chore: make TUI harness build opt-in for dev only

The harness is dev-only tooling for AI agents and integration tests.
It should not ship to end users who install the CLI.

- Gate MCP harness esbuild behind BUILD_HARNESS=1 env var
- Remove agent-tui-harness bin entry from package.json
- Add !dist/mcp-harness to files array (npm publish exclusion)
- Remove node-pty from optionalDependencies (stays in devDependencies)
- Add build:harness script, update test:tui to use it
- Update AGENTS.md to reference npm run build:harness

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: aidandaly24

AGENTS.md

@@ -129,7 +129,8 @@ The TUI harness provides MCP tools for programmatically driving the AgentCore CL
 
 ### Getting Started
 
-1. Run `npm run build` to compile the project before using the harness tools.
+1. Run `npm run build:harness` to compile both the CLI and the MCP harness binary. The harness is dev-only tooling and
+   is not included in the standard `npm run build`.
 2. Call `tui_launch` to start a TUI session. It returns a `sessionId` that all subsequent tool calls require.
    - `tui_launch({})` with no arguments defaults to `command="node"`, `args=["dist/cli/index.mjs"]` (the AgentCore CLI).
    - The `cwd` parameter determines what the TUI sees: if `cwd` is a directory with an `agentcore.config.json`, the TUI
@@ -357,6 +358,6 @@ When `tui_send_keys` doesn't change the screen:
 
 When `tui_launch` returns an error:
 
-1. Ensure `npm run build` was run recently -- the CLI binary at `dist/cli/index.mjs` must be up to date.
+1. Ensure `npm run build:harness` was run recently -- both the CLI binary and the MCP harness must be up to date.
 2. Check that `cwd` points to a valid directory.
 3. The error response includes the screen content at time of failure -- use it to diagnose.

esbuild.config.mjs

@@ -61,11 +61,17 @@ fs.chmodSync('./dist/cli/index.mjs', '755');
 
 console.log('CLI build complete: dist/cli/index.mjs');
 
-// MCP harness build — only run if the entry point source exists.
-// The source file is created separately; skip gracefully until then.
+// ---------------------------------------------------------------------------
+// MCP harness build — opt-in via BUILD_HARNESS=1
+//
+// The TUI harness is dev-only tooling for AI agents and integration tests.
+// It is NOT shipped to end users. Build it separately with:
+//   BUILD_HARNESS=1 node esbuild.config.mjs
+//   npm run build:harness
+// ---------------------------------------------------------------------------
 const mcpEntryPoint = './src/tui-harness/mcp/index.ts';
 
-if (fs.existsSync(mcpEntryPoint)) {
+if (process.env.BUILD_HARNESS === '1' && fs.existsSync(mcpEntryPoint)) {
   await esbuild.build({
     entryPoints: [mcpEntryPoint],
     outfile: './dist/mcp-harness/index.mjs',
@@ -91,6 +97,6 @@ if (fs.existsSync(mcpEntryPoint)) {
   fs.chmodSync('./dist/mcp-harness/index.mjs', '755');
 
   console.log('MCP harness build complete: dist/mcp-harness/index.mjs');
-} else {
+} else if (process.env.BUILD_HARNESS === '1') {
   console.log(`MCP harness build skipped: entry point ${mcpEntryPoint} does not exist yet`);
 }

package.json

@@ -30,8 +30,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "agentcore": "dist/cli/index.mjs",
-    "agent-tui-harness": "dist/mcp-harness/index.mjs"
+    "agentcore": "dist/cli/index.mjs"
   },
   "exports": {
     ".": {
@@ -41,14 +40,16 @@
   },
   "files": [
     "dist",
-    "scripts"
+    "scripts",
+    "!dist/mcp-harness"
   ],
   "scripts": {
     "preinstall": "node scripts/check-old-cli.mjs",
     "build": "npm run build:lib && npm run build:cli && npm run build:assets",
     "build:lib": "tsc -p tsconfig.build.json",
     "build:cli": "node esbuild.config.mjs",
     "build:assets": "node scripts/copy-assets.mjs",
+    "build:harness": "BUILD_HARNESS=1 node esbuild.config.mjs",
     "cli": "npx tsx src/cli/index.ts",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src/",
@@ -66,7 +67,7 @@
     "test:unit": "vitest run --project unit --coverage",
     "test:e2e": "vitest run --project e2e",
     "test:update-snapshots": "vitest run --project unit --update",
-    "test:tui": "npm run build && vitest run --project tui"
+    "test:tui": "npm run build:harness && vitest run --project tui"
   },
   "dependencies": {
     "@aws-cdk/toolkit-lib": "^1.16.0",
@@ -129,9 +130,6 @@
     "typescript-eslint": "^8.50.1",
     "vitest": "^4.0.18"
   },
-  "optionalDependencies": {
-    "node-pty": "^1.1.0"
-  },
   "overridesComments": {
     "minimatch": "GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch 10.0.0-10.2.2 has ReDoS vulnerabilities. Multiple transitive deps (eslint, typescript-eslint, eslint-plugin-import, eslint-plugin-react, prettier-plugin-sort-imports, aws-cdk-lib) pin older versions. Remove this override once upstream packages update their minimatch dependency to >=10.2.3.",
     "fast-xml-parser": "GHSA-fj3w-jwp8-x2g3: fast-xml-parser <5.3.8 has stack overflow in XMLBuilder. Transitive via @aws-sdk/xml-builder. Remove this override once @aws-sdk updates to fast-xml-parser >=5.3.8."