fix(tui): validate empty input in SecretInput before triggering cancel

.github/workflows/agent-restricted.yml

@@ -68,7 +68,7 @@ jobs:
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/build-and-test.yml

@@ -2,9 +2,9 @@ name: Build and Test
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'feat/**']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'feat/**']
 
 permissions:
   contents: read

.github/workflows/ci-failure-issue.yml

@@ -26,7 +26,7 @@ jobs:
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/cleanup-pr-tarballs.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/codeql.yml

@@ -4,9 +4,9 @@ on:
   push:
     branches: ['main']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'feat/**']
   pull_request_target:
-    branches: ['main']
+    branches: ['main', 'feat/**']
 
 # Cancel in-progress runs for PRs; never cancel runs on main (merges should not abort each other)
 concurrency:

.github/workflows/e2e-tests-full.yml

@@ -5,8 +5,11 @@ on:
       aws_region:
         description: 'AWS region for deployment'
         default: 'us-east-1'
+      cdk_branch:
+        description: 'Branch of CDK constructs repo to build from'
+        default: 'main'
   push:
-    branches: [main]
+    branches: [main, 'feat/**']
 
 env:
   AGENTCORE_TELEMETRY_DISABLED: '1'
@@ -32,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'main' }}
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '20.x'
@@ -51,7 +54,7 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v2
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}
@@ -63,14 +66,34 @@ jobs:
           BUILD_PREVIEW: ${{ matrix.cli-build == 'preview' && '1' || '0' }}
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: aws
-      - name: Build CDK package from main
+      - name: Build CDK package
         run: |
-          git clone --depth 1 "https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git" /tmp/cdk-repo
+          if [ -n "${{ inputs.cdk_branch }}" ] && [ "${{ inputs.cdk_branch }}" != "main" ]; then
+            CDK_BRANCH="${{ inputs.cdk_branch }}"
+          elif [ "${{ github.ref_name }}" != "main" ]; then
+            CDK_BRANCH="main"
+            REPO_URL="https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git"
+            # Check if a branch exists on the CDK repo with the same 
+            if git ls-remote --exit-code --heads "$REPO_URL" "${{ github.ref_name }}" > /dev/null 2>&1; then
+              CDK_BRANCH="${{ github.ref_name }}"
+            else
+              # Check if a branch exists with _ subbed for -. (legacy support for summit branch) 
+              ALT="${{ github.ref_name }}"
+              ALT="${ALT//_/-}"
+              if git ls-remote --exit-code --heads "$REPO_URL" "$ALT" > /dev/null 2>&1; then
+                CDK_BRANCH="$ALT"
+              fi
+            fi
+          else
+            CDK_BRANCH="main"
+          fi
+          echo "Using CDK branch: $CDK_BRANCH"
+          git clone --depth 1 --branch "$CDK_BRANCH" "https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git" /tmp/cdk-repo
           cd /tmp/cdk-repo
           npm ci
           npm run build

.github/workflows/e2e-tests.yml

@@ -5,11 +5,8 @@ on:
       aws_region:
         description: 'AWS region for deployment'
         default: 'us-east-1'
-      cdk_branch:
-        description: 'CDK repo branch to build from (default: main)'
-        default: 'main'
   pull_request_target:
-    branches: [main]
+    branches: [main, feat/**]
 
 concurrency:
   group: e2e-${{ github.event.pull_request.number || github.ref }}
@@ -50,8 +47,6 @@ jobs:
     runs-on: ubuntu-latest
     environment: e2e-testing
     timeout-minutes: 30
-    env:
-      AGENTCORE_TELEMETRY_DISABLED: '1'
     steps:
       - uses: actions/checkout@v6
         with:
@@ -75,110 +70,53 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v2
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}
           parse-json-secrets: true
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: aws
-      # Clone CDK repo for bundle script (requires App token for private repo access)
-      - name: Clone CDK repo
+      - name: Build CDK package from main
         run: |
-          CDK_BRANCH="${{ inputs.cdk_branch || 'main' }}"
-          echo "Cloning CDK from branch: $CDK_BRANCH"
-          git clone --depth 1 --branch "$CDK_BRANCH" "https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git" /tmp/cdk-repo
+          git clone --depth 1 "https://x-access-token:${CDK_REPO_TOKEN}@github.com/${CDK_REPO}.git" /tmp/cdk-repo
+          cd /tmp/cdk-repo
+          npm ci
+          npm run build
+          TARBALL=$(npm pack --pack-destination "$RUNNER_TEMP" | tail -1)
+          echo "CDK_TARBALL=$RUNNER_TEMP/$TARBALL" >> "$GITHUB_ENV"
         env:
           CDK_REPO_TOKEN: ${{ steps.app-token.outputs.token }}
           CDK_REPO: ${{ secrets.CDK_REPO_NAME }}
 
       - run: npm ci
-
-      - name: Bundle GA and preview tarballs
-        run: |
-          npm run bundle
-          GA_TARBALL=$(ls aws-agentcore-*.tgz | grep -v preview | head -1)
-          PREVIEW_TARBALL=$(ls aws-agentcore-*-preview-*.tgz | head -1)
-          echo "GA_TARBALL=$PWD/$GA_TARBALL" >> "$GITHUB_ENV"
-          echo "PREVIEW_TARBALL=$PWD/$PREVIEW_TARBALL" >> "$GITHUB_ENV"
-        env:
-          AGENTCORE_CDK_PATH: /tmp/cdk-repo
-
-      - name: Install GA CLI globally
-        run: npm install -g "$GA_TARBALL"
+      - run: npm run build
+      - name: Install CLI globally
+        run: npm install -g "$(npm pack | tail -1)"
 
       - name: Detect changed e2e test files
         id: changed
         run: |
           BASE_SHA=${{ github.event.pull_request.base.sha || 'HEAD~1' }}
-          # If any helper file changed, run all e2e tests
-          HELPERS_CHANGED=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.ts' \
-            | grep -v '\.test\.ts$' | head -1)
-          if [ -n "$HELPERS_CHANGED" ]; then
-            GA_EXTRA=$(find e2e-tests -name '*.test.ts' \
-              | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \
-              | grep -v '^e2e-tests/payment-strands-bedrock\.test\.ts$' \
-              | grep -v '^e2e-tests/harness-' \
-              | tr '\n' ' ')
-            HARNESS_EXTRA=$(find e2e-tests -name 'harness-*.test.ts' \
-              | grep -v '^e2e-tests/harness-bedrock\.test\.ts$' \
-              | tr '\n' ' ')
-          else
-            GA_EXTRA=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.test.ts' \
-              | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \
-              | grep -v '^e2e-tests/payment-strands-bedrock\.test\.ts$' \
-              | grep -v '^e2e-tests/harness-' \
-              | tr '\n' ' ')
-            HARNESS_EXTRA=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/harness-*.test.ts' \
-              | grep -v '^e2e-tests/harness-bedrock\.test\.ts$' \
-              | tr '\n' ' ')
-          fi
-          echo "ga_extra=$GA_EXTRA" >> "$GITHUB_OUTPUT"
-          echo "harness_extra=$HARNESS_EXTRA" >> "$GITHUB_OUTPUT"
-          echo "GA extra tests: ${GA_EXTRA:-none}"
-          echo "Harness extra tests: ${HARNESS_EXTRA:-none}"
-
-      - name: Run E2E tests (GA)
-        env:
-          AWS_ACCOUNT_ID: ${{ steps.aws.outputs.account_id }}
-          AWS_REGION: ${{ inputs.aws_region || 'us-east-1' }}
-          ANTHROPIC_API_KEY: ${{ env.E2E_ANTHROPIC_API_KEY }}
-          OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }}
-          GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }}
-          E2E_EFS_ACCESS_POINT_ARN: ${{ env.E2E_EFS_ACCESS_POINT_ARN }}
-          E2E_S3_ACCESS_POINT_ARN: ${{ env.E2E_S3_ACCESS_POINT_ARN }}
-          E2E_FILESYSTEM_SUBNET_ID: ${{ env.E2E_FILESYSTEM_SUBNET_ID }}
-          E2E_FILESYSTEM_SECURITY_GROUP_ID: ${{ env.E2E_FILESYSTEM_SECURITY_GROUP_ID }}
-          # CoinbaseCDP testnet creds for payment-strands-bedrock.test.ts. Sourced from
-          # the same E2E secret (keys CDP_API_KEY_ID / CDP_API_KEY_SECRET / CDP_WALLET_SECRET),
-          # which parse-json-secrets surfaces as E2E_CDP_*; remapped here to the unprefixed
-          # names the test reads. Absent on forks -> test self-skips via its hasCdpCreds gate.
-          CDP_API_KEY_ID: ${{ env.E2E_CDP_API_KEY_ID }}
-          CDP_API_KEY_SECRET: ${{ env.E2E_CDP_API_KEY_SECRET }}
-          CDP_WALLET_SECRET: ${{ env.E2E_CDP_WALLET_SECRET }}
-        run:
-          npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts e2e-tests/payment-strands-bedrock.test.ts ${{
-          steps.changed.outputs.ga_extra }}
-
-      - name: Install preview CLI globally
-        run: npm install -g "$PREVIEW_TARBALL"
+          CHANGED=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.test.ts' \
+            | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \
+            | tr '\n' ' ')
+          echo "extra_tests=$CHANGED" >> "$GITHUB_OUTPUT"
+          echo "Changed e2e tests: ${CHANGED:-none}"
 
-      - name: Run E2E tests (preview/harness)
+      - name: Run E2E tests
         env:
           AWS_ACCOUNT_ID: ${{ steps.aws.outputs.account_id }}
           AWS_REGION: ${{ inputs.aws_region || 'us-east-1' }}
           ANTHROPIC_API_KEY: ${{ env.E2E_ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }}
           GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }}
-          E2E_EFS_ACCESS_POINT_ARN: ${{ env.E2E_EFS_ACCESS_POINT_ARN }}
-          E2E_S3_ACCESS_POINT_ARN: ${{ env.E2E_S3_ACCESS_POINT_ARN }}
-          E2E_FILESYSTEM_SUBNET_ID: ${{ env.E2E_FILESYSTEM_SUBNET_ID }}
-          E2E_FILESYSTEM_SECURITY_GROUP_ID: ${{ env.E2E_FILESYSTEM_SECURITY_GROUP_ID }}
-          BUILD_PREVIEW: '1'
-        run: npx vitest run --project e2e e2e-tests/harness-bedrock.test.ts ${{ steps.changed.outputs.harness_extra }}
+          CDK_TARBALL: ${{ env.CDK_TARBALL }}
+        # Always run strands-bedrock as baseline, plus any e2e test files changed in the PR
+        run: npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts ${{ steps.changed.outputs.extra_tests }}

.github/workflows/lint.yml

@@ -2,9 +2,9 @@ name: Quality and Safety Checks
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'feat/**']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'feat/**']
 
 permissions:
   contents: read
@@ -29,7 +29,7 @@ jobs:
         uses: actions/cache/save@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
 
   format:
     needs: setup
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
       - run: npm run format:check
 
   lint:
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
       - run: npm run lint
 
   security:
@@ -70,7 +70,7 @@ jobs:
       - uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
       - run: npm run security:audit
 
   secrets:
@@ -84,7 +84,7 @@ jobs:
       - uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
       - run: npm run secrets:check
 
   typecheck:
@@ -98,11 +98,10 @@ jobs:
       - uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: node-modules-${{ hashFiles('npm-shrinkwrap.json') }}
+          key: node-modules-${{ hashFiles('package-lock.json') }}
       - run: npm run typecheck
 
   schema-check:
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'release') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6