fix(run-insights): reject empty --name "" instead of auto-generating

[notgitika]

Summary

• agentcore run insights --name \"\" was silently accepted: the empty string slipped through the truthy check in resolveInsightsName and the CLI auto-generated a name. Users who explicitly typed --name \"\" now get a clear ValidationError instead.
• Tightens the --lookback-days error message wording to align with the service-side BatchEvaluationName contract (^[a-zA-Z][a-zA-Z0-9_]{0,47}$) referenced in AgentCoreEvaluationCommonModel.

Bug : "agentcore run insights --name "" is accepted — the CLI silently ignores the empty string and auto-generates a name."

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.20.2.tgz

How to install

gh release download pr-1600-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.2.tgz

[agentcore-cli-automation]

Thanks for the fix — the empty-string bypass is a real bug worth catching. One change request before merge:

The empty---name check is placed outside runCliCommand, which breaks two behaviors the rest of this file relies on:

1. No telemetry on failure. Errors thrown inside runCliCommand are classified and emitted as cli.command_run failure events (see runCliCommand → trackCommandRun in src/cli/telemetry/cli-command-run.ts). Throwing at line 402 bypasses that entirely, so the run.insights command never records this validation failure. Per src/cli/telemetry/README.md, validation errors should flow through the telemetry-wrapped path.

2. Breaks the --json contract. runCliCommand formats errors as { success: false, error: ... } and exits 1 when --json is set. With the check outside the wrapper, the throw propagates to Commander's default handler, which prints a plain-text error / stack to stderr. So agentcore run insights --name "" --json will not produce parseable JSON on stdout, even though the PR description implies it does. (The manual test in the PR description only asserts the message text, not that stdout is valid JSON.)

The fix is to move the check inside the runCliCommand callback, right alongside the existing --lookback-days check (which this PR correctly leaves inside the wrapper):

await runCliCommand('run.job', !!cliOptions.json, async () => {
  if (cliOptions.name !== undefined && cliOptions.name.trim() === '') {
    throw new ValidationError('--name must not be empty. Omit the flag to auto-generate a name.');
  }
  const engine = createJobEngine(new ConfigIO());
  // ...

This matches the pattern used by run ingest further down in the same file (line 672-674), where --name validation is inside runCliCommand.

Two smaller observations (not blocking):

• No unit test was added for the new behavior. The existing test file only covers validateLookbackDays. Since command.tsx doesn't have a test harness, that's understandable, but worth noting given this is a P1 bug-bash item.
• cliOptions.name?.trim() === '' also rejects whitespace-only names (e.g. --name " "), which is probably desirable but isn't called out in the PR description or message. Consider whether the user-facing message should mention whitespace, or whether to trim before validating against NAME_PATTERN.

[agentcore-cli-automation]

This check is outside runCliCommand, which breaks two things:

1. Telemetry: runCliCommand records failures via trackCommandRun (src/cli/telemetry/cli-command-run.ts). Throwing here bypasses that, so this validation failure is never emitted as a cli.command_run event. Per src/cli/telemetry/README.md, validation errors should be thrown inside the wrapper.

2. --json output contract: runCliCommand formats errors as { success: false, error: ... } on stdout when --json is set. Throwing outside means Commander's default handler prints plain text to stderr, so agentcore run insights --name "" --json won't produce parseable JSON.

The fix is to move this block inside the runCliCommand callback (a few lines below), next to the existing --lookback-days validation. That's the same pattern used by run ingest at line 672-674.

await runCliCommand('run.job', !!cliOptions.json, async () => {
  if (cliOptions.name !== undefined && cliOptions.name.trim() === '') {
    throw new ValidationError('--name must not be empty. Omit the flag to auto-generate a name.');
  }
  const engine = createJobEngine(new ConfigIO());
  // ...