fix(import): add early name validation and allow re-import with --name

Bug 5: Validate --name against the AgentNameSchema regex before any
file I/O operations. Previously, a malicious --name like
'../../../etc/pwned' would copy files outside the project directory
and set up a Python venv there before schema validation rejected it.
Now invalid names are caught immediately with a clear error message.
Applied to both import-runtime and import-memory.

Bug 6: Allow re-importing the same cloud resource under a different
local name when --name is provided. Previously, the deployed-state
duplicate check blocked all re-imports by resource ID regardless of
--name. Now it only blocks when --name is not provided, and suggests
using --name in the error message. When --name is provided, it warns
and proceeds. Applied to both import-runtime and import-memory.

Author: aidandaly24

src/cli/commands/import/import-memory.ts

@@ -1,5 +1,5 @@
-import type { AgentCoreProjectSpec, Memory } from '../../../schema';
 import type { ConfigIO } from '../../../lib';
+import type { AgentCoreProjectSpec, Memory } from '../../../schema';
 import type { MemoryDetail } from '../../aws/agentcore-control';
 import { getMemoryDetail, listAllMemories } from '../../aws/agentcore-control';
 import { LocalCdkProject } from '../../cdk/local-cdk-project';
@@ -88,9 +88,11 @@ function toMemorySpec(memory: MemoryDetail, localName: string): Memory {
  */
 export async function handleImportMemory(options: ImportResourceOptions): Promise<ImportResourceResult> {
   const logger = new ExecLogger({ command: 'import-memory' });
-  const onProgress = options.onProgress ?? ((message: string) => {
-    console.log(`${green}[done]${reset}  ${message}`);
-  });
+  const onProgress =
+    options.onProgress ??
+    ((message: string) => {
+      console.log(`${green}[done]${reset}  ${message}`);
+    });
 
   // Rollback state
   let configSnapshot: AgentCoreProjectSpec | undefined;
@@ -184,6 +186,20 @@ export async function handleImportMemory(options: ImportResourceOptions): Promis
     }
 
     const localName = options.name ?? memoryDetail.name;
+    // Validate name early to prevent path traversal before any file I/O
+    const NAME_REGEX = /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/;
+    if (!NAME_REGEX.test(localName)) {
+      const error = `Invalid name "${localName}". Name must start with a letter and contain only letters, numbers, and underscores (max 48 chars).`;
+      logger.endStep('error', error);
+      logger.finalize(false);
+      return {
+        success: false,
+        error,
+        resourceType: 'memory',
+        resourceName: localName,
+        logPath: logger.getRelativeLogPath(),
+      };
+    }
     onProgress(`Memory: ${memoryDetail.name} → local name: ${localName}`);
     logger.endStep('success');
 
@@ -206,16 +222,21 @@ export async function handleImportMemory(options: ImportResourceOptions): Promis
     const targetName = target.name ?? 'default';
     const existingResource = await findResourceInDeployedState(ctx.configIO, targetName, 'memory', memoryId);
     if (existingResource) {
-      const error = `Memory "${memoryId}" is already imported in this project as "${existingResource}". Remove it first before re-importing.`;
-      logger.endStep('error', error);
-      logger.finalize(false);
-      return {
-        success: false,
-        error,
-        resourceType: 'memory',
-        resourceName: localName,
-        logPath: logger.getRelativeLogPath(),
-      };
+      if (!options.name) {
+        const error = `Memory "${memoryId}" is already imported in this project as "${existingResource}". Remove it first before re-importing, or use --name to import under a different name.`;
+        logger.endStep('error', error);
+        logger.finalize(false);
+        return {
+          success: false,
+          error,
+          resourceType: 'memory',
+          resourceName: localName,
+          logPath: logger.getRelativeLogPath(),
+        };
+      }
+      onProgress(
+        `Warning: Memory "${memoryId}" already imported as "${existingResource}". Re-importing as "${localName}".`
+      );
     }
     logger.endStep('success');
 

src/cli/commands/import/import-runtime.ts

@@ -1,5 +1,5 @@
-import type { AgentCoreProjectSpec, AgentEnvSpec } from '../../../schema';
 import type { ConfigIO } from '../../../lib';
+import type { AgentCoreProjectSpec, AgentEnvSpec } from '../../../schema';
 import type { AgentRuntimeDetail } from '../../aws/agentcore-control';
 import { getAgentRuntimeDetail, listAllAgentRuntimes } from '../../aws/agentcore-control';
 import { LocalCdkProject } from '../../cdk/local-cdk-project';
@@ -103,9 +103,11 @@ function toAgentEnvSpec(
  */
 export async function handleImportRuntime(options: ImportResourceOptions): Promise<ImportResourceResult> {
   const logger = new ExecLogger({ command: 'import-runtime' });
-  const onProgress = options.onProgress ?? ((message: string) => {
-    console.log(`${green}[done]${reset}  ${message}`);
-  });
+  const onProgress =
+    options.onProgress ??
+    ((message: string) => {
+      console.log(`${green}[done]${reset}  ${message}`);
+    });
 
   // Rollback state
   let configSnapshot: AgentCoreProjectSpec | undefined;
@@ -216,6 +218,20 @@ export async function handleImportRuntime(options: ImportResourceOptions): Promi
     if (localName.startsWith(prefix)) {
       localName = localName.slice(prefix.length);
     }
+    // Validate name early to prevent path traversal before any file I/O
+    const NAME_REGEX = /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/;
+    if (!NAME_REGEX.test(localName)) {
+      const error = `Invalid name "${localName}". Name must start with a letter and contain only letters, numbers, and underscores (max 48 chars).`;
+      logger.endStep('error', error);
+      logger.finalize(false);
+      return {
+        success: false,
+        error,
+        resourceType: 'runtime',
+        resourceName: localName,
+        logPath: logger.getRelativeLogPath(),
+      };
+    }
     onProgress(`Runtime: ${runtimeDetail.agentRuntimeName} → local name: ${localName}`);
     logger.endStep('success');
 
@@ -302,16 +318,21 @@ export async function handleImportRuntime(options: ImportResourceOptions): Promi
     const targetName = target.name ?? 'default';
     const existingResource = await findResourceInDeployedState(ctx.configIO, targetName, 'runtime', runtimeId);
     if (existingResource) {
-      const error = `Runtime "${runtimeId}" is already imported in this project as "${existingResource}". Remove it first before re-importing.`;
-      logger.endStep('error', error);
-      logger.finalize(false);
-      return {
-        success: false,
-        error,
-        resourceType: 'runtime',
-        resourceName: localName,
-        logPath: logger.getRelativeLogPath(),
-      };
+      if (!options.name) {
+        const error = `Runtime "${runtimeId}" is already imported in this project as "${existingResource}". Remove it first before re-importing, or use --name to import under a different name.`;
+        logger.endStep('error', error);
+        logger.finalize(false);
+        return {
+          success: false,
+          error,
+          resourceType: 'runtime',
+          resourceName: localName,
+          logPath: logger.getRelativeLogPath(),
+        };
+      }
+      onProgress(
+        `Warning: Runtime "${runtimeId}" already imported as "${existingResource}". Re-importing as "${localName}".`
+      );
     }
     logger.endStep('success');