fix(tui): validate empty input in SecretInput before triggering cancel

[notgitika]

Summary

• Fixes the "add credential" TUI flow going back to the previous step when pressing Enter with no API key input
• SecretInput now runs customValidation on empty values before falling through to onCancel, showing the validation error instead of navigating back
• Moved the empty-value early return in validateValue() to after customValidation runs, so validators that reject empty strings are respected

Test plan

• Added unit test: "shows validation error instead of calling onCancel when customValidation rejects empty value"
• All 24 existing SecretInput tests continue to pass
• Behavior unchanged when no customValidation is provided (empty Enter still calls onCancel)
• Behavior unchanged when onSkip is provided (empty Enter still calls onSkip)

Fixes #1618

[github-actions]

Package Tarball

aws-agentcore-0.19.0.tgz

How to install

gh release download pr-1667-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.19.0.tgz

[agentcore-cli-automation]

Thanks for fixing the empty-Enter regression — the core change to validateValue() and the onSubmit handler in SecretInput.tsx looks correct, and the new test covers the bug well.

A few things to address before this can merge:

1. The branch is severely out of date. GitHub reports 497 changed files / +41,833 / -21,925, and a git diff origin/main HEAD for this branch shows 272 files changed (+3,480 / -13,701). The branch was forked from main at ef1e0667 and is missing ~57 commits, so as-is this PR would revert a large amount of unrelated work (workflows, e2e/integ tests, assets, schemas, AWS clients, etc.). GitHub also marks it as mergeable: false. Please rebase onto current main (or open a fresh PR off main) so the diff only contains the two files you actually intended to change.

2. Unrelated removal of stripAnsi in the placeholder test is likely a regression — see the inline comment.

3. onSkip is silently unreachable when an empty-rejecting customValidation is also provided — minor, see the inline comment.

No telemetry concerns and no excessive mocking in the test — those look fine.

[agentcore-cli-automation]

This change (removing stripAnsi and the import on line 4) is unrelated to the bug being fixed, and it will almost certainly break this test.

When placeholder is set, the empty-value branch in SecretInput renders the first character through <Cursor> (which wraps it in backgroundColor="white" color="black" ANSI codes) and placeholder.slice(1) separately through <Text dimColor> (which wraps it in dim ANSI codes). So the raw frame for "sk-..." ends up roughly as \x1b[47m\x1b[30ms\x1b[39m\x1b[49m\x1b[2mk-...\x1b[22m — the s and the k-... are separated by escape sequences, so lastFrame().toContain('sk-...') no longer matches.

The same pattern is visible elsewhere in this file (e.g. expect(lastFrame()).toContain('PENAI_API_KEY') on what is otherwise an OPENAI_API_KEY placeholder — the O is missing precisely because it goes through Cursor). Please restore the stripAnsi wrapper (and the import) so the test continues to pass, or drop this hunk entirely since it isn't part of the fix.

[agentcore-cli-automation]

When onSkip is provided and customValidation rejects empty values, this branch makes onSkip unreachable: an empty Enter will always hit the setShowError(true); return; path above. None of the current call sites combine both, but the prop docs still advertise "Leave empty to skip", so this is a footgun for future callers.

A couple of options:

• Document the constraint on the customValidation JSDoc (e.g. "if onSkip is provided, customValidation must accept empty input, otherwise skip will be unreachable").
• Or skip the validation step when onSkip is set, so that empty Enter always means "skip" regardless of customValidation — matching the existing prop semantics more closely.
• Or only run customValidation on empty input when onSkip is not provided (i.e. move the validation call inside the else branch).

Up to you which one you prefer.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)