aws-sam-cli 1.166.1__tar.gz → 1.167.0__tar.gz

{aws_sam_cli-1.166.1/aws_sam_cli.egg-info → aws_sam_cli-1.167.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-sam-cli
-Version: 1.166.1
+Version: 1.167.0
 Summary: AWS SAM CLI is a CLI tool for local development and testing of Serverless applications
 Author-email: Amazon Web Services <aws-sam-developers@amazon.com>
 License-Expression: Apache-2.0
@@ -30,7 +30,7 @@ License-File: NOTICE
 Requires-Dist: chevron~=0.12
 Requires-Dist: click==8.1.8
 Requires-Dist: Flask<3.2
-Requires-Dist: boto3[crt]==1.43.83
+Requires-Dist: boto3[crt]==1.43.102
 Requires-Dist: jmespath~=1.1.0
 Requires-Dist: ruamel_yaml~=0.19.1
 Requires-Dist: PyYAML~=6.0
@@ -55,16 +55,16 @@ Provides-Extra: rust-tests
 Requires-Dist: cargo-lambda==1.9.2; extra == "rust-tests"
 Requires-Dist: ziglang==0.16.0; extra == "rust-tests"
 Provides-Extra: pre-dev
-Requires-Dist: ruff==0.16.5; extra == "pre-dev"
+Requires-Dist: ruff==0.16.8; extra == "pre-dev"
 Provides-Extra: dev
 Requires-Dist: aws-sam-cli[pre-dev]; extra == "dev"
 Requires-Dist: coverage==7.16.0; extra == "dev"
 Requires-Dist: pytest-cov==7.1.0; extra == "dev"
 Requires-Dist: mypy==2.3.1; extra == "dev"
 Requires-Dist: types-pywin32==312.0.0.20260827; extra == "dev"
-Requires-Dist: types-PyYAML==6.0.12.20260815; extra == "dev"
+Requires-Dist: types-PyYAML==6.0.12.20260906; extra == "dev"
 Requires-Dist: types-chevron==0.14.2.20260408; extra == "dev"
-Requires-Dist: types-psutil==7.2.2.20260827; extra == "dev"
+Requires-Dist: types-psutil==7.2.2.20260906; extra == "dev"
 Requires-Dist: types-setuptools==84.0.0.20260812; extra == "dev"
 Requires-Dist: types-Pygments==2.21.0.20260819; extra == "dev"
 Requires-Dist: types-colorama==0.4.15.20260508; extra == "dev"
@@ -72,17 +72,17 @@ Requires-Dist: types-dateparser==1.4.2.20260813; extra == "dev"
 Requires-Dist: types-docutils==0.23.0.20260827; extra == "dev"
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == "dev"
 Requires-Dist: types-pyOpenSSL==24.1.0.20240722; extra == "dev"
-Requires-Dist: types-requests==2.33.0.20260712; extra == "dev"
+Requires-Dist: types-requests==2.33.0.20260906; extra == "dev"
 Requires-Dist: types-urllib3==1.26.25.14; extra == "dev"
 Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: parameterized==0.9.0; extra == "dev"
 Requires-Dist: pytest-xdist==3.8.0; extra == "dev"
 Requires-Dist: pytest-forked==1.7.5; extra == "dev"
 Requires-Dist: pytest-timeout==2.4.0; extra == "dev"
-Requires-Dist: pytest-rerunfailures==16.6; extra == "dev"
+Requires-Dist: pytest-rerunfailures==16.7; extra == "dev"
 Requires-Dist: pytest-metadata==3.1.1; extra == "dev"
 Requires-Dist: pytest-json-report-wip==1.5.1; extra == "dev"
-Requires-Dist: filelock==3.32.4; extra == "dev"
+Requires-Dist: filelock==4.0.1; extra == "dev"
 Requires-Dist: black==26.5.1; extra == "dev"
 Requires-Dist: psutil==7.2.2; extra == "dev"
 Requires-Dist: chardet<6; extra == "dev"

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0/aws_sam_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-sam-cli
-Version: 1.166.1
+Version: 1.167.0
 Summary: AWS SAM CLI is a CLI tool for local development and testing of Serverless applications
 Author-email: Amazon Web Services <aws-sam-developers@amazon.com>
 License-Expression: Apache-2.0
@@ -30,7 +30,7 @@ License-File: NOTICE
 Requires-Dist: chevron~=0.12
 Requires-Dist: click==8.1.8
 Requires-Dist: Flask<3.2
-Requires-Dist: boto3[crt]==1.43.83
+Requires-Dist: boto3[crt]==1.43.102
 Requires-Dist: jmespath~=1.1.0
 Requires-Dist: ruamel_yaml~=0.19.1
 Requires-Dist: PyYAML~=6.0
@@ -55,16 +55,16 @@ Provides-Extra: rust-tests
 Requires-Dist: cargo-lambda==1.9.2; extra == "rust-tests"
 Requires-Dist: ziglang==0.16.0; extra == "rust-tests"
 Provides-Extra: pre-dev
-Requires-Dist: ruff==0.16.5; extra == "pre-dev"
+Requires-Dist: ruff==0.16.8; extra == "pre-dev"
 Provides-Extra: dev
 Requires-Dist: aws-sam-cli[pre-dev]; extra == "dev"
 Requires-Dist: coverage==7.16.0; extra == "dev"
 Requires-Dist: pytest-cov==7.1.0; extra == "dev"
 Requires-Dist: mypy==2.3.1; extra == "dev"
 Requires-Dist: types-pywin32==312.0.0.20260827; extra == "dev"
-Requires-Dist: types-PyYAML==6.0.12.20260815; extra == "dev"
+Requires-Dist: types-PyYAML==6.0.12.20260906; extra == "dev"
 Requires-Dist: types-chevron==0.14.2.20260408; extra == "dev"
-Requires-Dist: types-psutil==7.2.2.20260827; extra == "dev"
+Requires-Dist: types-psutil==7.2.2.20260906; extra == "dev"
 Requires-Dist: types-setuptools==84.0.0.20260812; extra == "dev"
 Requires-Dist: types-Pygments==2.21.0.20260819; extra == "dev"
 Requires-Dist: types-colorama==0.4.15.20260508; extra == "dev"
@@ -72,17 +72,17 @@ Requires-Dist: types-dateparser==1.4.2.20260813; extra == "dev"
 Requires-Dist: types-docutils==0.23.0.20260827; extra == "dev"
 Requires-Dist: types-jsonschema==4.26.0.20260518; extra == "dev"
 Requires-Dist: types-pyOpenSSL==24.1.0.20240722; extra == "dev"
-Requires-Dist: types-requests==2.33.0.20260712; extra == "dev"
+Requires-Dist: types-requests==2.33.0.20260906; extra == "dev"
 Requires-Dist: types-urllib3==1.26.25.14; extra == "dev"
 Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: parameterized==0.9.0; extra == "dev"
 Requires-Dist: pytest-xdist==3.8.0; extra == "dev"
 Requires-Dist: pytest-forked==1.7.5; extra == "dev"
 Requires-Dist: pytest-timeout==2.4.0; extra == "dev"
-Requires-Dist: pytest-rerunfailures==16.6; extra == "dev"
+Requires-Dist: pytest-rerunfailures==16.7; extra == "dev"
 Requires-Dist: pytest-metadata==3.1.1; extra == "dev"
 Requires-Dist: pytest-json-report-wip==1.5.1; extra == "dev"
-Requires-Dist: filelock==3.32.4; extra == "dev"
+Requires-Dist: filelock==4.0.1; extra == "dev"
 Requires-Dist: black==26.5.1; extra == "dev"
 Requires-Dist: psutil==7.2.2; extra == "dev"
 Requires-Dist: chardet<6; extra == "dev"

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/aws_sam_cli.egg-info/requires.txt

@@ -1,7 +1,7 @@
 chevron~=0.12
 click==8.1.8
 Flask<3.2
-boto3[crt]==1.43.83
+boto3[crt]==1.43.102
 jmespath~=1.1.0
 ruamel_yaml~=0.19.1
 PyYAML~=6.0
@@ -29,9 +29,9 @@ coverage==7.16.0
 pytest-cov==7.1.0
 mypy==2.3.1
 types-pywin32==312.0.0.20260827
-types-PyYAML==6.0.12.20260815
+types-PyYAML==6.0.12.20260906
 types-chevron==0.14.2.20260408
-types-psutil==7.2.2.20260827
+types-psutil==7.2.2.20260906
 types-setuptools==84.0.0.20260812
 types-Pygments==2.21.0.20260819
 types-colorama==0.4.15.20260508
@@ -39,23 +39,23 @@ types-dateparser==1.4.2.20260813
 types-docutils==0.23.0.20260827
 types-jsonschema==4.26.0.20260518
 types-pyOpenSSL==24.1.0.20240722
-types-requests==2.33.0.20260712
+types-requests==2.33.0.20260906
 types-urllib3==1.26.25.14
 pytest==9.1.1
 parameterized==0.9.0
 pytest-xdist==3.8.0
 pytest-forked==1.7.5
 pytest-timeout==2.4.0
-pytest-rerunfailures==16.6
+pytest-rerunfailures==16.7
 pytest-metadata==3.1.1
 pytest-json-report-wip==1.5.1
-filelock==3.32.4
+filelock==4.0.1
 black==26.5.1
 psutil==7.2.2
 chardet<6
 
 [pre-dev]
-ruff==0.16.5
+ruff==0.16.8
 
 [rust-tests]
 cargo-lambda==1.9.2

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/pyproject.toml

@@ -35,7 +35,7 @@ dependencies = [
     "chevron~=0.12",
     "click==8.1.8",
     "Flask<3.2",
-    "boto3[crt]==1.43.83",
+    "boto3[crt]==1.43.102",
     "jmespath~=1.1.0",
     "ruamel_yaml~=0.19.1",
     "PyYAML~=6.0",
@@ -70,7 +70,7 @@ rust-tests = [
     "ziglang==0.16.0",
 ]
 pre-dev = [
-    "ruff==0.16.5",
+    "ruff==0.16.8",
 ]
 dev = [
     "aws-sam-cli[pre-dev]",
@@ -78,9 +78,9 @@ dev = [
     "pytest-cov==7.1.0",
     "mypy==2.3.1",
     "types-pywin32==312.0.0.20260827",
-    "types-PyYAML==6.0.12.20260815",
+    "types-PyYAML==6.0.12.20260906",
     "types-chevron==0.14.2.20260408",
-    "types-psutil==7.2.2.20260827",
+    "types-psutil==7.2.2.20260906",
     "types-setuptools==84.0.0.20260812",
     "types-Pygments==2.21.0.20260819",
     "types-colorama==0.4.15.20260508",
@@ -88,17 +88,17 @@ dev = [
     "types-docutils==0.23.0.20260827",
     "types-jsonschema==4.26.0.20260518",
     "types-pyOpenSSL==24.1.0.20240722",
-    "types-requests==2.33.0.20260712",
+    "types-requests==2.33.0.20260906",
     "types-urllib3==1.26.25.14",
     "pytest==9.1.1",
     "parameterized==0.9.0",
     "pytest-xdist==3.8.0",
     "pytest-forked==1.7.5",
     "pytest-timeout==2.4.0",
-    "pytest-rerunfailures==16.6",
+    "pytest-rerunfailures==16.7",
     "pytest-metadata==3.1.1",
     "pytest-json-report-wip==1.5.1",
-    "filelock==3.32.4",
+    "filelock==4.0.1",
     "black==26.5.1",
     "psutil==7.2.2",
     "chardet<6",

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/samcli/__init__.py

@@ -2,4 +2,4 @@
 SAM CLI version
 """
 
-__version__ = "1.166.1"
+__version__ = "1.167.0"

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/samcli/commands/sync/command.py

@@ -163,10 +163,9 @@ DEFAULT_CAPABILITIES = ("CAPABILITY_NAMED_IAM", "CAPABILITY_AUTO_EXPAND")
 )
 @click.option(
     "--express/--no-express",
-    default=False,
+    default=True,
     required=False,
     is_flag=True,
-    # TODO: Flip default to True after public announcement of express mode support
     help="Use CloudFormation Express mode to speed up infrastructure deployments by completing once resource "
     "configuration is applied, without waiting for full stabilization.",
 )
@@ -308,7 +307,7 @@ def do_cli(
     build_in_source: Optional[bool],
     watch_exclude: Optional[Dict[str, List[str]]],
     language_extensions: Optional[bool],
-    express: bool = False,
+    express: bool = True,
 ) -> None:
     """
     Implementation of the ``cli`` method

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/samcli/hook_packages/terraform/copy_terraform_built_artifacts.py

@@ -310,10 +310,10 @@ if __name__ == "__main__":
     argparser.add_argument(
         "--expression",
         type=str,
-        required=True,
+        required=False,
         help="Jpath query expression separated by | (delimiter) "
         "and allows for searching within a json object."
-        "eg: |values|sub_module|[?address==me]|output",
+        "eg: |values|sub_module|[?address==me]|output. Not required if --args-file is used.",
     )
     argparser.add_argument(
         "--directory",
@@ -327,6 +327,16 @@ if __name__ == "__main__":
         required=False,
         help="Terraform resource path for the SAM CLI Metadata resource. This option is not to be used with --json",
     )
+    argparser.add_argument(
+        "--args-file",
+        type=str,
+        required=False,
+        help="Path to a JSON file containing 'expression' and/or 'target' values, as an alternative to "
+        "passing them directly via --expression/--target on the command line. This avoids embedding "
+        "untrusted Terraform resource addresses/expressions in a shell command line, since quoting "
+        "rules are not portable across shells (e.g. POSIX sh vs Windows cmd.exe). Values from this "
+        "file take precedence over --expression/--target if both are provided.",
+    )
     argparser.add_argument(
         "--json",
         type=str,
@@ -347,6 +357,22 @@ if __name__ == "__main__":
     json_str = arguments.json
     mount_symlinks = arguments.mount_symlinks
 
+    if arguments.args_file:
+        try:
+            with open(arguments.args_file, "r") as args_file_handle:
+                file_args = json.load(args_file_handle)
+        except (OSError, ValueError):
+            LOG.error("Reading args file '%s' unsuccessful!", arguments.args_file, exc_info=True)
+            cli_exit()
+        if not isinstance(file_args, dict):
+            LOG.error("Args file '%s' must contain a JSON object.", arguments.args_file)
+            cli_exit()
+        expression = file_args.get("expression", expression)
+        target = file_args.get("target", target)
+
+    if not expression:
+        argparser.error("An --expression value must be provided, either directly or via --args-file.")
+
     # validate environment variables do not contain blocked arguments
     validate_environment_variables()
 

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/samcli/hook_packages/terraform/hooks/prepare/enrich.py

@@ -83,6 +83,7 @@ def enrich_resources_and_generate_makefile(
     }
 
     makefile_rules = []
+    pending_args_files = []
     for sam_metadata_resource in sam_metadata_resources:
         # enrich resource
         resource_type = get_sam_metadata_planned_resource_value_attribute(
@@ -111,7 +112,7 @@ def enrich_resources_and_generate_makefile(
             )
 
             # get makefile rule for resource
-            makefile_rule = generate_makefile_rule_for_lambda_resource(
+            makefile_rule, pending_args_file = generate_makefile_rule_for_lambda_resource(
                 sam_metadata_resource,
                 logical_id,
                 terraform_application_dir,
@@ -120,10 +121,11 @@ def enrich_resources_and_generate_makefile(
                 mount_symlinks=mount_symlinks,
             )
             makefile_rules.append(makefile_rule)
+            pending_args_files.append(pending_args_file)
 
     # generate makefile
     LOG.debug("Generate Makefile in %s", output_directory_path)
-    generate_makefile(makefile_rules, output_directory_path)
+    generate_makefile(makefile_rules, pending_args_files, output_directory_path)
 
 
 def _enrich_zip_lambda_function(

{aws_sam_cli-1.166.1 → aws_sam_cli-1.167.0}/samcli/hook_packages/terraform/hooks/prepare/makefile_generator.py

@@ -4,16 +4,18 @@ Terraform Makefile and make rule generation
 This module generates the Makefile for the project and the rules for each of the Lambda functions found
 """
 
+import json
 import logging
 import os
 import shutil
 import uuid
 from pathlib import Path
-from typing import List, Optional
+from typing import List, NamedTuple, Optional, Tuple
 
 from samcli.hook_packages.terraform.hooks.prepare.types import (
     SamMetadataResource,
 )
+from samcli.lib.utils.hash import str_checksum
 from samcli.lib.utils.path_utils import convert_path_to_unix_path
 
 LOG = logging.getLogger(__name__)
@@ -21,6 +23,25 @@ LOG = logging.getLogger(__name__)
 TERRAFORM_BUILD_SCRIPT = "copy_terraform_built_artifacts.py"
 ZIP_UTILS_MODULE = "zip.py"
 TF_BACKEND_OVERRIDE_FILENAME = "z_samcli_backend_override"
+ARGS_FILE_SUFFIX = ".args.json"
+# a 16-char hex checksum plus ".args.json" is 26 characters total, comfortably clear of both the
+# 255-byte per-component filesystem/OS filename limit and Windows' 260-character MAX_PATH total
+# path length limit (see _get_args_file_path)
+ARGS_FILE_NAME_HASH_LEN = 16
+
+
+class PendingArgsFile(NamedTuple):
+    """
+    An args file (see _get_args_file_path) that still needs to be written to disk.
+
+    Building the args file's path and contents is kept separate from actually writing it, so
+    that generation of every Makefile rule can complete - and be confirmed free of errors - before
+    any file is written. See generate_makefile(), which is the only place these are written.
+    """
+
+    path: str
+    expression: str
+    target: str
 
 
 def generate_makefile_rule_for_lambda_resource(
@@ -30,7 +51,7 @@ def generate_makefile_rule_for_lambda_resource(
     python_command_name: str,
     output_dir: str,
     mount_symlinks: bool = False,
-) -> str:
+) -> Tuple[str, PendingArgsFile]:
     """
     Generates and returns a makefile rule for the lambda resource associated with the given sam metadata resource.
 
@@ -50,35 +71,50 @@ def generate_makefile_rule_for_lambda_resource(
 
     Returns
     -------
-    str
-        The generated makefile rule
+    Tuple[str, PendingArgsFile]
+        The generated makefile rule, and the args file this rule depends on. The caller is
+        responsible for passing every PendingArgsFile collected across all rules to
+        generate_makefile(), which writes them - this function itself performs no I/O.
     """
     target = _get_makefile_build_target(logical_id)
     resource_address = sam_metadata_resource.resource.get("address", "")
-    python_command_recipe = _format_makefile_recipe(
-        _build_makerule_python_command(
-            python_command_name,
-            output_dir,
-            resource_address,
-            sam_metadata_resource,
-            terraform_application_dir,
-            mount_symlinks=mount_symlinks,
-        )
+    command, pending_args_file = _build_makerule_python_command(
+        python_command_name,
+        output_dir,
+        resource_address,
+        sam_metadata_resource,
+        terraform_application_dir,
+        logical_id,
+        mount_symlinks=mount_symlinks,
     )
-    return f"{target}{python_command_recipe}"
+    python_command_recipe = _format_makefile_recipe(command)
+    return f"{target}{python_command_recipe}", pending_args_file
 
 
 def generate_makefile(
     makefile_rules: List[str],
+    pending_args_files: List[PendingArgsFile],
     output_directory_path: str,
 ) -> None:
     """
-    Generates a makefile with the given rules in the given directory
+    Generates a makefile with the given rules in the given directory, and writes the args files
+    each rule depends on.
+
+    This is the only place args files are written to disk. Collecting every PendingArgsFile
+    across all rules first, then writing them all here (rather than as each rule is built) means
+    that if generating any single rule fails partway through - e.g. an unrecognized sam metadata
+    resource type - no args file for *any* rule has been written yet, so a build that ultimately
+    fails to produce a Makefile also leaves no partial args files behind. Stale args files from a
+    previous run (e.g. for a Lambda resource that has since been renamed or removed) are pruned
+    for the same reason: nothing here is left to accumulate indefinitely across builds.
 
     Parameters
     ----------
     makefile_rules: List[str]
         the list of rules to write in the Makefile
+    pending_args_files: List[PendingArgsFile]
+        the args files that the given makefile_rules depend on; written here, after any stale
+        args files from a previous run are removed
     output_directory_path: str
         the output directory path to write the generated makefile
     """
@@ -87,6 +123,22 @@ def generate_makefile(
     if not os.path.exists(output_directory_path):
         os.makedirs(output_directory_path, exist_ok=True)
 
+    # remove any args files left behind by a previous run (e.g. for a Lambda resource that has
+    # since been renamed or removed) before writing this run's set. Listing the directory and
+    # filtering by suffix - rather than glob.glob(os.path.join(output_directory_path, "*.args.json")) -
+    # is deliberate: glob applies fnmatch pattern semantics to *every* path component, not just
+    # the final one, so a project path containing a glob metacharacter (e.g. "proj[1]") would
+    # silently make the pattern match nothing, leaving stale files to accumulate indefinitely
+    # with no error raised. os.listdir has no pattern-expansion semantics on the directory path
+    # at all, so it can't have that failure mode.
+    for entry in os.listdir(output_directory_path):
+        if entry.endswith(ARGS_FILE_SUFFIX):
+            os.remove(os.path.join(output_directory_path, entry))
+
+    for pending_args_file in pending_args_files:
+        with open(pending_args_file.path, "w+") as args_file:
+            json.dump({"expression": pending_args_file.expression, "target": pending_args_file.target}, args_file)
+
     # create z_samcli_backend_override.tf in output directory
     _generate_backend_override_file(output_directory_path)
 
@@ -130,8 +182,9 @@ def _build_makerule_python_command(
     resource_address: str,
     sam_metadata_resource: SamMetadataResource,
     terraform_application_dir: str,
+    logical_id: str,
     mount_symlinks: bool = False,
-) -> str:
+) -> Tuple[str, PendingArgsFile]:
     """
     Build the Python command recipe to be used inside of the Makefile rule
 
@@ -148,29 +201,93 @@ def _build_makerule_python_command(
         associated with this sam metadata resource
     terraform_application_dir: str
         the terraform project root directory
+    logical_id: str
+        Logical ID of the lambda resource; used to name the generated args file
 
     Returns
     -------
-    str
-        Fully resolved Terraform show command
+    Tuple[str, PendingArgsFile]
+        Fully resolved Terraform show command, and the args file it depends on (not yet written
+        to disk - see generate_makefile())
     """
     show_command_template = (
         '{python_command_name} "{terraform_built_artifacts_script_path}" '
-        '--expression "{jpath_string}" --directory "$(ARTIFACTS_DIR)" --target "{resource_address}"'
+        '--directory "$(ARTIFACTS_DIR)" --args-file "{args_file_path}"'
     )
     jpath_string = _build_jpath_string(sam_metadata_resource, resource_address)
     terraform_built_artifacts_script_path = convert_path_to_unix_path(
         str(Path(output_dir, TERRAFORM_BUILD_SCRIPT).relative_to(terraform_application_dir))
     )
+    args_file_path = _get_args_file_path(output_dir, logical_id)
+    args_file_relative_path = convert_path_to_unix_path(
+        str(Path(args_file_path).relative_to(terraform_application_dir))
+    )
     command = show_command_template.format(
         python_command_name=python_command_name,
         terraform_built_artifacts_script_path=terraform_built_artifacts_script_path,
-        jpath_string=jpath_string.replace('"', '\\"'),
-        resource_address=resource_address.replace('"', '\\"'),
+        args_file_path=args_file_relative_path,
     )
     if mount_symlinks:
         command += " --mount-symlinks"
-    return command
+    pending_args_file = PendingArgsFile(path=args_file_path, expression=jpath_string, target=resource_address)
+    return command, pending_args_file
+
+
+def _get_args_file_path(output_dir: str, logical_id: str) -> str:
+    """
+    Deterministically computes the path of the args file for a given Lambda resource, without
+    writing anything to disk - see generate_makefile(), which is where the args file content
+    (the potentially untrusted Terraform jpath expression and resource address) actually gets
+    written, once every Makefile rule has been generated successfully.
+
+    Keeping this path computation free of I/O is what lets _build_makerule_python_command (and
+    generate_makefile_rule_for_lambda_resource above it) remain pure functions of their inputs:
+    the Makefile recipe text can be built and returned - including the args file path it
+    references - without anything touching the filesystem, so a failure generating a *later*
+    rule can't leave an *earlier* rule's args file already written with nothing to clean it up.
+
+    The recipe line generated by `_build_makerule_python_command` is first macro-expanded by
+    `make`, and the result is then handed to a shell for execution (`/bin/sh` on Linux/macOS,
+    or `cmd.exe` on Windows when no `sh.exe` is found on PATH). There is no single escaping
+    scheme that is simultaneously safe for `make`'s macro expansion and portable across both
+    shells, since their quoting rules are fundamentally different (and `cmd.exe` does not treat
+    single quotes as quoting characters at all). Keeping the untrusted expression/resource
+    address off the command line entirely sidesteps the problem: only this file path (safe on
+    every shell) is ever embedded in the recipe text, and the untrusted content is read directly
+    from disk by `copy_terraform_built_artifacts.py`.
+
+    The file is named by hashing logical_id to a fixed-length string, rather than embedding (even
+    truncated) logical_id itself. logical_id is deterministic and unique per resource
+    (build_cfn_logical_id() strips every non-alphanumeric character and appends a hash of the
+    full Terraform address) but can be up to 255 *characters* and is Unicode-aware
+    ("alphanumeric" is not limited to ASCII), so a truncation-based name would have to reason
+    separately about the 255-*byte* per-component filesystem/OS filename limit and, on Windows,
+    the 260-character MAX_PATH limit on the *total* path once combined with a real project
+    directory path (MAX_PATH is hit by the project's own path depth too, not just this file name
+    in isolation, and a deeply-nested Terraform module address can push logical_id itself close
+    to 255 characters). A fixed-length hash sidesteps both regardless of how long or non-ASCII
+    logical_id is, and the deterministic name means each `sam build` (which always re-runs
+    prepare) overwrites the previous run's file for this resource, rather than accumulating one.
+
+    Note that logical_id is itself derived from the same (potentially attacker-controlled)
+    Terraform resource address that motivates this fix - hashing it is safe to embed in the
+    recipe because the hash, not the input, is what actually appears there, not because the
+    input is inherently trusted.
+
+    Parameters
+    ----------
+    output_dir: str
+        the directory into which the Makefile (and this args file) is written
+    logical_id: str
+        Logical ID of the lambda resource; hashed to name the args file
+
+    Returns
+    -------
+    str
+        The absolute path of the args file (this function does not create it)
+    """
+    args_file_name = f"{str_checksum(logical_id)[:ARGS_FILE_NAME_HASH_LEN]}{ARGS_FILE_SUFFIX}"
+    return os.path.join(output_dir, args_file_name)
 
 
 def _get_makefile_build_target(logical_id: str) -> str: