@build-astron-co/nimbus 0.2.0 → 0.4.0

package/src/__tests__/permissions.test.ts

@@ -7,7 +7,7 @@
  * and user config overrides.
  */
 
-import { describe, test, expect, beforeEach } from 'bun:test';
+import { describe, test, expect, beforeEach } from 'vitest';
 import { z } from 'zod';
 import {
   checkPermission,

package/src/__tests__/pipeline.test.ts

@@ -0,0 +1,50 @@
+/**
+ * Pipeline Command Tests — H2
+ *
+ * Validates provider auto-detection.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { detectProvider } from '../commands/pipeline';
+
+describe('detectProvider (H2)', () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-pipeline-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  test('detects GitHub Actions from .github/workflows directory', () => {
+    fs.mkdirSync(path.join(tmpDir, '.github', 'workflows'), { recursive: true });
+    expect(detectProvider(tmpDir)).toBe('github');
+  });
+
+  test('detects GitLab CI from .gitlab-ci.yml', () => {
+    fs.writeFileSync(path.join(tmpDir, '.gitlab-ci.yml'), 'stages:\n  - test\n', 'utf-8');
+    expect(detectProvider(tmpDir)).toBe('gitlab');
+  });
+
+  test('detects CircleCI from .circleci/config.yml', () => {
+    fs.mkdirSync(path.join(tmpDir, '.circleci'), { recursive: true });
+    fs.writeFileSync(path.join(tmpDir, '.circleci', 'config.yml'), 'version: 2\n', 'utf-8');
+    expect(detectProvider(tmpDir)).toBe('circleci');
+  });
+
+  test('returns null when no CI config is found', () => {
+    expect(detectProvider(tmpDir)).toBeNull();
+  });
+
+  test('prefers GitHub over GitLab when both exist', () => {
+    fs.mkdirSync(path.join(tmpDir, '.github', 'workflows'), { recursive: true });
+    fs.writeFileSync(path.join(tmpDir, '.gitlab-ci.yml'), '{}', 'utf-8');
+    // GitHub is checked first
+    expect(detectProvider(tmpDir)).toBe('github');
+  });
+});

package/src/__tests__/polish-phase3.test.ts

@@ -0,0 +1,340 @@
+/**
+ * Polish Phase 3 Tests — M1, M3, M4, M5
+ *
+ * Tests for:
+ *   M1 — dry-run mode (parseRunArgs + buildSystemPrompt)
+ *   M3 — cost estimate/compare/report subcommands
+ *   M4 — config primaryClouds key
+ *   M5 — MCP add/list/remove in plugin.ts
+ */
+
+import { describe, test, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { parseRunArgs } from '../cli/run';
+import { buildSystemPrompt } from '../agent/system-prompt';
+import { CONFIG_KEYS } from '../config/types';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+let tmpDir: string;
+
+// Patch os.homedir so MCP/plugin files go into a temp dir
+vi.mock('node:os', async () => {
+  const actual = await vi.importActual<typeof os>('node:os');
+  return {
+    ...actual,
+    homedir: () => tmpDir ?? actual.homedir(),
+  };
+});
+
+async function getMcpModule() {
+  vi.resetModules();
+  return await import('../commands/plugin');
+}
+
+// ---------------------------------------------------------------------------
+// M1 — Dry-run mode
+// ---------------------------------------------------------------------------
+
+describe('M1 — dry-run mode (parseRunArgs)', () => {
+  test('--dry-run sets dryRun=true', () => {
+    const result = parseRunArgs(['--dry-run', 'check infrastructure']);
+    expect(result.dryRun).toBe(true);
+  });
+
+  test('--dry-run forces mode to "plan"', () => {
+    const result = parseRunArgs(['--dry-run', 'check everything']);
+    expect(result.mode).toBe('plan');
+  });
+
+  test('--dry-run overrides --mode build to plan', () => {
+    const result = parseRunArgs(['--mode', 'build', '--dry-run', 'prompt']);
+    expect(result.mode).toBe('plan');
+    expect(result.dryRun).toBe(true);
+  });
+
+  test('--dry-run overrides --mode deploy to plan', () => {
+    const result = parseRunArgs(['--mode', 'deploy', '--dry-run', 'prompt']);
+    expect(result.mode).toBe('plan');
+  });
+
+  test('dryRun defaults to undefined when not specified', () => {
+    const result = parseRunArgs(['my prompt']);
+    expect(result.dryRun).toBeFalsy();
+  });
+
+  test('--dry-run preserves other flags', () => {
+    const result = parseRunArgs(['--dry-run', '--auto-approve', '--format', 'json', 'the prompt']);
+    expect(result.dryRun).toBe(true);
+    expect(result.autoApprove).toBe(true);
+    expect(result.format).toBe('json');
+    expect(result.prompt).toBe('the prompt');
+  });
+});
+
+describe('M1 — dry-run mode (buildSystemPrompt)', () => {
+  test('includes DRY-RUN MODE block when dryRun=true', () => {
+    const prompt = buildSystemPrompt({ mode: 'plan', tools: [], dryRun: true });
+    expect(prompt).toContain('DRY-RUN MODE');
+    expect(prompt).toContain('Do not execute any mutating operations');
+    expect(prompt).toContain('List exactly what you would do step by step');
+  });
+
+  test('does not include DRY-RUN block when dryRun is false', () => {
+    const prompt = buildSystemPrompt({ mode: 'plan', tools: [], dryRun: false });
+    expect(prompt).not.toContain('DRY-RUN MODE');
+  });
+
+  test('does not include DRY-RUN block when dryRun is omitted', () => {
+    const prompt = buildSystemPrompt({ mode: 'build', tools: [] });
+    expect(prompt).not.toContain('DRY-RUN MODE');
+  });
+
+  test('DRY-RUN block appears after environment context section', () => {
+    const prompt = buildSystemPrompt({ mode: 'plan', tools: [], dryRun: true });
+    const envIdx = prompt.indexOf('# Environment');
+    const dryRunIdx = prompt.indexOf('DRY-RUN MODE');
+    expect(envIdx).toBeGreaterThan(-1);
+    expect(dryRunIdx).toBeGreaterThan(envIdx);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// M3 — Cost estimate subcommand recognition
+// ---------------------------------------------------------------------------
+
+describe('M3 — cost command subcommands', () => {
+  test('costCommand exports costCompareCommand function', async () => {
+    const mod = await import('../commands/cost/index');
+    expect(typeof mod.costCompareCommand).toBe('function');
+  });
+
+  test('costCommand exports costReportCommand function', async () => {
+    const mod = await import('../commands/cost/index');
+    expect(typeof mod.costReportCommand).toBe('function');
+  });
+
+  test('costReportCommand outputs JSON report when format is json', async () => {
+    const { costReportCommand } = await import('../commands/cost/index');
+    const logs: string[] = [];
+    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => logs.push(String(args[0])));
+
+    await costReportCommand('json');
+
+    vi.restoreAllMocks();
+    expect(logs.length).toBeGreaterThan(0);
+    const parsed = JSON.parse(logs[0]) as Record<string, unknown>;
+    expect(parsed).toHaveProperty('generatedAt');
+    expect(parsed).toHaveProperty('format', 'json');
+  });
+
+  test('costReportCommand outputs CSV header when format is csv', async () => {
+    const { costReportCommand } = await import('../commands/cost/index');
+    const logs: string[] = [];
+    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => logs.push(String(args[0])));
+
+    await costReportCommand('csv');
+
+    vi.restoreAllMocks();
+    expect(logs.some(l => l.includes('timestamp,description,cost_usd'))).toBe(true);
+  });
+
+  test('costReportCommand outputs text summary by default', async () => {
+    const { costReportCommand } = await import('../commands/cost/index');
+    const outputs: string[] = [];
+    vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+      outputs.push(String(chunk));
+      return true;
+    });
+
+    await costReportCommand('text');
+
+    vi.restoreAllMocks();
+    // Should not throw — text mode uses ui.print which writes to stdout
+    expect(true).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// M4 — Config primaryClouds key
+// ---------------------------------------------------------------------------
+
+describe('M4 — config primaryClouds key', () => {
+  test('CONFIG_KEYS contains primaryClouds entry', () => {
+    const entry = CONFIG_KEYS.find(k => k.key === 'primaryClouds');
+    expect(entry).toBeDefined();
+    expect(entry?.type).toBe('string');
+    expect(entry?.description).toContain('cloud');
+  });
+
+  test('CONFIG_KEYS primaryClouds description mentions comma-separated', () => {
+    const entry = CONFIG_KEYS.find(k => k.key === 'primaryClouds');
+    expect(entry?.description).toMatch(/comma.?separated|aws.*gcp|gcp.*azure/i);
+  });
+
+  test('CONFIG_KEYS contains model entry', () => {
+    const entry = CONFIG_KEYS.find(k => k.key === 'model');
+    expect(entry).toBeDefined();
+    expect(entry?.type).toBe('string');
+  });
+
+  test('CONFIG_KEYS model description mentions known model IDs', () => {
+    const entry = CONFIG_KEYS.find(k => k.key === 'model');
+    expect(entry?.description).toContain('claude');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// M5 — MCP add/list/remove
+// ---------------------------------------------------------------------------
+
+describe('M5 — MCP server management', () => {
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-mcp-test-'));
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.resetModules();
+  });
+
+  test('mcpCommand is exported from plugin.ts', async () => {
+    const mod = await getMcpModule();
+    expect(typeof mod.mcpCommand).toBe('function');
+  });
+
+  test('list shows no servers when config is absent', async () => {
+    const { mcpCommand } = await getMcpModule();
+    const outputs: string[] = [];
+    vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+      outputs.push(String(chunk));
+      return true;
+    });
+
+    await mcpCommand('list', []);
+    vi.restoreAllMocks();
+    // Should not throw
+    expect(true).toBe(true);
+  });
+
+  test('add writes server entry to mcp.json', async () => {
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    await mcpCommand('add', ['npx -y @my/mcp-server', '--name', 'my-server']);
+
+    vi.restoreAllMocks();
+
+    const mcpFile = path.join(tmpDir, '.nimbus', 'mcp.json');
+    expect(fs.existsSync(mcpFile)).toBe(true);
+    const config = JSON.parse(fs.readFileSync(mcpFile, 'utf-8')) as { servers: Array<{ name: string }> };
+    expect(config.servers.some(s => s.name === 'my-server')).toBe(true);
+  });
+
+  test('add stores correct command and args for npm package', async () => {
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    await mcpCommand('add', ['npx -y @my/mcp-server', '--name', 'test-server']);
+
+    vi.restoreAllMocks();
+
+    const mcpFile = path.join(tmpDir, '.nimbus', 'mcp.json');
+    const config = JSON.parse(fs.readFileSync(mcpFile, 'utf-8')) as {
+      servers: Array<{ name: string; command: string; args: string[]; type: string }>;
+    };
+    const server = config.servers.find(s => s.name === 'test-server');
+    expect(server).toBeDefined();
+    expect(server?.command).toBe('npx');
+    expect(server?.args).toContain('-y');
+    expect(server?.type).toBe('stdio');
+  });
+
+  test('add stores HTTP server with type=http', async () => {
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    await mcpCommand('add', ['https://my.mcp.server.example.com', '--name', 'http-server']);
+
+    vi.restoreAllMocks();
+
+    const mcpFile = path.join(tmpDir, '.nimbus', 'mcp.json');
+    const config = JSON.parse(fs.readFileSync(mcpFile, 'utf-8')) as {
+      servers: Array<{ name: string; type: string; url: string }>;
+    };
+    const server = config.servers.find(s => s.name === 'http-server');
+    expect(server?.type).toBe('http');
+    expect(server?.url).toBe('https://my.mcp.server.example.com');
+  });
+
+  test('add warns on duplicate name', async () => {
+    // Pre-create config with an existing entry
+    const nimbusDir = path.join(tmpDir, '.nimbus');
+    fs.mkdirSync(nimbusDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(nimbusDir, 'mcp.json'),
+      JSON.stringify({ servers: [{ name: 'existing', command: 'npx', args: ['existing'], type: 'stdio' }] }),
+      'utf-8'
+    );
+
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    // Should not throw or add duplicate
+    await mcpCommand('add', ['npx existing', '--name', 'existing']);
+    vi.restoreAllMocks();
+
+    const config = JSON.parse(
+      fs.readFileSync(path.join(nimbusDir, 'mcp.json'), 'utf-8')
+    ) as { servers: unknown[] };
+    expect(config.servers).toHaveLength(1);
+  });
+
+  test('remove deletes server from mcp.json', async () => {
+    const nimbusDir = path.join(tmpDir, '.nimbus');
+    fs.mkdirSync(nimbusDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(nimbusDir, 'mcp.json'),
+      JSON.stringify({
+        servers: [
+          { name: 'server-a', command: 'npx', args: ['a'], type: 'stdio' },
+          { name: 'server-b', command: 'npx', args: ['b'], type: 'stdio' },
+        ],
+      }),
+      'utf-8'
+    );
+
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    await mcpCommand('remove', ['server-a']);
+    vi.restoreAllMocks();
+
+    const config = JSON.parse(
+      fs.readFileSync(path.join(nimbusDir, 'mcp.json'), 'utf-8')
+    ) as { servers: Array<{ name: string }> };
+    expect(config.servers.some(s => s.name === 'server-a')).toBe(false);
+    expect(config.servers.some(s => s.name === 'server-b')).toBe(true);
+  });
+
+  test('remove warns when server not found', async () => {
+    const { mcpCommand } = await getMcpModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+
+    // Should not throw
+    await expect(mcpCommand('remove', ['nonexistent-server'])).resolves.not.toThrow();
+    vi.restoreAllMocks();
+  });
+
+  test('MCPServerEntry type is exported', async () => {
+    // Type test — verifies the export exists at runtime via typeof usage
+    const mod = await getMcpModule();
+    // mcpCommand should be a function (type shape check)
+    expect(typeof mod.mcpCommand).toBe('function');
+  });
+});

package/src/__tests__/profile.test.ts

@@ -0,0 +1,237 @@
+/**
+ * Profile Command Tests — H1
+ *
+ * Tests for the per-project credential profile management system.
+ * Profiles are stored in ~/.nimbus/profiles.json.
+ */
+
+import { describe, test, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+
+// Mock homedir to use a temp directory so tests don't touch ~/.nimbus
+let tmpDir: string;
+
+vi.mock('node:os', async () => {
+  const actual = await vi.importActual<typeof os>('node:os');
+  return {
+    ...actual,
+    homedir: () => tmpDir ?? actual.homedir(),
+  };
+});
+
+async function getProfileModule() {
+  // Force re-import so homedir mock is active
+  return await import('../commands/profile');
+}
+
+describe('profile store helpers (H1)', () => {
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-profile-test-'));
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.resetModules();
+  });
+
+  test('loadProfiles returns empty object when no file exists', async () => {
+    const { loadProfiles } = await getProfileModule();
+    const profiles = loadProfiles();
+    expect(profiles).toEqual({});
+  });
+
+  test('saveProfiles then loadProfiles round-trips correctly', async () => {
+    const { loadProfiles, saveProfiles } = await getProfileModule();
+    const data = {
+      prod: { awsProfile: 'production', kubectlContext: 'prod-cluster', tfWorkspace: 'prod' },
+      staging: { awsProfile: 'staging', gcpProject: 'my-project-staging' },
+    };
+    saveProfiles(data);
+
+    const loaded = loadProfiles();
+    expect(loaded.prod?.awsProfile).toBe('production');
+    expect(loaded.prod?.kubectlContext).toBe('prod-cluster');
+    expect(loaded.prod?.tfWorkspace).toBe('prod');
+    expect(loaded.staging?.awsProfile).toBe('staging');
+    expect(loaded.staging?.gcpProject).toBe('my-project-staging');
+  });
+
+  test('saveProfiles creates ~/.nimbus directory if missing', async () => {
+    const { saveProfiles } = await getProfileModule();
+    saveProfiles({ test: { awsProfile: 'test' } });
+
+    const profilesPath = path.join(tmpDir, '.nimbus', 'profiles.json');
+    expect(fs.existsSync(profilesPath)).toBe(true);
+  });
+
+  test('profiles.json format is valid JSON with proper structure', async () => {
+    const { saveProfiles } = await getProfileModule();
+    const data = {
+      myprofile: {
+        awsProfile: 'my-aws',
+        tfWorkspace: 'dev',
+        kubectlContext: 'dev-cluster',
+        gcpProject: 'my-gcp-project',
+        azureSubscription: 'my-sub-id',
+        k8sNamespace: 'default',
+      },
+    };
+    saveProfiles(data);
+
+    const profilesPath = path.join(tmpDir, '.nimbus', 'profiles.json');
+    const raw = fs.readFileSync(profilesPath, 'utf-8');
+    const parsed = JSON.parse(raw);
+    expect(parsed.myprofile.awsProfile).toBe('my-aws');
+    expect(parsed.myprofile.tfWorkspace).toBe('dev');
+    expect(parsed.myprofile.kubectlContext).toBe('dev-cluster');
+    expect(parsed.myprofile.gcpProject).toBe('my-gcp-project');
+    expect(parsed.myprofile.azureSubscription).toBe('my-sub-id');
+    expect(parsed.myprofile.k8sNamespace).toBe('default');
+  });
+
+  test('getCurrentProfileName returns null when no current profile set', async () => {
+    const { getCurrentProfileName } = await getProfileModule();
+    // Clear env var if set
+    delete process.env.NIMBUS_PROFILE;
+    const current = getCurrentProfileName();
+    expect(current).toBeNull();
+  });
+
+  test('NIMBUS_PROFILE env var overrides current profile file', async () => {
+    process.env.NIMBUS_PROFILE = 'env-profile';
+    const { getCurrentProfileName } = await getProfileModule();
+    expect(getCurrentProfileName()).toBe('env-profile');
+    delete process.env.NIMBUS_PROFILE;
+  });
+});
+
+describe('profileCommand subcommands (H1)', () => {
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-profile-cmd-test-'));
+    vi.resetModules();
+    delete process.env.NIMBUS_PROFILE;
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.resetModules();
+    delete process.env.NIMBUS_PROFILE;
+  });
+
+  test('list shows "No profiles" message when empty', async () => {
+    const { profileCommand } = await getProfileModule();
+    const logs: string[] = [];
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    await expect(profileCommand('list', [])).resolves.not.toThrow();
+    vi.restoreAllMocks();
+  });
+
+  test('profileCommand exports function', async () => {
+    const { profileCommand } = await getProfileModule();
+    expect(typeof profileCommand).toBe('function');
+  });
+
+  test('CredentialProfile type accepts all fields', async () => {
+    const { loadProfiles, saveProfiles } = await getProfileModule();
+    const profile = {
+      awsProfile: 'aws-prod',
+      tfWorkspace: 'production',
+      kubectlContext: 'prod-k8s',
+      gcpProject: 'gcp-prod',
+      azureSubscription: 'az-sub',
+      k8sNamespace: 'production',
+    };
+    saveProfiles({ prod: profile });
+    const loaded = loadProfiles();
+    expect(loaded.prod).toEqual(profile);
+  });
+
+  test('profile list subcommand does not throw', async () => {
+    const { profileCommand, saveProfiles } = await getProfileModule();
+    saveProfiles({ dev: { awsProfile: 'dev' }, prod: { awsProfile: 'prod' } });
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    await expect(profileCommand('list', [])).resolves.not.toThrow();
+    vi.restoreAllMocks();
+  });
+
+  test('profile show subcommand displays profile JSON', async () => {
+    const { profileCommand, saveProfiles } = await getProfileModule();
+    saveProfiles({ myenv: { awsProfile: 'myenv-aws', tfWorkspace: 'myenv' } });
+    const logged: string[] = [];
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(console, 'log').mockImplementation((...args) => logged.push(args.join(' ')));
+    await expect(profileCommand('show', ['myenv'])).resolves.not.toThrow();
+    // console.log output should include the awsProfile value
+    const combined = logged.join('\n');
+    expect(combined).toContain('myenv-aws');
+    vi.restoreAllMocks();
+  });
+
+  test('profile delete subcommand with missing profile does not crash', async () => {
+    const { profileCommand, saveProfiles } = await getProfileModule();
+    saveProfiles({});
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    // delete a non-existent profile should call process.exit(1)
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation((_code) => { throw new Error('exit'); });
+    await expect(profileCommand('delete', ['nonexistent'])).rejects.toThrow('exit');
+    mockExit.mockRestore();
+    vi.restoreAllMocks();
+  });
+
+  test('unknown subcommand shows usage without throwing', async () => {
+    const { profileCommand } = await getProfileModule();
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    await expect(profileCommand('unknown-sub', [])).resolves.not.toThrow();
+    vi.restoreAllMocks();
+  });
+});
+
+describe('profile lifecycle (H1)', () => {
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-profile-lifecycle-'));
+    vi.resetModules();
+    delete process.env.NIMBUS_PROFILE;
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.resetModules();
+    delete process.env.NIMBUS_PROFILE;
+  });
+
+  test('save → load → overwrite → load cycle', async () => {
+    const { loadProfiles, saveProfiles } = await getProfileModule();
+
+    // Create
+    saveProfiles({ alpha: { awsProfile: 'alpha' } });
+    expect(loadProfiles().alpha?.awsProfile).toBe('alpha');
+
+    // Overwrite
+    saveProfiles({ alpha: { awsProfile: 'alpha-v2', tfWorkspace: 'ws' } });
+    const updated = loadProfiles();
+    expect(updated.alpha?.awsProfile).toBe('alpha-v2');
+    expect(updated.alpha?.tfWorkspace).toBe('ws');
+  });
+
+  test('multiple profiles coexist in same file', async () => {
+    const { loadProfiles, saveProfiles } = await getProfileModule();
+    saveProfiles({
+      dev: { awsProfile: 'dev', tfWorkspace: 'dev' },
+      staging: { awsProfile: 'staging', kubectlContext: 'staging-k8s' },
+      prod: { awsProfile: 'prod', gcpProject: 'prod-gcp' },
+    });
+    const profiles = loadProfiles();
+    expect(Object.keys(profiles)).toHaveLength(3);
+    expect(profiles.dev?.awsProfile).toBe('dev');
+    expect(profiles.staging?.kubectlContext).toBe('staging-k8s');
+    expect(profiles.prod?.gcpProject).toBe('prod-gcp');
+  });
+});