@productbrain/cli 0.1.0-beta.1428 → 0.1.0-beta.14280

package/dist/__tests__/profiles.test.js

@@ -7,7 +7,7 @@ import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs';
 import { resolve } from 'path';
 // vi.hoisted runs before mock hoisting — safe to compute test paths here
-const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LEGACY_PATH, mockClearSession, mockSessionStateRef, mockDiscardSession, mockSessionFileExists, } = vi.hoisted(() => {
+const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LEGACY_PATH, mockClearSession, mockSessionStateRef, mockDiscardSession, mockDiscardAllSessions, existsSyncOverride, } = vi.hoisted(() => {
     const os = require('os');
     const path = require('path');
     const home = path.resolve(os.tmpdir(), `pb-test-profiles-${process.pid}`);
@@ -20,30 +20,52 @@ const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LE
         mockClearSession: vi.fn(),
         mockSessionStateRef: { current: null },
         mockDiscardSession: vi.fn(),
-        mockSessionFileExists: vi.fn(() => false),
+        mockDiscardAllSessions: vi.fn(),
+        // Escape hatch for the TOCTOU regression test below — a real ESM module namespace
+        // (`fs`) cannot be vi.spyOn'd directly ("Module namespace is not configurable in
+        // ESM"), so existsSync is wrapped to defer to this override when set, and to the
+        // real implementation otherwise. Every other test in this file exercises real fs.
+        existsSyncOverride: { current: null },
     };
 });
 vi.mock('os', async (importOriginal) => {
     const actual = await importOriginal();
     return { ...actual, homedir: () => TEST_HOME };
 });
+vi.mock('fs', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        existsSync: (path) => existsSyncOverride.current ? existsSyncOverride.current(path) : actual.existsSync(path),
+    };
+});
 // Mock session to track close-on-switch
 vi.mock('../lib/session.js', () => ({
     readSession: () => mockSessionStateRef.current,
     writeSession: vi.fn(),
     clearSession: mockClearSession,
     discardSession: mockDiscardSession,
-    sessionFileExists: mockSessionFileExists,
+    discardAllSessions: mockDiscardAllSessions,
+    // reset/profile-switch now consider sibling active sessions (Codex re-review).
+    hasAnyActiveSession: () => false,
     addCapturedEntry: vi.fn(),
 }));
 vi.mock('../lib/workspace-probe.js', () => ({
     probeWorkspace: vi.fn(async () => ({ name: 'Resolved WS' })),
 }));
 // Import after mocks
-import { listProfiles, getActiveProfile, createProfile, useProfile, deleteProfile, resolveProfileConfig, } from '../lib/profiles.js';
-import { resolveProfileListState, runProfileUse } from '../commands/profile.js';
+import { listProfiles, getActiveProfile, createProfile, useProfile, deleteProfile, resolveProfileConfig, profileFileExists, profilePath, resolveNamedProfileConfig, } from '../lib/profiles.js';
+import { resolvePinnedProfile } from '../lib/localBinding.js';
+import { ErrorCode } from '../lib/errors.js';
+import { resolveProfileListState, runProfileUse, runProfileCreate, formatProfileList } from '../commands/profile.js';
+import { resetConfigCache } from '../lib/config.js';
+import { resetReportedProfileSnapshot } from '../lib/reportedProfile.js';
+import { setOutputMode } from '../lib/runner.js';
 describe('profiles', () => {
     beforeEach(() => {
+        // Safety net: every TOCTOU test clears this in its own try/finally, but reset here too
+        // so a prior failure can never leak a stubbed existsSync() into an unrelated test.
+        existsSyncOverride.current = null;
         // Clean slate
         if (existsSync(TEST_CONFIG_DIR)) {
             rmSync(TEST_CONFIG_DIR, { recursive: true, force: true });
@@ -53,7 +75,6 @@ describe('profiles', () => {
         mockSessionStateRef.current = null;
         vi.clearAllMocks();
         mockDiscardSession.mockClear();
-        mockSessionFileExists.mockReturnValue(false);
     });
     afterEach(() => {
         if (existsSync(TEST_HOME)) {
@@ -79,9 +100,83 @@ describe('profiles', () => {
         });
         it('rejects invalid profile names', () => {
             expect(() => createProfile('My Profile!', 'pb_sk_test')).toThrow(/Invalid profile name/);
+            expect(() => createProfile('My Profile!', 'pb_sk_test')).toThrow(/Must be 1 to 32 characters,/);
             expect(() => createProfile('', 'pb_sk_test')).toThrow(/Invalid profile name/);
             expect(() => createProfile('-bad', 'pb_sk_test')).toThrow(/Invalid profile name/);
         });
+        describe('overwrite option (TEN-2851)', () => {
+            it('without { overwrite: true }, still refuses an occupied name (default stays fail-closed)', () => {
+                createProfile('occupied', 'pb_sk_old', 'https://old.convex.site');
+                expect(() => createProfile('occupied', 'pb_sk_new', 'https://new.convex.site')).toThrow(/already exists/);
+                // Behavioral, not just "it threw": independent read proves the pre-existing file untouched.
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'occupied.env'), 'utf8');
+                expect(content).toContain('pb_sk_old');
+                expect(content).not.toContain('pb_sk_new');
+            });
+            it('with { overwrite: true }, replaces an occupied profile\'s credentials', () => {
+                createProfile('occupied', 'pb_sk_old', 'https://old.convex.site');
+                createProfile('occupied', 'pb_sk_new', 'https://new.convex.site', { overwrite: true });
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'occupied.env'), 'utf8');
+                expect(content).toContain('pb_sk_new');
+                expect(content).not.toContain('pb_sk_old');
+            });
+            it('{ overwrite: true } on a NON-existent profile still creates it (not overwrite-only)', () => {
+                createProfile('brand-new', 'pb_sk_fresh', undefined, { overwrite: true });
+                expect(listProfiles()).toContain('brand-new');
+            });
+        });
+        describe('TOCTOU-safe write (Copilot review, TEN-2851)', () => {
+            it('a race-created file surfaces PROFILE_ALREADY_EXISTS even when existsSync() lied "no" — proves the guard is the exclusive write, not the stale pre-check', () => {
+                // Simulate the race window: a file is genuinely on disk, but existsSync() is
+                // stubbed to report "not there" — modeling a concurrent create landing AFTER
+                // any existsSync() check would have run and BEFORE the write. If createProfile
+                // still relied on existsSync() to decide whether to write, this would silently
+                // clobber; the exclusive-create ('wx') write path fails on EEXIST regardless of
+                // what existsSync() reported.
+                createProfile('raced', 'pb_sk_original', 'https://original.convex.site');
+                existsSyncOverride.current = () => false;
+                try {
+                    expect(() => createProfile('raced', 'pb_sk_racer', 'https://racer.convex.site')).toThrow(/already exists/);
+                }
+                finally {
+                    existsSyncOverride.current = null;
+                }
+                // Independent read (override already cleared, real fs again) — file untouched.
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'raced.env'), 'utf8');
+                expect(content).toContain('pb_sk_original');
+                expect(content).not.toContain('pb_sk_racer');
+            });
+            it('{ overwrite: true } still replaces correctly even under the same existsSync()-lies-false stub (overwrite path is unaffected by the TOCTOU fix)', () => {
+                createProfile('raced-overwrite', 'pb_sk_original', 'https://original.convex.site');
+                existsSyncOverride.current = () => false;
+                try {
+                    createProfile('raced-overwrite', 'pb_sk_new', 'https://new.convex.site', { overwrite: true });
+                }
+                finally {
+                    existsSyncOverride.current = null;
+                }
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'raced-overwrite.env'), 'utf8');
+                expect(content).toContain('pb_sk_new');
+                expect(content).not.toContain('pb_sk_original');
+            });
+        });
+        describe('overwrite never claims a missing active-profile marker (Codex review, WP-628 P2)', () => {
+            it('overwriting an EXISTING profile while active-profile is absent does NOT activate it — overwrite can never be "the first profile"', () => {
+                createProfile('first', 'pb_sk_first');
+                createProfile('second', 'pb_sk_second_old');
+                // Simulate the edge state the review names: profile files remain, but the
+                // active-profile marker is gone (e.g. manually deleted).
+                rmSync(TEST_ACTIVE_PATH, { force: true });
+                expect(existsSync(TEST_ACTIVE_PATH)).toBe(false);
+                createProfile('second', 'pb_sk_second_new', undefined, { overwrite: true });
+                // Before the fix: createProfile's unconditional "first profile → activate" branch
+                // would have written 'second' here, silently activating the overwritten target
+                // globally — contradicting saveKeyAsProfile's own "does not activate globally"
+                // contract. The marker must stay absent; an overwrite of an EXISTING profile is
+                // never "the first profile ever created."
+                expect(existsSync(TEST_ACTIVE_PATH)).toBe(false);
+            });
+        });
     });
     describe('auto-migration from legacy .env', () => {
         it('migrates legacy .env to default profile on first resolveProfileConfig()', () => {
@@ -114,6 +209,9 @@ describe('profiles', () => {
             process.env.PB_PROFILE = 'staging';
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_staging_key');
+            // WP-681 review fix: profileName reports which name ACTUALLY resolved (staging, the
+            // PB_PROFILE override) — never the active-profile file's name (prod).
+            expect(config.profileName).toBe('staging');
         });
         it('active-profile file wins over default', () => {
             createProfile('default', 'pb_sk_default_key');
@@ -121,12 +219,44 @@ describe('profiles', () => {
             useProfile('custom');
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_custom_key');
+            expect(config.profileName).toBe('custom');
         });
         it('falls back to default profile when no active-profile file', () => {
             mkdirSync(TEST_PROFILES_DIR, { recursive: true });
             writeFileSync(resolve(TEST_PROFILES_DIR, 'default.env'), 'PRODUCTBRAIN_API_KEY=pb_sk_fallback\n', { mode: 0o600 });
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_fallback');
+            // WP-681 review fix: profileName is 'default' — the level that actually resolved —
+            // never a stale/missing active-profile file name.
+            expect(config.profileName).toBe('default');
+        });
+    });
+    // TEN-4503 / TASK-638: a name from PB_PROFILE, a committed pin or the active-profile file is
+    // validated before it becomes a path. A planted key one folder up (profiles/../x.env) is the
+    // file a traversal would read; it must never be read, and nothing may be written.
+    describe('a traversal-shaped profile name is refused before any path is built', () => {
+        function plantOutsideKey() {
+            const planted = resolve(TEST_CONFIG_DIR, 'x.env');
+            writeFileSync(planted, 'PRODUCTBRAIN_API_KEY=pb_sk_planted_outside_profiles\n');
+            return planted;
+        }
+        it('PB_PROFILE=../x (the whoami / every-command credential path) is refused, the planted key is never read', () => {
+            plantOutsideKey();
+            process.env.PB_PROFILE = '../x';
+            expect(() => resolveProfileConfig()).toThrow(expect.objectContaining({ code: ErrorCode.PROFILE_NAME_INVALID }));
+        });
+        it('a pin naming ../x is refused before the pinned profile is read', () => {
+            plantOutsideKey();
+            expect(() => resolvePinnedProfile('../x')).toThrow(expect.objectContaining({ code: ErrorCode.PROFILE_NAME_INVALID }));
+            expect(() => profileFileExists('../x')).toThrow(expect.objectContaining({ code: ErrorCode.PROFILE_NAME_INVALID }));
+        });
+        it('createProfile("../x") writes nothing, not even the profiles folder', () => {
+            expect(() => createProfile('../x', 'pb_sk_should_not_land')).toThrow(expect.objectContaining({ code: ErrorCode.PROFILE_NAME_INVALID }));
+            expect(existsSync(TEST_PROFILES_DIR)).toBe(false);
+            expect(existsSync(resolve(TEST_CONFIG_DIR, 'x.env'))).toBe(false);
+        });
+        it('an absolute name is refused the same way', () => {
+            expect(() => profilePath('/etc/passwd')).toThrow(expect.objectContaining({ code: ErrorCode.PROFILE_NAME_INVALID }));
         });
     });
     describe('cannot delete active profile', () => {
@@ -202,6 +332,331 @@ describe('profiles', () => {
                 process.chdir(prevCwd);
             }
         });
+        it('does not mark global as active in a declared project with no pin', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            useProfile('product-brain');
+            const prevCwd = process.cwd();
+            const savedKey = process.env.PRODUCTBRAIN_API_KEY;
+            delete process.env.PRODUCTBRAIN_API_KEY;
+            const projectDir = resolve(TEST_HOME, 'unpinned-project');
+            const pbDir = resolve(projectDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'https://project-gateway.example.com' }));
+            try {
+                process.chdir(projectDir);
+                resetConfigCache();
+                const state = resolveProfileListState();
+                expect(state.active).toBeNull();
+                expect(state.activeSource).not.toBe('global');
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                if (savedKey !== undefined)
+                    process.env.PRODUCTBRAIN_API_KEY = savedKey;
+                process.chdir(prevCwd);
+                resetConfigCache();
+            }
+        });
+        it('does not mark any profile active when PRODUCTBRAIN_API_KEY is exported (TEN-3240)', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            useProfile('product-brain');
+            const savedKey = process.env.PRODUCTBRAIN_API_KEY;
+            process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_exported_key_0123456789';
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                const state = resolveProfileListState();
+                // The export supplied the credential, so `product-brain` is listed but is NOT active.
+                expect(state.active).toBeNull();
+                expect(state.activeSource).toBe('env-key');
+                // Codex P2: the pretty list must SAY why nothing is marked active, or it reads as a
+                // broken list — and with zero profiles it would otherwise advise creating a shadowed one.
+                const pretty = formatProfileList(state);
+                expect(pretty).toContain('PRODUCTBRAIN_API_KEY');
+                expect(formatProfileList({ ...state, profiles: [] })).toContain('PRODUCTBRAIN_API_KEY');
+                // Codex P2 r2: must not promise the profiles win — a preview worktree's direct binding
+                // outranks every one of them, so unsetting the key still leaves them unused.
+                expect(pretty).not.toContain('for these profiles to take effect');
+                expect(pretty).toContain('which binding takes over');
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                if (savedKey !== undefined)
+                    process.env.PRODUCTBRAIN_API_KEY = savedKey;
+                else
+                    delete process.env.PRODUCTBRAIN_API_KEY;
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // PRRT_kwDORS4ils6ih-Do (round 2): the create receipt used to derive a host from
+        // project-config/profile/env precedence alone, ignoring that an exported key outranks
+        // EVERY profile file outright — reporting a host (e.g. a repo's dev project URL) that the
+        // exported key's production binding would never actually use.
+        it('create: reports the shadow instead of a false "would resolve to" host when PRODUCTBRAIN_API_KEY is exported', async () => {
+            const savedKey = process.env.PRODUCTBRAIN_API_KEY;
+            process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_exported_key_0123456789';
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'shadowed', apiKey: 'pb_sk_shadowed' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "shadowed" created');
+                expect(out).toContain('PRODUCTBRAIN_API_KEY');
+                expect(out).toContain('this profile is not in use');
+                // Never claim the derived host is what actually resolves while shadowed.
+                expect(out).not.toContain('→');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                if (savedKey !== undefined)
+                    process.env.PRODUCTBRAIN_API_KEY = savedKey;
+                else
+                    delete process.env.PRODUCTBRAIN_API_KEY;
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // PRRT_kwDORS4ils6jBWYx (round 4): a declared project (config.json) with no tenant pin
+        // (config.local.json profile field) leaves every command failing closed in
+        // refuseWhenProjectHasNoTenant() — the create receipt must say so, not print an unqualified
+        // "created. → host" that implies the profile would actually be used.
+        it('create: reports the missing-pin state instead of a false "created. → host" receipt', async () => {
+            const repo = makeRepo(); // .productbrain/ dir with NO config.local.json pin
+            writeFileSync(resolve(repo, '.productbrain', 'config.json'), JSON.stringify({ siteUrl: 'https://example.convex.site' }));
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'unpinned', apiKey: 'pb_sk_unpinned' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "unpinned" created');
+                expect(out).toContain('no tenant pin');
+                expect(out).toContain('pb profile use --local unpinned');
+                expect(out).not.toContain('created. →');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // PRRT_kwDORS4ils6jG9FL (round 10): PB_PROFILE naming a DIFFERENT, already-resolvable
+        // profile outranks a freshly created one in resolveEffectiveProfile()'s own precedence
+        // (repo pin > PB_PROFILE > global > default) — resolveReportedProfile() correctly reports
+        // `source:'env'` naming that OTHER profile, but the create receipt used to ignore that
+        // source entirely and print the unqualified "created. → host" line as if the new profile
+        // were active.
+        it('create: reports the PB_PROFILE override instead of a false "created. → host" receipt', async () => {
+            const savedProfile = process.env.PB_PROFILE;
+            createProfile('other', 'pb_sk_other_key');
+            process.env.PB_PROFILE = 'other';
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'fresh', apiKey: 'pb_sk_fresh_key' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "fresh" created');
+                expect(out).toContain('PB_PROFILE=other');
+                expect(out).toContain('this profile is not in use');
+                expect(out).not.toContain('created. →');
+                // jLlcN (round 17): the command-forms rule file of that time forbade an env-prefix command form
+                // (`PB_PROFILE=name some-command`) — the receipt must present unset-and-select as two
+                // separate steps, and `export PB_PROFILE=...` as its own standalone line, never a prefix.
+                expect(out).toContain('unset PB_PROFILE');
+                expect(out).toContain('pb profile use fresh');
+                expect(out).toContain('export PB_PROFILE=fresh');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                if (savedProfile !== undefined)
+                    process.env.PB_PROFILE = savedProfile;
+                else
+                    delete process.env.PB_PROFILE;
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        it('create: no override note when PB_PROFILE already names the profile being (re)created', async () => {
+            const savedProfile = process.env.PB_PROFILE;
+            process.env.PB_PROFILE = 'samename';
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'samename', apiKey: 'pb_sk_samename_key' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "samename" created. →');
+                expect(out).not.toContain('is not in use');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                if (savedProfile !== undefined)
+                    process.env.PB_PROFILE = savedProfile;
+                else
+                    delete process.env.PB_PROFILE;
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        it('create: still reports the resolved host with no shadow present', async () => {
+            const repo = makeRepo();
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'plain', apiKey: 'pb_sk_plain' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "plain" created. →');
+                expect(out).not.toContain('is not in use');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // jK6hP (round 16): the override note only ever checked `source:'env'` — a repo pin
+        // (config.local.json naming a DIFFERENT profile) outranks a freshly created one in the same
+        // precedence (local > env > global > default) but printed the false "created. → host" line.
+        it('create: reports the repo-pin (local) override instead of a false "created. → host" receipt', async () => {
+            // No prevCwd save/restore (neighboring 'create:' tests in this describe don't either): a
+            // preceding test's own un-restored chdir can leave process.cwd() pointing at a directory
+            // this suite's own global afterEach (line ~108) is about to rmSync — reading it back here
+            // would risk an ENOENT, so this test always chdirs FORWARD to a fresh, just-created path.
+            createProfile('other-local', 'pb_sk_other_local_key');
+            const repo = makeRepo('other-local');
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'fresh-local', apiKey: 'pb_sk_fresh_local_key' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "fresh-local" created');
+                expect(out).toContain('pinned to "other-local"');
+                expect(out).toContain('this profile is not in use');
+                expect(out).toContain('pb profile use --local fresh-local');
+                expect(out).not.toContain('created. →');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        it('create: with no --url, a new profile takes the gateway of the profile this folder pins; --url still wins', async () => {
+            const devSite = 'https://trustworthy-kangaroo-277.convex.site';
+            createProfile('dev-pin', 'pb_sk_dev_pin_key', devSite);
+            process.chdir(makeRepo('dev-pin'));
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'agent-design', apiKey: 'pb_sk_agent_design_key' });
+                expect(resolveNamedProfileConfig('agent-design')?.siteUrl).toBe(devSite);
+                expect(writeSpy.mock.calls.map((c) => String(c[0])).join('')).toContain('trustworthy-kangaroo-277.convex.site');
+                await runProfileCreate({ name: 'agent-prod', apiKey: 'pb_sk_agent_prod_key', url: 'https://gateway.productbrain.io' });
+                expect(resolveNamedProfileConfig('agent-prod')?.siteUrl).toBe('https://gateway.productbrain.io');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        it('create: with no pin, a new profile still defaults to production', async () => {
+            process.chdir(makeRepo());
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'unpinned', apiKey: 'pb_sk_unpinned_key' });
+                expect(resolveNamedProfileConfig('unpinned')?.siteUrl).toBe('https://gateway.productbrain.io');
+            }
+            finally {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // jK6hP (round 16): same gap for the GLOBAL active-profile file — it outranks a freshly
+        // created profile whenever no repo pin and no PB_PROFILE are in play, but was never checked.
+        it('create: reports the global-active-profile override instead of a false "created. → host" receipt', async () => {
+            // No prevCwd save/restore — see the comment on the local-override test above.
+            createProfile('other-global', 'pb_sk_other_global_key');
+            useProfile('other-global');
+            const scratch = resolve(TEST_HOME, 'no-project-global');
+            mkdirSync(scratch, { recursive: true });
+            process.chdir(scratch);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'fresh-global', apiKey: 'pb_sk_fresh_global_key' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "fresh-global" created');
+                expect(out).toContain('global active profile is "other-global"');
+                expect(out).toContain('this profile is not in use');
+                expect(out).toContain('pb profile use fresh-global');
+                expect(out).not.toContain('created. →');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+        // Round 24 (jUmGx): the active-profile marker can name a profile that no longer exists
+        // (deleted, or never created — corrupted state, not reachable through useProfile()'s own
+        // existence check, so the marker is written directly here). resolveProfileConfig() then
+        // falls through past the dangling marker to the "default" profile file, and
+        // resolveReportedProfile() reports that as source:'default' — a fifth override source the
+        // original NAME_OVERRIDE_SOURCES list (env/local/global) never checked.
+        it('create: reports the "default" fallback override when the active-profile marker names a DELETED profile', async () => {
+            createProfile('default', 'pb_sk_default_key');
+            // Write the marker directly — useProfile() would refuse a nonexistent target.
+            writeFileSync(TEST_ACTIVE_PATH, 'ghost-profile-deleted', { mode: 0o600 });
+            const scratch = resolve(TEST_HOME, 'no-project-default-fallback');
+            mkdirSync(scratch, { recursive: true });
+            process.chdir(scratch);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                await runProfileCreate({ name: 'fresh-after-default', apiKey: 'pb_sk_fresh_after_default_key' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Profile "fresh-after-default" created');
+                expect(out).toContain('"default" is active instead');
+                expect(out).toContain('pb profile use fresh-after-default');
+                expect(out).not.toContain('created. →');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
     });
     describe('profile file format', () => {
         it('stores apiKey and optional siteUrl', () => {
@@ -236,12 +691,11 @@ describe('profiles', () => {
             useProfile('preview-ws');
             process.chdir(repo);
             mockSessionStateRef.current = { sessionId: 's-old' };
-            mockSessionFileExists.mockReturnValue(true);
             await runProfileUse({ name: 'product-brain' });
             const pin = JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8'));
             expect(pin.profile).toBe('product-brain');
             expect(getActiveProfile()).toBe('product-brain');
-            expect(mockDiscardSession).toHaveBeenCalled();
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
         });
         it('default: no repo pin -> flips global + discards session, writes no pin', async () => {
             createProfile('a', 'pb_live_a');
@@ -249,11 +703,10 @@ describe('profiles', () => {
             const repo = makeRepo(); // no pin
             process.chdir(repo);
             mockSessionStateRef.current = { sessionId: 's1' };
-            mockSessionFileExists.mockReturnValue(true);
             await runProfileUse({ name: 'b' });
             expect(getActiveProfile()).toBe('b');
             expect(existsSync(resolve(repo, '.productbrain', 'config.local.json'))).toBe(false);
-            expect(mockDiscardSession).toHaveBeenCalled();
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
         });
         it('default: discards a stale CLOSED MARKER (file exists, no active session) on switch', async () => {
             createProfile('a', 'pb_live_a');
@@ -261,9 +714,16 @@ describe('profiles', () => {
             const repo = makeRepo('a');
             process.chdir(repo);
             mockSessionStateRef.current = null; // readSession() === null (closed marker)
-            mockSessionFileExists.mockReturnValue(true); // …but the marker file still exists
             await runProfileUse({ name: 'b' });
-            expect(mockDiscardSession).toHaveBeenCalled();
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
+        });
+        it('--local: still writes the pin when the project has config.json and no pin yet (S2 repair path)', async () => {
+            createProfile('a', 'pb_live_a');
+            const repo = makeRepo();
+            writeFileSync(resolve(repo, '.productbrain', 'config.json'), JSON.stringify({ siteUrl: 'https://project.example.com' }));
+            process.chdir(repo);
+            await runProfileUse({ name: 'a', local: true });
+            expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('a');
         });
         it('--local: writes only the repo pin and discards the session', async () => {
             createProfile('a', 'pb_live_a');
@@ -272,11 +732,10 @@ describe('profiles', () => {
             const repo = makeRepo('a');
             process.chdir(repo);
             mockSessionStateRef.current = { sessionId: 's1' };
-            mockSessionFileExists.mockReturnValue(true);
             await runProfileUse({ name: 'b', local: true });
             expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('b');
             expect(getActiveProfile()).toBe('a'); // global untouched
-            expect(mockDiscardSession).toHaveBeenCalled();
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
         });
         it('--global: with a differing repo pin, does NOT discard session', async () => {
             createProfile('a', 'pb_live_a');
@@ -284,11 +743,70 @@ describe('profiles', () => {
             const repo = makeRepo('a'); // repo pinned to a
             process.chdir(repo);
             mockSessionStateRef.current = { sessionId: 's1' };
-            mockSessionFileExists.mockReturnValue(true);
             await runProfileUse({ name: 'b', global: true });
             expect(getActiveProfile()).toBe('b');
             expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('a'); // pin untouched
-            expect(mockDiscardSession).not.toHaveBeenCalled();
+            expect(mockDiscardAllSessions).not.toHaveBeenCalled();
+        });
+        // DEC-1632 / TEN-3398 / WP-720: the point-of-action replacement for the removed ambient
+        // pin-vs-global disagreement warning. `pb profile use --global` in a directory with a
+        // repo-local pin says so ONCE, right here, naming the pin and stating plainly that commands
+        // run in this repo will still use it — never again on every subsequent read/write. This
+        // exact mechanism already existed in profile.ts (`pinnedElsewhere`) before this slice; it
+        // was untested, so this pins its text now that it is the sole replacement for the notice.
+        it('--global: with a differing repo pin, names it ONCE in a point-of-action message (not an ambient one)', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a'); // repo pinned to a
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b', global: true });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Switched global profile to "b".');
+                expect(out).toContain('Note: this repo is pinned to "a" via config.local.json — the global switch won\'t change it here.');
+                expect(out).toContain('Run `pb use b` (no flag) to switch this repo too.');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
+        });
+        it('--global: with NO repo pin, prints no point-of-action note — nothing diverges to name', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo(); // no pin
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b', global: true });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).not.toContain('is pinned to');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
+        });
+        it('default (no flags): reconciles the pin itself instead of naming a divergence — no point-of-action note either', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a'); // repo pinned to a
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b' }); // no --local/--global -> reconcile
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).not.toContain('is pinned to');
+                expect(out).toContain('(updated repo-local pin in .productbrain/config.local.json)');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
         });
         it('rejects --local and --global together', async () => {
             createProfile('a', 'pb_live_a');