feat: add VPC info messages to dev and invoke commands [3/3] (#426)

* feat: add VPC network mode to schema

Fix NetworkModeSchema enum from PUBLIC|PRIVATE to PUBLIC|VPC to match
the AWS API. Add NetworkConfigSchema for subnet and security group
validation, and networkConfig field to AgentEnvSpec with cross-field
validation requiring networkConfig when networkMode is VPC.

Changes:
- Fix NetworkModeSchema enum: PRIVATE → VPC
- Add NetworkConfigSchema (subnet/SG ID regex, min/max array bounds)
- Add networkConfig optional field to AgentEnvSpec
- Add superRefine cross-field validation
- Update LLM-compacted schema documentation
- Add 13 new unit tests for VPC schema validation

* feat: add VPC info messages to dev and invoke commands

Add informational messages when agents use VPC network mode:
- dev command: Note that VPC networking does not apply locally
- invoke command: Guidance about required VPC Endpoints (S3, ECR,
  Bedrock) and public internet access for non-Bedrock providers

Author: tejaskash

src/cli/commands/dev/command.tsx

@@ -144,6 +144,12 @@ export const registerDev = (program: Command) => {
           const targetAgent = project.agents.find(a => a.name === config.agentName);
           const providerInfo = targetAgent?.modelProvider ?? '(see agent code)';
 
+          if (targetAgent?.networkMode === 'VPC') {
+            console.warn(
+              'Warning: This agent uses VPC network mode. Local dev server runs outside your VPC. Network behavior may differ from deployed environment.'
+            );
+          }
+
           console.log(`Starting dev server...`);
           console.log(`Agent: ${config.agentName}`);
           console.log(`Provider: ${providerInfo}`);
@@ -178,6 +184,20 @@ export const registerDev = (program: Command) => {
           await new Promise(() => {});
         }
 
+        // Warn if the target agent uses VPC mode
+        {
+          const vpcAgent = opts.agent
+            ? project.agents.find(a => a.name === opts.agent)
+            : project.agents.length === 1
+              ? project.agents[0]
+              : undefined;
+          if (vpcAgent?.networkMode === 'VPC') {
+            console.warn(
+              'Warning: This agent uses VPC network mode. Local dev server runs outside your VPC. Network behavior may differ from deployed environment.'
+            );
+          }
+        }
+
         // Enter alternate screen buffer for fullscreen mode
         process.stdout.write(ENTER_ALT_SCREEN);
 

src/cli/commands/invoke/action.ts

@@ -67,6 +67,12 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
     return { success: false, error: 'No agents defined in configuration' };
   }
 
+  if (agentSpec.networkMode === 'VPC') {
+    console.warn(
+      'Warning: This agent uses VPC network mode. Invocation may require setting up VPC Endpoints for S3, ECR, Bedrock. If your agent uses a non-Bedrock model provider, VPC will require public internet access.'
+    );
+  }
+
   // Get the deployed state for this specific agent
   const agentState = targetState?.resources?.agents?.[agentSpec.name];