fix: reuse target credential provider for invoke and logs

[nborges-aws]

Description

Fixes bug where agentcore project invoke used the selected target’s credentials to resolve deployed resources, but used the AWS credential chain for the actual runtime or harness invocation (or cloudwatch request). This could cause a mismatch in the AWS account used for project resolution and project operations.

Changes:

• Plum the verified target credential provider through project resource resolution
• Reuse credential provider for both CLI and TUI runtime/harness invocation paths, as well as runtime log requests
• Ensures clients use the same account/region that the project target was resolved against
• Narrow the resolved-target from AwsCredentials to AwsCredentialProvider to ensure raw credentials are not accepted

Only the credential provider function is carried in memory. Raw credentials are not persisted by this change.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• bun run test (3218 pass, 0 fail)
• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Well-scoped fix for a real correctness bug. The change consistently threads the target-verified credential provider from CdkBackend.resolveDeployedResources through ResolvedDeployedResource into the invoke/log handlers, and coreOptsFromCtx picks it up automatically so downstream pickers (RuntimeEndpointPicker, HarnessEndpointPicker, HarnessChat, etc.) inherit the correct account/region binding without extra plumbing.

Things I specifically checked and am comfortable with:

• Trust boundary: AwsCredentialProvider (narrowed to AwsCredentialIdentityProvider) prevents raw credentials from leaking into the type. Only the provider closure is carried; nothing is persisted.
• Target echo comment in manager.tsx: The existing safeguard ({ ...resource, target: resolved.target }) is preserved; credentialProvider is generated by the backend from credentialsForTarget (which asserts account === target.account), so trusting the backend echo here is fine.
• Coverage of callers: resolveDeployedResource is only used by handlers/project/invoke/{runtime,harness}.tsx, handlers/project/invoke/screen.tsx, and handlers/project/log/runtime.tsx — all four are updated. Test doubles in invoke/index.test.tsx, invoke.screen.test.tsx, log/runtime.test.tsx, and cdk.test.ts are all updated to match the new shape.
• Two propagation patterns: the invoke path pins into context via AwsCredentialProviderKey (needed so child components/pickers inherit it via coreOptsFromCtx), while log/runtime.tsx overrides credentials on the options object directly. Both are correct; the divergence is intentional since the log handler doesn't spawn a TUI that reuses the ctx.
• Telemetry: not applicable — this is a bug fix with no new user-facing surface.

No changes requested.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.02%. Comparing base (9dcc38b) to head (9138c67).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2307   +/-   ##
=========================================
  Coverage     97.02%   97.02%           
=========================================
  Files           579      579           
  Lines         39446    39456   +10     
=========================================
+ Hits          38271    38281   +10     
  Misses         1175     1175           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

make sense, nice well scoped fix!