Summary
Two separate projects that share the same name (in agentcore.json) and target, deployed to the same account+region, resolve to the same CloudFormation stack. The second deploy updates/overwrites the first project's stack instead of creating its own.
Repro
- Create two projects in different directories, both
name: "demo".
agentcore deploy --target default from each, same account+region.- Both map to stack
AgentCore-demo-default; the second deploy overwrites the first's stack.
Root cause
Stack identity is derived solely from (project name, target name) — AgentCore-<name>-<target> (src/assets/cdk/bin/cdk.ts toStackName). The project spec has no stable unique id distinct from the human-chosen name, and the agentcore:project-name tag is just the name, so nothing disambiguates two same-named projects. The deploy path only verifies the account matches the target (src/core/project/backends/cdk.ts), not project identity.
Impact
Silent overwrite of another project's deployed resources when names collide in a shared account+region.
Suggested fix
Generate a stable project id at project init, store it committed in agentcore.json, stamp it as a stack tag (e.g. agentcore:project-id), and refuse to deploy when an existing stack of that name carries a different id.
Summary
Two separate projects that share the same
name(inagentcore.json) and target, deployed to the same account+region, resolve to the same CloudFormation stack. The second deploy updates/overwrites the first project's stack instead of creating its own.Repro
name: "demo".agentcore deploy --target defaultfrom each, same account+region.AgentCore-demo-default; the second deploy overwrites the first's stack.Root cause
Stack identity is derived solely from
(project name, target name)—AgentCore-<name>-<target>(src/assets/cdk/bin/cdk.tstoStackName). The project spec has no stable unique id distinct from the human-chosenname, and theagentcore:project-nametag is just the name, so nothing disambiguates two same-named projects. The deploy path only verifies the account matches the target (src/core/project/backends/cdk.ts), not project identity.Impact
Silent overwrite of another project's deployed resources when names collide in a shared account+region.
Suggested fix
Generate a stable project id at
project init, store it committed inagentcore.json, stamp it as a stack tag (e.g.agentcore:project-id), and refuse to deploy when an existing stack of that name carries a different id.