fix(pause-online-insights): reject mismatched --name and --arn#1601
Conversation
When both a config name and --arn were passed to `agentcore pause/resume online-insights`, the ARN silently won and the name was ignored. If they referred to different configs, the wrong config was paused with no warning. Now we cross-check: if both are provided, look up the named config and verify its configId matches the ARN's. Mismatches return a clear error explaining which config each side resolves to. Passing only one (or matching values) continues to work. Bug bash item aws#15 (P1).
github-actions
Bot
added
the
agentcore-harness-reviewing
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
Package TarballHow to installgh release download pr-1601-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.2.tgz |
agentcore-cli-automation
left a comment
agentcore-cli-automation
left a comment
There was a problem hiding this comment.
Nice targeted fix for a real footgun — silently picking the ARN when both were passed was the worst-of-both-worlds behavior. Two concerns worth addressing before merge around how the new cross-validation interacts with the --arn-without-project flow and how thoroughly it cross-checks the two inputs (details inline).
One side note (not introduced by this PR but now affects the new code path): in handlePauseResume, every resolution error is wrapped as ResourceNotFoundError at line 111. The mismatch error this PR adds is a validation/argument error, not a missing-resource error — there's a ValidationError class in src/lib/errors/types.ts that's a better fit and would give telemetry / error-classification downstream the right signal. Feel free to defer if you'd rather keep this PR scoped, but worth a follow-up.
github-actions
Bot
removed
the
agentcore-harness-reviewing
Addresses review feedback: - requireProject() is now called whenever a config name is provided, even alongside --arn, so the user gets a clear error outside a project. - Region mismatch between name resolution and ARN is now rejected, closing the same class of silent inconsistency on the region axis.
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
agentcore-devx-automation
Bot
added
the
claude-security-reviewing
|
Claude Security Review: no high-confidence findings. (run) |
agentcore-devx-automation
Bot
removed
the
claude-security-reviewing
3 participants
Summary
When both a config name argument and
--arnwere passed toagentcore pause online-insights/agentcore resume online-insights, the ARN silently won and the name was ignored. If the two referred to different configs, the wrong config was paused with no error.Now
resolveConfigcross-checks: if both are provided, the named config is looked up and itsconfigIdmust match the ARN's. Mismatches return a clear error showing which config each side resolves to. Passing only one (or matching values) is unchanged.Bug: "--arn and config name accept mismatched values without checking."