[jariy17]

Problem

CUSTOM_JWT invocation failures were converted to SilentCLIError before any response output was written. Rejected bearer tokens therefore exited unsuccessfully without explaining the HTTP failure.

Fix

• represent Runtime invocation results as an explicit stream or rejected response
• cancel rejected CUSTOM_JWT response bodies without reading or parsing them
• report the HTTP status and request ID through the existing Runtime response writer
• render the same status-only failure in the interactive Runtime console
• keep transport failures visible and prevent rejected evaluation responses from being treated as model output
• preserve the existing silent root error only after a writer has emitted the failure summary

Validation

• bun test — 4,707 passed, 6 skipped
• affected Runtime suites — 116 passed
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• real READY CUSTOM_JWT Runtime with a synthetic invalid token: raw, JSON, output-file, stdin-token, and TUI paths each reported one HTTP 403 failure with no response bytes or token disclosure

bun run audit could not complete because the configured registry audit endpoint returned HTTP 404.

Closes #2745

[github-actions]

Package Tarball

aws-agentcore-1.0.1.tgz

How to install

gh release download pr-2751-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)