fix: add format validation to non-interactive VPC path, consolidate VpcOptions type

- validateVpcOptions now calls validateSubnetIds/validateSecurityGroupIds
  so the non-interactive CLI path gives friendly format errors instead of
  falling through to Zod regex failures
- CreateOptions, AddAgentOptions, and AgentPrimitive.AddAgentOptions now
  extend VpcOptions instead of redeclaring networkMode/subnets/securityGroups

Author: tejaskash

src/cli/commands/add/types.ts

@@ -1,8 +1,9 @@
 import type { GatewayAuthorizerType, ModelProvider, SDKFramework, TargetLanguage } from '../../../schema';
 import type { MemoryOption } from '../../tui/screens/generate/types';
+import type { VpcOptions } from '../shared/vpc-utils';
 
 // Agent types
-export interface AddAgentOptions {
+export interface AddAgentOptions extends VpcOptions {
   name?: string;
   type?: 'create' | 'byo';
   build?: string;
@@ -11,9 +12,6 @@ export interface AddAgentOptions {
   modelProvider?: ModelProvider;
   apiKey?: string;
   memory?: MemoryOption;
-  networkMode?: string;
-  subnets?: string;
-  securityGroups?: string;
   codeLocation?: string;
   entrypoint?: string;
   json?: boolean;

src/cli/commands/create/types.ts

@@ -1,4 +1,6 @@
-export interface CreateOptions {
+import type { VpcOptions } from '../shared/vpc-utils';
+
+export interface CreateOptions extends VpcOptions {
   name?: string;
   agent?: boolean;
   defaults?: boolean;
@@ -8,9 +10,6 @@ export interface CreateOptions {
   modelProvider?: string;
   apiKey?: string;
   memory?: string;
-  networkMode?: string;
-  subnets?: string;
-  securityGroups?: string;
   outputDir?: string;
   skipGit?: boolean;
   skipPythonSetup?: boolean;

src/cli/commands/shared/__tests__/vpc-utils.test.ts

@@ -1,4 +1,4 @@
-import { parseCommaSeparatedList, validateSecurityGroupIds, validateSubnetIds } from '../vpc-utils';
+import { parseCommaSeparatedList, validateSecurityGroupIds, validateSubnetIds, validateVpcOptions } from '../vpc-utils';
 import { describe, expect, it } from 'vitest';
 
 describe('parseCommaSeparatedList', () => {
@@ -79,3 +79,34 @@ describe('validateSecurityGroupIds', () => {
     expect(result).toContain('Invalid security group ID format');
   });
 });
+
+describe('validateVpcOptions - format validation', () => {
+  it('rejects VPC mode with invalid subnet format', () => {
+    const result = validateVpcOptions({
+      networkMode: 'VPC',
+      subnets: 'not-a-subnet',
+      securityGroups: 'sg-12345678',
+    });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('Invalid subnet ID format');
+  });
+
+  it('rejects VPC mode with invalid security group format', () => {
+    const result = validateVpcOptions({
+      networkMode: 'VPC',
+      subnets: 'subnet-12345678',
+      securityGroups: 'not-a-sg',
+    });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('Invalid security group ID format');
+  });
+
+  it('accepts VPC mode with valid subnet and security group formats', () => {
+    const result = validateVpcOptions({
+      networkMode: 'VPC',
+      subnets: 'subnet-12345678, subnet-abcdef12',
+      securityGroups: 'sg-12345678',
+    });
+    expect(result.valid).toBe(true);
+  });
+});

src/cli/commands/shared/vpc-utils.ts

@@ -69,6 +69,11 @@ export function validateVpcOptions(options: VpcOptions): VpcValidationResult {
     if (!options.securityGroups) {
       return { valid: false, error: '--security-groups is required when network mode is VPC' };
     }
+
+    const subnetResult = validateSubnetIds(options.subnets);
+    if (subnetResult !== true) return { valid: false, error: subnetResult };
+    const sgResult = validateSecurityGroupIds(options.securityGroups);
+    if (sgResult !== true) return { valid: false, error: sgResult };
   }
 
   if (options.networkMode !== 'VPC' && (options.subnets || options.securityGroups)) {

src/cli/primitives/AgentPrimitive.tsx

@@ -12,6 +12,7 @@ import type {
 import { AgentEnvSpecSchema, CREDENTIAL_PROVIDERS } from '../../schema';
 import type { AddAgentOptions as CLIAddAgentOptions } from '../commands/add/types';
 import { validateAddAgentOptions } from '../commands/add/validate';
+import type { VpcOptions } from '../commands/shared/vpc-utils';
 import { VPC_ENDPOINT_WARNING, parseCommaSeparatedList } from '../commands/shared/vpc-utils';
 import { getErrorMessage } from '../errors';
 import {
@@ -35,7 +36,7 @@ import { dirname, join } from 'path';
 /**
  * Options for adding an agent resource.
  */
-export interface AddAgentOptions {
+export interface AddAgentOptions extends VpcOptions {
   name: string;
   type: 'create' | 'byo';
   buildType: BuildType;
@@ -44,9 +45,6 @@ export interface AddAgentOptions {
   modelProvider: ModelProvider;
   apiKey?: string;
   memory?: MemoryOption;
-  networkMode?: string;
-  subnets?: string;
-  securityGroups?: string;
   codeLocation?: string;
   entrypoint?: string;
 }