fix: fail fast on missing project create dependencies

[nborges-aws]

Description

Add preflight dependency check to agentcore create flow. This change prevents a project scaffolding and a full NPM install from occurring before failing on uv missing.

Create now validates required tools exist before scaffolding project files or starting installation.

• checks npm when dependency installation is enabled
• checks uv for Python runtime templates
• checks git when repository init is enabled
• added tests asserting that no project files are created and no installation occurs when dependency is missing

nickdb@7cf34dd82df3 agentcore-cli % PATH="$SMOKE_BIN:$PATH" bun run src/index.ts project create --name MissingUvSmoke --template agent-python-strands
Error: 'uv' was not found on your PATH. Install uv: https://docs.astral.sh/uv/getting-started/installation/
nickdb@7cf34dd82df3 agentcore-cli % test ! -e ./MissingUvSmoke && echo "./MissingUvSmoke was not created" || echo "./MissingUvSmoke exists"
./MissingUvSmoke was not created

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• bun run test (2790 pass, 0 fail)
• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice tight fix. Moving checkCreateDependencies ahead of projectTree.write(destination) correctly ensures a missing dependency fails before any files are scaffolded, and the new negative-path test (fails before writing files or running npm when a later dependency is missing) locks that behavior in by asserting commands === [] and that the target directory was never created.

A few things I verified while reviewing:

• createProjectTree builds an in-memory FsTreeNode and does no I/O, so running the pre-flight check between createProjectTree and projectTree.write is safe.
• The upfront check keys off scaffoldRuntimeInput?.language === "Python" for uv, while installRuntimeDependencies re-checks based on pyproject.toml existence. The redundant late check is harmless and preserves the existing safety net if the two ever drift.
• Harness-only paths correctly only check npm + git upfront (the harness scaffold path does no external commands until the shared npm-install/git-init steps).
• Tests use real temp dirs and only stub runner/checkTool at the process boundary — no excessive mocking.
• No telemetry needed; this is a bug fix, not a new user-facing feature.

Nothing blocking.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.08%. Comparing base (16db5b4) to head (d86d07a).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2178   +/-   ##
=========================================
  Coverage     97.08%   97.08%           
=========================================
  Files           536      536           
  Lines         36979    36996   +17     
=========================================
+ Hits          35901    35918   +17     
  Misses         1078     1078           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

do we need a similar check in the add runtime flow? I believe right now we'll fail after writing files if uv/npm is missing based on the code:

agentcore-cli/src/core/project/manager.tsx

Lines 338 to 343 in a24c744

	const spec = await this.scaffoldRuntimeResources(outputPath, input.resourceConfig);
	if (spec.runtimes) projectSpec.runtimes.push(...spec.runtimes);
	if (spec.memories) projectSpec.memories.push(...spec.memories);
	if (spec.credentials) projectSpec.credentials.push(...spec.credentials);
	yield* this.installRuntimeDependencies(outputPath);

[nborges-aws]

Good call out. Just updated the PR with a check for this flow as well

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[Hweinstock]

nit: could this be inside the switch to avoid the extra branching?

Hoping to clean this up anyway, so I say we merge and comeback.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)