fix(cli): temporarily disable the --endpoint-url global flag

[jariy17]

Why

--endpoint-url behaved inconsistently across commands (bug-bash finding #5). Disable it for now rather than ripping out the mechanism.

What

• Unregister EndpointKey from root.groupFlags(...) (one line). --endpoint-url is now rejected as an unknown option.
• Kept intact (so re-enabling = add it back to groupFlags): EndpointKey definition, coreOptsFromCtx threading, the runtime-shell guard, and the internal endpointUrl option (still used by tests to point Core at mock endpoints).

Tests

• runtime/shell: now asserts --endpoint-url is rejected as an unknown option.
• gateway/invoke + memory event get: dropped the --endpoint-url arg + its threaded-option assertion.
• Full suite green (pre-existing handlebars failures unrelated); typecheck clean.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Changes requested

The code changes are clean and the rationale (temporarily disable --endpoint-url while keeping EndpointKey plumbing intact for easy re-enable) is well-documented in the code comments. However, user-facing docs still advertise the flag:

• README.md line 244 – The "Global flags" table still lists --endpoint-url as a supported global flag. Users following the README will hit an "unknown option '--endpoint-url'" error. Please remove this row (or annotate it as temporarily unavailable).
• README.md line 796–797 – The Runtime Shell section notes that shell "does not support --json or --endpoint-url". With the flag now globally rejected, this callout should be dropped or rephrased so it doesn't imply the flag is otherwise available.

(command.md also mentions it, but that file is auto-generated by scripts/generate-command-reference.mjs at release time, so no manual edit needed there.)

Non-blocking observation, mentioned only for awareness: the defensive endpointUrl !== undefined check in src/handlers/runtime/shell/operation.ts (lines 28–30) is now unreachable via the CLI, and the updated test in shell.test.tsx no longer exercises it. That's fine as defense-in-depth for programmatic callers / re-enable, and matches the "keep plumbing defined" intent — just noting it in case you'd rather drop the dead check.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.26%. Comparing base (a23e472) to head (260c75c).

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2350      +/-   ##
============================================
- Coverage     97.26%   97.26%   -0.01%     
============================================
  Files           610      610              
  Lines         40590    40590              
============================================
- Hits          39480    39479       -1     
- Misses         1110     1111       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.