fix: pass requestHeaderAllowlist through create flow and fix tag command types (#643)

Two fixes:

1. The create flow was dropping requestHeaderAllowlist when building the
GenerateConfig from AddAgentConfig. Headers entered through the TUI
Advanced settings were collected correctly but never written to
agentcore.json because two GenerateConfig construction sites omitted
the field. Adds the missing field to useCreateFlow.ts (TUI create path)
and create/action.ts (CLI create path).

2. The tag command referenced a missing ./types module and stale
readMcpSpec/writeMcpSpec methods removed in the mcp.json merge (#605).
Creates the types file and updates gateway tag operations to use the
project spec instead.

Author: tejaskash

src/cli/commands/create/action.ts

@@ -136,6 +136,7 @@ export interface CreateWithAgentOptions {
   networkMode?: NetworkMode;
   subnets?: string[];
   securityGroups?: string[];
+  requestHeaderAllowlist?: string[];
   agentId?: string;
   agentAliasId?: string;
   region?: string;
@@ -158,6 +159,7 @@ export async function createProjectWithAgent(options: CreateWithAgentOptions): P
     networkMode,
     subnets,
     securityGroups,
+    requestHeaderAllowlist,
     skipGit,
     skipPythonSetup,
     onProgress,
@@ -234,6 +236,7 @@ export async function createProjectWithAgent(options: CreateWithAgentOptions): P
       networkMode,
       subnets,
       securityGroups,
+      requestHeaderAllowlist,
     };
 
     // Resolve credential strategy FIRST (new project has no existing credentials)

src/cli/commands/tag/__tests__/action.test.ts

@@ -0,0 +1,185 @@
+import { addTag, listTags, removeDefaultTag, removeTag, setDefaultTag } from '../action.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockReadProjectSpec, mockWriteProjectSpec, mockFindConfigRoot } = vi.hoisted(() => ({
+  mockReadProjectSpec: vi.fn(),
+  mockWriteProjectSpec: vi.fn(),
+  mockFindConfigRoot: vi.fn(),
+}));
+
+vi.mock('../../../../lib/index.js', () => ({
+  ConfigIO: class {
+    readProjectSpec = mockReadProjectSpec;
+    writeProjectSpec = mockWriteProjectSpec;
+  },
+  findConfigRoot: mockFindConfigRoot,
+  NoProjectError: class NoProjectError extends Error {
+    constructor() {
+      super('No AgentCore project found');
+      this.name = 'NoProjectError';
+    }
+  },
+}));
+
+const baseSpec = () => ({
+  name: 'TestProject',
+  version: 1,
+  tags: { 'agentcore:created-by': 'agentcore-cli' },
+  agents: [
+    {
+      type: 'AgentCoreRuntime',
+      name: 'myAgent',
+      build: 'CodeZip',
+      entrypoint: 'main.py',
+      codeLocation: 'app/myAgent',
+      runtimeVersion: 'python3.13',
+      protocol: 'HTTP',
+    },
+  ],
+  memories: [{ type: 'AgentCoreMemory', name: 'myMemory', eventExpiryDuration: 30, strategies: [] }],
+  credentials: [],
+  agentCoreGateways: [
+    {
+      name: 'myGateway',
+      targets: [],
+      authorizerType: 'NONE',
+      enableSemanticSearch: true,
+      exceptionLevel: 'NONE',
+    },
+  ],
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mockFindConfigRoot.mockReturnValue('/fake/config/root');
+  mockReadProjectSpec.mockResolvedValue(baseSpec());
+  mockWriteProjectSpec.mockResolvedValue(undefined);
+});
+
+describe('listTags', () => {
+  it('returns project defaults and all resources with merged tags', async () => {
+    const result = await listTags();
+    expect(result.projectDefaults).toEqual({ 'agentcore:created-by': 'agentcore-cli' });
+    expect(result.resources).toHaveLength(3);
+    expect(result.resources[0]).toEqual({
+      type: 'agent',
+      name: 'myAgent',
+      tags: { 'agentcore:created-by': 'agentcore-cli' },
+    });
+  });
+
+  it('filters by resource ref', async () => {
+    const result = await listTags('agent:myAgent');
+    expect(result.resources).toHaveLength(1);
+    expect(result.resources[0]!.name).toBe('myAgent');
+  });
+
+  it('throws on nonexistent resource', async () => {
+    await expect(listTags('agent:nonexistent')).rejects.toThrow('not found');
+  });
+});
+
+describe('addTag', () => {
+  it('adds tag to agent and writes spec', async () => {
+    const result = await addTag('agent:myAgent', 'env', 'prod');
+    expect(result.success).toBe(true);
+    expect(mockWriteProjectSpec).toHaveBeenCalledTimes(1);
+    const written = mockWriteProjectSpec.mock.calls[0]![0];
+    expect(written.agents[0].tags).toEqual({ env: 'prod' });
+  });
+
+  it('adds tag to gateway and writes project spec', async () => {
+    const result = await addTag('gateway:myGateway', 'env', 'prod');
+    expect(result.success).toBe(true);
+    expect(mockWriteProjectSpec).toHaveBeenCalledTimes(1);
+    const written = mockWriteProjectSpec.mock.calls[0]![0];
+    expect(written.agentCoreGateways[0].tags).toEqual({ env: 'prod' });
+  });
+
+  it('throws for invalid resource ref', async () => {
+    await expect(addTag('invalid', 'key', 'value')).rejects.toThrow('Invalid resource reference');
+  });
+
+  it('throws for nonexistent resource', async () => {
+    await expect(addTag('agent:noSuchAgent', 'key', 'value')).rejects.toThrow('not found');
+  });
+
+  it('rejects empty tag key', async () => {
+    await expect(addTag('agent:myAgent', '', 'value')).rejects.toThrow('Invalid tag key');
+  });
+
+  it('rejects tag key exceeding 128 chars', async () => {
+    await expect(addTag('agent:myAgent', 'k'.repeat(129), 'value')).rejects.toThrow('Invalid tag key');
+  });
+
+  it('rejects tag value exceeding 256 chars', async () => {
+    await expect(addTag('agent:myAgent', 'key', 'v'.repeat(257))).rejects.toThrow('Invalid tag value');
+  });
+
+  it('rejects tag key with invalid characters', async () => {
+    await expect(addTag('agent:myAgent', 'key\x00bad', 'value')).rejects.toThrow('Invalid tag key');
+  });
+
+  it('rejects tag value with invalid characters', async () => {
+    await expect(addTag('agent:myAgent', 'key', 'value\x00bad')).rejects.toThrow('Invalid tag value');
+  });
+
+  it('rejects agentcore: prefixed keys', async () => {
+    await expect(addTag('agent:myAgent', 'agentcore:custom', 'value')).rejects.toThrow('managed by the system');
+  });
+});
+
+describe('removeTag', () => {
+  it('removes tag from agent', async () => {
+    const spec = baseSpec();
+    (spec.agents[0] as Record<string, unknown>).tags = { env: 'prod', team: 'a' };
+    mockReadProjectSpec.mockResolvedValue(spec);
+
+    const result = await removeTag('agent:myAgent', 'env');
+    expect(result.success).toBe(true);
+    const written = mockWriteProjectSpec.mock.calls[0]![0];
+    expect(written.agents[0].tags).toEqual({ team: 'a' });
+  });
+
+  it('throws when key not found with hint about defaults', async () => {
+    await expect(removeTag('agent:myAgent', 'nonexistent')).rejects.toThrow('remove-defaults');
+  });
+
+  it('rejects agentcore: prefixed keys', async () => {
+    await expect(removeTag('agent:myAgent', 'agentcore:created-by')).rejects.toThrow('managed by the system');
+  });
+});
+
+describe('setDefaultTag', () => {
+  it('sets project-level default tag', async () => {
+    const result = await setDefaultTag('team', 'platform');
+    expect(result.success).toBe(true);
+    const written = mockWriteProjectSpec.mock.calls[0]![0];
+    expect(written.tags).toEqual({ 'agentcore:created-by': 'agentcore-cli', team: 'platform' });
+  });
+
+  it('rejects agentcore: prefixed keys', async () => {
+    await expect(setDefaultTag('agentcore:custom', 'value')).rejects.toThrow('managed by the system');
+  });
+});
+
+describe('removeDefaultTag', () => {
+  it('rejects removal of agentcore: prefixed system tags', async () => {
+    await expect(removeDefaultTag('agentcore:created-by')).rejects.toThrow('managed by the system');
+  });
+
+  it('removes user-defined project-level default tag', async () => {
+    const spec = baseSpec();
+    (spec.tags as Record<string, string>).team = 'platform';
+    mockReadProjectSpec.mockResolvedValue(spec);
+
+    const result = await removeDefaultTag('team');
+    expect(result.success).toBe(true);
+    const written = mockWriteProjectSpec.mock.calls[0]![0];
+    expect(written.tags).toEqual({ 'agentcore:created-by': 'agentcore-cli' });
+  });
+
+  it('throws when key not found', async () => {
+    await expect(removeDefaultTag('nonexistent')).rejects.toThrow('not found');
+  });
+});