven handlers use, so telemetry, error handling and schema validation are inherited rather than duplicated. A few things I explicitly looked at and liked:

• Schemas are exported from the handler modules and reused by the wizards (ComponentsSchema, MemoryNameSchema, EventExpiryDurationSchema, toDefaultStrategy, GatewayAuthorizerConfigSchema). No copies to drift.
• Wizard positions by step key, so conditional branches ({isCustomJwt && <Step name="authorizer-configuration" />}, {hasGateways && isAttaching && <Step name="mode" />}) don't shift the user, and stepElements is derived via React.Children.toArray(...).filter(isStepElement) so false/null branch children are dropped cleanly.
• submitting ref makes buffered double-enter idempotent; ExitOnError correctly routes failures through useApp().exit(error) so renderTuiAt's waitUntilExit() rejects and the normal CLI error path prints the message — as opposed to a React stack.
• Tests are real end-to-end: createGatewayProjectTestHarness scaffolds a real project on a temp dir, and assertions read the actual agentcore.json back. No fs/ProjectManager mocks, no fake stdin — good.
• The configBundle test verifies the exported COMPONENTS_EXAMPLE itself parses and satisfies the schema, which is exactly the guard you want on an on-screen example.

Nothing that needs to change before merging.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[AlexanderRichey]

A lot of this looks good, but I'm concerned about potential duplication with existing components/patterns. Can you take a pass over this to make sure we're not duplicating code/components/logic we already have?

[AlexanderRichey]

Are we moving stuff around? I think we already have components for all of this. Let's reuse and not duplicate.

[notgitika]

temporarily closing this