fix: prevent region override for post-deploy commands (#595)

Author: konippi

src/cli/commands/deploy/actions.ts

@@ -68,7 +68,7 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
     // Load targets and find the specified one
     startStep('Load deployment target');
-    const targets = await configIO.readAWSDeploymentTargets();
+    const targets = await configIO.resolveAWSDeploymentTargets();
     const target = targets.find(t => t.name === options.target);
     if (!target) {
       endStep('error', `Target "${options.target}" not found`);

src/cli/operations/deploy/__tests__/preflight.test.ts

@@ -29,6 +29,7 @@ vi.mock('../../../../lib/index.js', () => ({
     }
     readProjectSpec = mockReadProjectSpec;
     readAWSDeploymentTargets = mockReadAWSDeploymentTargets;
+    resolveAWSDeploymentTargets = mockReadAWSDeploymentTargets;
     readDeployedState = mockReadDeployedState;
     configExists = mockConfigExists;
   },

src/cli/operations/deploy/__tests__/teardown-utils.test.ts

@@ -27,6 +27,7 @@ vi.mock('../../../../lib/index.js', () => ({
   ConfigIO: class {
     readProjectSpec = mockReadProjectSpec;
     readAWSDeploymentTargets = mockReadAWSDeploymentTargets;
+    resolveAWSDeploymentTargets = mockReadAWSDeploymentTargets;
     readDeployedState = mockReadDeployedState;
     writeDeployedState = mockWriteDeployedState;
   },

src/cli/operations/deploy/preflight.ts

@@ -71,7 +71,7 @@ export async function validateProject(): Promise<PreflightContext> {
 
   const configIO = new ConfigIO({ baseDir: configRoot });
   const projectSpec = await configIO.readProjectSpec();
-  const awsTargets = await configIO.readAWSDeploymentTargets();
+  const awsTargets = await configIO.resolveAWSDeploymentTargets();
 
   // Validate that at least one agent or gateway is defined, unless this is a teardown deploy.
   //

src/cli/operations/deploy/teardown.ts

@@ -23,7 +23,7 @@ export interface DiscoverDeployedResult {
 export async function discoverDeployedTargets(configBaseDir?: string): Promise<DiscoverDeployedResult> {
   const configIO = new ConfigIO(configBaseDir ? { baseDir: configBaseDir } : undefined);
   const projectSpec = await configIO.readProjectSpec();
-  const targets = await configIO.readAWSDeploymentTargets();
+  const targets = await configIO.resolveAWSDeploymentTargets();
 
   const deployedTargets: DeployedTarget[] = [];
   for (const target of targets) {
@@ -124,7 +124,7 @@ export async function performStackTeardown(targetName: string): Promise<StackTea
       throw err;
     }
   }
-  const remainingTargets = (await configIO.readAWSDeploymentTargets()).filter(t => t.name !== targetName);
+  const remainingTargets = (await configIO.resolveAWSDeploymentTargets()).filter(t => t.name !== targetName);
   await configIO.writeAWSDeploymentTargets(remainingTargets);
 
   return { success: true };

src/cli/tui/hooks/useAwsTargetConfig.ts

@@ -110,7 +110,7 @@ export function useAwsTargetConfig(): AwsTargetConfigState {
         }
 
         const configIO = new ConfigIO({ baseDir: configRoot });
-        const targets = await configIO.readAWSDeploymentTargets();
+        const targets = await configIO.resolveAWSDeploymentTargets();
 
         if (targets.length > 1) {
           // Multiple targets - show selection

src/lib/schemas/io/config-io.ts

@@ -108,9 +108,8 @@ export class ConfigIO {
 
   /**
    * Read and validate the AWS configuration file.
-   * Applies overrides following AWS SDK precedence:
-   * - Account: from current credentials if AWS_PROFILE is set
-   * - Region: AWS_REGION > AWS_DEFAULT_REGION > profile config > saved value
+   * Region is preserved as saved. Use resolveAWSDeploymentTargets() for environment/profile overrides.
+   * TODO: Account is still overridden via AWS_PROFILE — consider moving to resolveAWSDeploymentTargets() for consistency.
    */
   async readAWSDeploymentTargets(): Promise<AwsDeploymentTarget[]> {
     const filePath = this.pathResolver.getAWSTargetsConfigPath();
@@ -124,6 +123,16 @@ export class ConfigIO {
       }
     }
 
+    return targets;
+  }
+
+  /**
+   * Read AWS deployment targets with region overrides from environment/profile.
+   * Region precedence: AWS_REGION > AWS_DEFAULT_REGION > profile config > saved value.
+   */
+  async resolveAWSDeploymentTargets(): Promise<AwsDeploymentTarget[]> {
+    const targets = await this.readAWSDeploymentTargets();
+
     // Override region from env vars
     const envRegion = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
     if (envRegion && AgentCoreRegionSchema.safeParse(envRegion).success) {