[nborges-aws]

Description

Follow up to #2761.

PR 2761's lost-state guard caused an unintended regression in the migration path. The regression blocked a migrated project from deploying a new target if another target already used its v0 payment provider. The new target had no state entry to restore, and deleting the provider would break the existing target.

This PR skips that guard for projects using v0 provider names. Keep it for v1-native projects. Added a regression test for the previously blocked deployment, which confirms behavior is addressed.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran bun test
• I ran the relevant end-to-end tests with bun run test:e2e, or explained why they are not applicable
  (CI does not run them for you)
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check
• I ran bun run audit
• I ran bun run secrets:check
• I ran bun run build
• If I modified src/assets/, I updated affected snapshots with bun test <test-file> --update-snapshots and committed them
• If I re-recorded fixtures or golden files, every change beyond account identifiers is explained
  by this PR
• This PR does not change command.md (the release workflow regenerates it)

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-1.0.1.tgz

How to install

gh release download pr-2774-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-1.0.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.50%. Comparing base (9a321a9) to head (fe4635c).

Additional details and impacted files

@@           Coverage Diff           @@
##             v1.x    #2774   +/-   ##
=======================================
  Coverage   96.50%   96.50%           
=======================================
  Files         709      709           
  Lines       58861    58865    +4     
=======================================
+ Hits        56801    56805    +4     
  Misses       2060     2060           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

I traced the change against v1.x and #2761. The fix is correctly scoped: the guard only ever fired for projects where providerName() and previousProviderName() disagree, which is the migrated case (migratedFrom === "v1", legacy === undefined) — for a raw v0 project both resolve to the bare credential name, so the inner condition was already unreachable. The v1-native path stays guarded and is still covered by the existing "fails before writing when an old payment provider is not recorded for the target" test, so the absent case of the new condition is exercised. The added regression test asserts behavior (old provider untouched, new provider created under a distinct name) rather than restating the implementation, and it fails on base.

Two non-blocking notes:

1. The lost-state protection is now gone for migrated projects, not narrowed (src/core/project/backends/cdk/credentials.ts:337-343). A migrated project whose target genuinely lost its deployed-state.json entry now silently creates example-<target>-wallet-<hash> and orphans the v0 bare provider, where before it got the explicit "restore the entry, or delete that provider if unused" error. That looks like a deliberate trade-off (the provisioner only sees this target's recorded map, so existence of the bare provider genuinely can't distinguish the two cases) — if you want the protection back for migrated projects, the data is already at hand in src/core/project/backends/cdk.ts:277-279, which reads the whole targets map; passing the provider names/ARNs claimed by other targets into CredentialProvisionInput would let the guard skip only when the bare provider is demonstrably in use elsewhere. Fine as a follow-up if you'd rather keep this PR minimal.

2. previousName !== provider is now dead inside the guard (line 346). With keepsV0CredentialNames excluded, previousName is always ${project.name}_${targetName}_${credential.name} (underscores) and provider is always the hashed form (underscores replaced), so the comparison can never be false. It reads as a meaningful case that no longer exists; dropping it (and inlining the underscored name) would make the remaining branch say what it does. Relatedly, the replacement comment explains only the exclusion — a reader of the if no longer learns what the guard protects against; keeping one line of the original "untracked orphan" rationale alongside the new one would help.