@productbrain/cli 0.1.0-beta.15 → 0.1.0-beta.1522

package/dist/lib/config.js

@@ -1,21 +1,420 @@
 /**
  * CLI config — reads PRODUCTBRAIN_API_KEY + CONVEX_SITE_URL from:
- * 1. Environment variables
- * 2. ~/.config/productbrain/.env (works from any directory)
- * 3. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ * 1. Environment variables (always highest priority)
+ * 2. Project local config: .productbrain/config.local.json (walked up from CWD, machine-local)
+ * 3. Project config: .productbrain/config.json (walked up from CWD, siteUrl only — committed)
+ * 4. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 5. Legacy ~/.config/productbrain/.env (auto-migrated to profiles on first use)
+ * 6. CWD .env.mcp / packages/mcp-server/.env.mcp / .env
+ *
+ * Config loading is lazy — loadEnv() runs on first getConfig()/getConfigOrGuide() call.
+ * This enables profile switching without import-time side effects (TEN-1276).
  *
  * When key is missing and retry is provided (TTY), runs guided flow per docs/cli-unauthenticated-user-journey.md.
+ *
+ * Split config design:
+ * - config.json (committed): siteUrl only — workspace gateway, safe to share with teammates.
+ * - config.local.json (gitignored): profile pin — machine-local, never committed.
  */
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { resolve } from 'path';
 import { homedir } from 'os';
-import { createInterface } from 'readline';
-const DEFAULT_SITE_URL = 'https://trustworthy-kangaroo-277.convex.site';
+import { DEFAULT_SITE_URL, isDevMode } from './constants.js';
+import { API_KEY_PREFIX } from './tokenConstants.js';
+import { resolveProfileConfig, resolveNamedProfileConfig, getGlobalActiveProfile } from './profiles.js';
+import { CLIError, ErrorCode } from './errors.js';
+import { confirm as promptConfirm, password as promptPassword } from './prompts.js';
 const HOME_CONFIG_DIR = resolve(homedir(), '.config', 'productbrain');
 const HOME_ENV_PATH = resolve(HOME_CONFIG_DIR, '.env');
 const CWD_ENV_PATHS = ['.env.mcp', 'packages/mcp-server/.env.mcp', '.env'];
 // Short error when not TTY (scripts/pipes must not hang)
 const NON_TTY_MESSAGE = 'No API key. Set PRODUCTBRAIN_API_KEY or run pb login.';
+/** Track whether env has been loaded to avoid redundant file reads. */
+let envLoaded = false;
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed siteUrl gateway) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export function findProjectRoot(startDir) {
+    let dir = startDir;
+    const home = homedir();
+    while (true) {
+        const pbDir = resolve(dir, '.productbrain');
+        if (existsSync(pbDir) &&
+            (existsSync(resolve(pbDir, 'config.json')) ||
+                existsSync(resolve(pbDir, 'config.local.json')))) {
+            return dir;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir || dir === home)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Read .productbrain/config.json from the walked-up project root.
+ * Only reads siteUrl — profile and apiKey fields are ignored (legacy or misplaced).
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+function readProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        // Silently ignore `profile` and `apiKey` in config.json — those must be in config.local.json
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`) and any preview-binding fields
+ * (`apiKey`, `siteUrl`, `preview`, `workspaceName`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON but does not throw.
+ */
+export function readLocalProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.local.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.profile === 'string' && parsed.profile) {
+            result.profile = parsed.profile;
+        }
+        // Preview binding fields — written by `npm run pb:preview`, cleared by `npm run pb:real`.
+        if (typeof parsed.apiKey === 'string' && parsed.apiKey.startsWith(API_KEY_PREFIX)) {
+            result.apiKey = parsed.apiKey;
+        }
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        if (parsed.preview === true) {
+            result.preview = true;
+        }
+        if (typeof parsed.workspaceName === 'string' && parsed.workspaceName) {
+            result.workspaceName = parsed.workspaceName;
+        }
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.local.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+/**
+ * Returns the preview binding metadata when pb is currently bound to a throwaway preview,
+ * or null when bound to the real Chain (the default).
+ *
+ * Effective-binding mirror: this only reports a preview binding when
+ * `resolveConfig()`/`loadEnv()` would actually honor it — `preview === true` AND
+ * an atomic apiKey+siteUrl pair (SF-3) AND no `PRODUCTBRAIN_API_KEY` env override
+ * (env always wins in resolveConfig step 1). Without these guards the PREVIEW
+ * banner could fire while writes still hit the real Chain, defeating the safety
+ * warning. Used by the PREVIEW banner (index.ts preAction hook) and the
+ * capture/update advisory.
+ *
+ * Security classification: reads only the gitignored machine-local config.local.json.
+ * The preview key in that file is a throwaway preview-scoped key, set by explicit
+ * `npm run pb:preview` opt-in and reversed by `npm run pb:real`. Never throws — returns
+ * null on any error so the banner/advisory path is never the source of a CLI crash.
+ */
+export function getPreviewBinding() {
+    try {
+        if (process.env.PRODUCTBRAIN_API_KEY)
+            return null;
+        const localConfig = readLocalProjectConfig();
+        if (localConfig?.preview === true && localConfig.apiKey && localConfig.siteUrl) {
+            return { workspaceName: localConfig.workspaceName ?? null };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write/merge the profile pin into <projectRoot>/.productbrain/config.local.json,
+ * preserving any sibling keys. Single source of truth for the local pin write —
+ * used by `pb profile use --local`, the default reconcile path, and `pb connect`.
+ *
+ * Co-writer note (SF-2): scripts/pb-binding.mjs is the OTHER writer of config.local.json — it
+ * merges/strips the preview-binding keys (apiKey, siteUrl, preview, workspaceName) for
+ * `npm run pb:preview` / `npm run pb:real`. Both writers preserve the `profile` pin. If you add
+ * a preview-scoped key here or in readLocalProjectConfig(), update pb-binding.mjs's PREVIEW_KEYS.
+ */
+export function setLocalProfilePin(projectRoot, profile) {
+    const configDir = resolve(projectRoot, '.productbrain');
+    const localConfigPath = resolve(configDir, 'config.local.json');
+    let existing = {};
+    if (existsSync(localConfigPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(localConfigPath, 'utf8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                existing = parsed;
+        }
+        catch { /* ignore parse errors — we overwrite the pin below */ }
+    }
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(localConfigPath, JSON.stringify({ ...existing, profile }, null, 2) + '\n');
+}
+/**
+ * WP-458 E2 — one-shot preview apiKey refresh from disk.
+ *
+ * After a worktree preview is reseeded, seed-preview.mjs Step 6 mints a NEW apiKey into
+ * `.productbrain/preview.json`, but `config.local.json` (and the live `process.env` binding it
+ * seeded via loadEnv) still carry the PRE-reseed key — so the next `pb session start` fails auth
+ * with an opaque INTERNAL. This re-reads the fresh key from preview.json so the caller can retry
+ * ONCE (session.ts). It is deliberately disk-to-disk: it compares preview.json's key against
+ * config.local.json's bound key, NOT against process.env (which loadEnv already populated from the
+ * stale binding), so it can't be confused by its own prior population. Never throws — any error
+ * degrades to 'unavailable'/'not-bound' so it can sit on the session-start path.
+ *
+ * Co-writer note (SF-2): mirrors pb-binding.mjs / setLocalProfilePin — preserves every sibling key
+ * in config.local.json (profile, preview, workspaceName) and only rewrites apiKey + siteUrl.
+ */
+export function refreshPreviewApiKeyFromDisk() {
+    try {
+        const projectRoot = findProjectRoot(process.cwd());
+        if (!projectRoot)
+            return 'not-bound';
+        const local = readLocalProjectConfig();
+        // Only act on a real preview binding (preview:true + atomic apiKey+siteUrl pair, SF-3).
+        if (!local?.preview || !local.apiKey || !local.siteUrl)
+            return 'not-bound';
+        // Never clobber a genuine env override: if the live key is NOT the bound preview key, either
+        // the user exported their own PRODUCTBRAIN_API_KEY (env wins in resolveConfig) or a refresh
+        // already happened — bail either way. An unset env key is fine (loadEnv may not have run yet).
+        const liveKey = process.env.PRODUCTBRAIN_API_KEY;
+        if (liveKey && liveKey !== local.apiKey)
+            return 'not-bound';
+        // Read the freshly-minted key from preview.json (seed-preview.mjs Step 6).
+        const previewPath = resolve(projectRoot, '.productbrain', 'preview.json');
+        if (!existsSync(previewPath))
+            return 'unavailable';
+        let fresh;
+        try {
+            const parsed = JSON.parse(readFileSync(previewPath, 'utf8'));
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                return 'unavailable';
+            fresh = parsed;
+        }
+        catch {
+            return 'unavailable';
+        }
+        const freshKey = typeof fresh.apiKey === 'string' ? fresh.apiKey : '';
+        if (!freshKey.startsWith(API_KEY_PREFIX))
+            return 'unavailable';
+        // Same key as the one already bound — retrying would just fail again; the failure is not a
+        // stale key, so the caller surfaces the real error rather than relabelling it.
+        if (freshKey === local.apiKey)
+            return 'unchanged';
+        const freshSite = typeof fresh.siteUrl === 'string' && fresh.siteUrl ? fresh.siteUrl : local.siteUrl;
+        // Merge the fresh preview key into config.local.json, preserving siblings.
+        const localConfigPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+        let existing = {};
+        if (existsSync(localConfigPath)) {
+            try {
+                const parsed = JSON.parse(readFileSync(localConfigPath, 'utf8'));
+                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                    existing = parsed;
+            }
+            catch { /* overwrite below */ }
+        }
+        writeFileSync(localConfigPath, JSON.stringify({ ...existing, apiKey: freshKey, siteUrl: freshSite }, null, 2) + '\n');
+        // Update the live binding + drop the load cache so the next getConfig() uses the fresh key.
+        process.env.PRODUCTBRAIN_API_KEY = freshKey;
+        process.env.CONVEX_SITE_URL = freshSite.replace(/\/$/, '');
+        resetConfigCache();
+        return 'refreshed';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
+/**
+ * Resolve the effective profile NAME + where it came from. The SOURCE-PRECEDENCE
+ * ORDER matches resolveConfig() (env > local pin > global > default), but unlike
+ * resolveConfig() this reports the *configured* pin name even when that profile is
+ * unresolvable (deleted / missing key). That divergence is intentional: a dangling
+ * repo pin must be surfaced by `pb whoami`, not silently masked by the global
+ * profile — masking it is the TEN-2163 silent-drift bug. Used by `pb whoami` and
+ * the inline "now using" prints.
+ */
+export function resolveEffectiveProfile() {
+    const envProfile = process.env.PB_PROFILE?.trim();
+    if (envProfile)
+        return { profile: envProfile, source: 'env' };
+    const localProfile = readLocalProjectConfig()?.profile;
+    if (localProfile)
+        return { profile: localProfile, source: 'local' };
+    const globalProfile = getGlobalActiveProfile();
+    if (globalProfile)
+        return { profile: globalProfile, source: 'global' };
+    if (resolveNamedProfileConfig('default'))
+        return { profile: 'default', source: 'default' };
+    return { profile: null, source: 'none' };
+}
+/**
+ * Run the full config resolution cascade and return a typed result.
+ * Resolution order:
+ * 1. Environment variables (highest priority)
+ * 2. config.local.json profile → resolveNamedProfileConfig(profile) for apiKey + siteUrl
+ * 2b. config.json siteUrl (gateway override only — no apiKey, no profile)
+ * 3. Profile system (~/.config/productbrain/profiles/{name}.env)
+ * 4. Legacy home config (~/.config/productbrain/.env)
+ * 5. CWD .env files (.env.mcp, packages/mcp-server/.env.mcp, .env)
+ *
+ * siteUrl always has a value (falls back to DEFAULT_SITE_URL).
+ */
+export function resolveConfig() {
+    // 1. Env vars — check directly, don't mutate process.env
+    const envKey = process.env.PRODUCTBRAIN_API_KEY;
+    const envSite = process.env.CONVEX_SITE_URL;
+    if (envKey) {
+        return {
+            apiKey: envKey,
+            siteUrl: (envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+            source: 'env',
+        };
+    }
+    // 2. Local project config — check for direct preview binding first, then profile pin.
+    const localConfig = readLocalProjectConfig();
+    // 2a. Direct preview binding (config.local.json apiKey) — set by `npm run pb:preview`.
+    // Security classification: gitignored machine-local file; throwaway preview-scoped key;
+    // explicit opt-in via `npm run pb:preview`; reversible via `npm run pb:real`;
+    // loud PREVIEW banner on every command makes it un-missable (index.ts preAction hook).
+    //
+    // Atomic apiKey+siteUrl (SF-3): only honor the preview key when its OWN siteUrl is present.
+    // Never let a preview key borrow config.json's (real-dev) siteUrl — that would send a
+    // preview credential to a non-preview gateway (STD-261). If siteUrl is absent we skip this
+    // branch and fall through to the profile pin / default, so it is impossible by construction
+    // for a `preview:true` key to be paired with the committed real-dev gateway.
+    if (localConfig?.apiKey && localConfig.siteUrl) {
+        return {
+            apiKey: localConfig.apiKey,
+            siteUrl: localConfig.siteUrl.replace(/\/$/, ''),
+            source: 'project',
+        };
+    }
+    // 2b. Profile pin (config.local.json profile field, gitignored)
+    if (localConfig?.profile) {
+        const namedConfig = resolveNamedProfileConfig(localConfig.profile);
+        if (namedConfig?.apiKey) {
+            // siteUrl: local.profile.siteUrl || config.json.siteUrl || env || default
+            const projectConfig = readProjectConfig();
+            return {
+                apiKey: namedConfig.apiKey,
+                siteUrl: (namedConfig.siteUrl || projectConfig?.siteUrl || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+                source: 'project',
+            };
+        }
+    }
+    // 2b. config.json — siteUrl gateway override only (no apiKey, no profile)
+    // Falls through; siteUrl from config.json is used as a tiebreaker below in step 3.
+    // 3. Profile system
+    const projectConfig = readProjectConfig();
+    const profileConfig = resolveProfileConfig();
+    if (profileConfig?.apiKey) {
+        return {
+            apiKey: profileConfig.apiKey,
+            siteUrl: (projectConfig?.siteUrl || profileConfig.siteUrl || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+            source: 'profile',
+        };
+    }
+    // 4. Legacy home config
+    if (existsSync(HOME_ENV_PATH)) {
+        const vars = parseEnvVars(readFileSync(HOME_ENV_PATH, 'utf8'));
+        if (vars['PRODUCTBRAIN_API_KEY']) {
+            return {
+                apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                siteUrl: (projectConfig?.siteUrl || vars['CONVEX_SITE_URL'] || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+                source: 'profile',
+            };
+        }
+    }
+    // 5. CWD .env files
+    for (const p of CWD_ENV_PATHS) {
+        const full = resolve(process.cwd(), p);
+        if (existsSync(full)) {
+            const vars = parseEnvVars(readFileSync(full, 'utf8'));
+            if (vars['PRODUCTBRAIN_API_KEY']) {
+                return {
+                    apiKey: vars['PRODUCTBRAIN_API_KEY'],
+                    siteUrl: (projectConfig?.siteUrl || vars['CONVEX_SITE_URL'] || envSite || DEFAULT_SITE_URL).replace(/\/$/, ''),
+                    source: 'cwd',
+                };
+            }
+            break;
+        }
+    }
+    // 6. No API key found anywhere — return with siteUrl default
+    const resolvedSiteUrl = (projectConfig?.siteUrl || envSite || DEFAULT_SITE_URL).replace(/\/$/, '');
+    // TEN-2382: the published CLI's prod default is intended (WP-301), so we do NOT
+    // warn on prod fall-through in general. The ONE exception is the preview-scrub
+    // misroute — a preview binding whose apiKey is present but whose siteUrl was
+    // scrubbed (the STD-261 atomic guard at step 2a dropped the key), now silently
+    // resolving to the production gateway. That single case is a real misroute.
+    if (localConfig?.apiKey && resolvedSiteUrl === DEFAULT_SITE_URL.replace(/\/$/, '')) {
+        process.stderr.write(`Warning: a preview API key is configured but its deployment URL is missing — ` +
+            `defaulting to the production gateway ${DEFAULT_SITE_URL}. Run ` +
+            `\`npm run pb:preview\` to rebind the preview, or set CONVEX_SITE_URL.\n`);
+    }
+    return {
+        apiKey: undefined,
+        siteUrl: resolvedSiteUrl,
+        source: 'default',
+    };
+}
+/** Parse env file content and return key-value pairs (without mutating process.env). */
+function parseEnvVars(content) {
+    const vars = {};
+    for (const line of content.split('\n')) {
+        const m = line.match(/^([^#=]+)=(.*)$/);
+        if (m) {
+            vars[m[1].trim()] = m[2].trim().replace(/^["']|["']$/g, '');
+        }
+    }
+    return vars;
+}
 function parseEnvContent(content) {
     for (const line of content.split('\n')) {
         const m = line.match(/^([^#=]+)=(.*)$/);
@@ -25,9 +424,55 @@ function parseEnvContent(content) {
     }
 }
 function loadEnv() {
+    if (envLoaded)
+        return;
+    envLoaded = true;
+    // 1. Try local project config first (preview binding or profile pin, config.local.json)
+    const localConfig = readLocalProjectConfig();
+    // 1a. Direct preview binding — set by `npm run pb:preview`, takes priority over profile pin.
+    // Atomic apiKey+siteUrl (SF-3): only bind the preview key when its OWN siteUrl is present —
+    // never let it fall through to config.json's (real-dev) siteUrl (STD-261). Mirror of the
+    // resolveConfig() 2a guard so loadEnv() and resolveConfig() agree on what counts as a binding.
+    if (localConfig?.apiKey && localConfig.siteUrl && !process.env.PRODUCTBRAIN_API_KEY) {
+        process.env.PRODUCTBRAIN_API_KEY = localConfig.apiKey;
+        // SF-3 atomic pair: when we accept the preview key, we MUST pair it with
+        // its OWN siteUrl — even if CONVEX_SITE_URL is already exported. Otherwise
+        // a stale/real exported CONVEX_SITE_URL would silently route the preview
+        // credential to a non-preview gateway. Mirror of resolveConfig() step 2a,
+        // which returns localConfig.siteUrl unconditionally inside this branch.
+        process.env.CONVEX_SITE_URL = localConfig.siteUrl.replace(/\/$/, '');
+    }
+    // 1b. Profile pin
+    if (localConfig?.profile && !process.env.PRODUCTBRAIN_API_KEY) {
+        const namedConfig = resolveNamedProfileConfig(localConfig.profile);
+        if (namedConfig?.apiKey) {
+            process.env.PRODUCTBRAIN_API_KEY = namedConfig.apiKey;
+            if (!process.env.CONVEX_SITE_URL && namedConfig.siteUrl) {
+                process.env.CONVEX_SITE_URL = namedConfig.siteUrl.replace(/\/$/, '');
+            }
+        }
+    }
+    // 1b. Apply siteUrl from config.json (gateway override — no apiKey reading here)
+    const projectConfig = readProjectConfig();
+    if (projectConfig?.siteUrl && !process.env.CONVEX_SITE_URL) {
+        process.env.CONVEX_SITE_URL = projectConfig.siteUrl.replace(/\/$/, '');
+    }
+    // 2. Try profile system (handles auto-migration from legacy .env)
+    const profileConfig = resolveProfileConfig();
+    if (profileConfig) {
+        // Only set if not already set by env vars or project config
+        if (!process.env.PRODUCTBRAIN_API_KEY) {
+            process.env.PRODUCTBRAIN_API_KEY = profileConfig.apiKey;
+        }
+        if (!process.env.CONVEX_SITE_URL && profileConfig.siteUrl) {
+            process.env.CONVEX_SITE_URL = profileConfig.siteUrl.replace(/\/$/, '');
+        }
+    }
+    // 3. Legacy home config (in case profiles didn't find it)
     if (existsSync(HOME_ENV_PATH)) {
         parseEnvContent(readFileSync(HOME_ENV_PATH, 'utf8'));
     }
+    // 4. CWD env files
     for (const p of CWD_ENV_PATHS) {
         const full = resolve(process.cwd(), p);
         if (existsSync(full)) {
@@ -36,49 +481,55 @@ function loadEnv() {
         }
     }
 }
-loadEnv();
-function question(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim().toLowerCase()));
-    });
-}
-function questionRaw(rl, prompt) {
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => resolve((answer ?? '').trim()));
-    });
+/** Reset env loaded state — used for profile switching. */
+export function resetConfigCache() {
+    envLoaded = false;
 }
 /**
  * Guided flow when key is missing (TTY only). Per docs/cli-unauthenticated-user-journey.md.
  * Returns true if we saved and ran retry; false if user said No (caller should exit).
  */
 async function runGuidedFlow(retry) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    console.log('Do you have an API key from Product Brain? (y/n)');
-    console.log('  Get one: Product Brain app → Settings → API Keys');
-    const hasKey = await question(rl, '> ');
-    if (hasKey !== 'y' && hasKey !== 'yes') {
+    const hasKey = await promptConfirm({
+        message: 'Do you have an API key from Product Brain?',
+        initialValue: false,
+    });
+    if (!hasKey) {
         console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
-        rl.close();
         process.exit(0);
     }
-    let apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        console.log('Key must start with pb_sk_. Try again or run pb login.');
-        apiKey = await questionRaw(rl, 'Paste your API key (pb_sk_...): ');
+    let apiKey = await promptPassword({
+        message: `Paste your API key (${API_KEY_PREFIX}...)`,
+        validate: (v) => (!v ? 'Key is required' : undefined),
+    });
+    if (!apiKey.startsWith(API_KEY_PREFIX)) {
+        console.log(`Key must start with ${API_KEY_PREFIX}. Try again or run pb login.`);
+        apiKey = await promptPassword({
+            message: `Paste your API key (${API_KEY_PREFIX}...)`,
+            validate: (v) => (!v || !v.startsWith(API_KEY_PREFIX) ? `Key must start with ${API_KEY_PREFIX}` : undefined),
+        });
     }
-    rl.close();
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
+    if (!apiKey || !apiKey.startsWith(API_KEY_PREFIX)) {
         console.log('Get your key: Product Brain app → Settings → API Keys. Then run: pb login');
         process.exit(0);
     }
-    const content = [
-        `# Product Brain CLI — saved by guided setup`,
-        `PRODUCTBRAIN_API_KEY=${apiKey}`,
-        `CONVEX_SITE_URL=${DEFAULT_SITE_URL.replace(/\/$/, '')}`,
-        '',
-    ].join('\n');
-    mkdirSync(HOME_CONFIG_DIR, { recursive: true });
-    writeFileSync(HOME_ENV_PATH, content, { mode: 0o600 });
+    // Save as a named profile via the profile system
+    const { createProfile, getActiveProfile } = await import('./profiles.js');
+    const profileName = getActiveProfile() || 'default';
+    try {
+        createProfile(profileName, apiKey, DEFAULT_SITE_URL.replace(/\/$/, ''));
+    }
+    catch {
+        // Profile already exists — fall back to legacy path
+        const content = [
+            `# Product Brain CLI — saved by guided setup`,
+            `PRODUCTBRAIN_API_KEY=${apiKey}`,
+            `CONVEX_SITE_URL=${DEFAULT_SITE_URL.replace(/\/$/, '')}`,
+            '',
+        ].join('\n');
+        mkdirSync(HOME_CONFIG_DIR, { recursive: true });
+        writeFileSync(HOME_ENV_PATH, content, { mode: 0o600 });
+    }
     process.env.PRODUCTBRAIN_API_KEY = apiKey;
     process.env.CONVEX_SITE_URL = DEFAULT_SITE_URL.replace(/\/$/, '');
     console.log('Saved your key. Running your command…\n');
@@ -86,32 +537,133 @@ async function runGuidedFlow(retry) {
     return true;
 }
 export function getConfig() {
+    loadEnv();
     const apiKey = process.env.PRODUCTBRAIN_API_KEY ?? '';
     const siteUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_SITE_URL).replace(/\/$/, '');
-    if (!apiKey || !apiKey.startsWith('pb_sk_')) {
-        throw new Error(NON_TTY_MESSAGE);
+    if (!apiKey || !apiKey.startsWith(API_KEY_PREFIX)) {
+        throw new CLIError(NON_TTY_MESSAGE, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Set PRODUCTBRAIN_API_KEY or run `pb login`.',
+        });
     }
-    if (!siteUrl.startsWith('https://')) {
-        throw new Error(`CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`);
+    const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
+    if (!siteUrl.startsWith('https://') && !allowHttp) {
+        throw new CLIError(`CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Set CONVEX_SITE_URL to an https:// URL.',
+        });
     }
     return { apiKey, siteUrl };
 }
+/**
+ * Non-throwing alternative to getConfig().
+ *
+ * Architecture: getConfig() is the primary path for commands that require auth — it
+ * throws CLIError when the key is missing, which is correct for API call paths.
+ * getConfigSafe() is for status/probe surfaces (no-args dashboard, init) that need
+ * to check config availability without crashing. Both paths are intentional and
+ * coexist by design — see WP-303 review (DW#5).
+ *
+ * Uses resolveConfig() directly (no loadEnv) to avoid env var pollution affecting source attribution.
+ */
+export function getConfigSafe() {
+    const resolved = resolveConfig();
+    if (!resolved.apiKey || !resolved.apiKey.startsWith(API_KEY_PREFIX)) {
+        return { ok: false, reason: 'No API key. Run pb login or set PRODUCTBRAIN_API_KEY.' };
+    }
+    const siteUrl = resolved.siteUrl;
+    const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
+    if (!siteUrl.startsWith('https://') && !allowHttp) {
+        return {
+            ok: false,
+            reason: `CONVEX_SITE_URL must use HTTPS (got "${siteUrl.slice(0, 30)}…"). API keys must not be sent over unencrypted connections.`,
+        };
+    }
+    return { ok: true, apiKey: resolved.apiKey, siteUrl, source: resolved.source };
+}
 /**
  * Get config; if key is missing and stdin is a TTY, run guided flow (y/n → paste key → save → retry).
  * @param retry Called after saving key so the original command runs in-process.
  * @returns Config, or null if we ran retry (caller should return without running again).
  */
 export async function getConfigOrGuide(retry) {
+    loadEnv();
     const apiKey = process.env.PRODUCTBRAIN_API_KEY ?? '';
     const siteUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_SITE_URL).replace(/\/$/, '');
-    if (apiKey.startsWith('pb_sk_') && siteUrl.startsWith('https://')) {
+    const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
+    if (apiKey.startsWith(API_KEY_PREFIX) && (siteUrl.startsWith('https://') || allowHttp)) {
         return { apiKey, siteUrl };
     }
     if (!process.stdin.isTTY) {
-        throw new Error(NON_TTY_MESSAGE);
+        throw new CLIError(NON_TTY_MESSAGE, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Set PRODUCTBRAIN_API_KEY or run `pb login`.',
+        });
     }
     const didRetry = await runGuidedFlow(retry);
     return didRetry ? null : null;
 }
-export { HOME_CONFIG_DIR, HOME_ENV_PATH };
+/**
+ * Resolve config for admin operations — profile-only resolution.
+ *
+ * Admin commands (pb admin ...) must NOT read .productbrain/config.json or CWD env files.
+ * The project config intentionally pins the repo to a dev Convex site; admin operations
+ * target PROD workspaces via the operator's active profile. Reading project config here
+ * would silently route admin calls to the wrong gateway (TEN-1334).
+ *
+ * Resolution order:
+ * 1. Shell env vars (PRODUCTBRAIN_API_KEY / CONVEX_SITE_URL) — always win
+ * 2. Active named profile (~/.config/productbrain/profiles/{name}.env)
+ * 3. Legacy home config (~/.config/productbrain/.env)
+ * 4. DEFAULT_SITE_URL as fallback for siteUrl
+ *
+ * Throws CLIError with AUTH_MISSING if no API key is found.
+ */
+export function resolveAdminConfig() {
+    let apiKey;
+    let rawSiteUrl;
+    // 1. Shell env vars — always highest priority
+    const envKey = process.env.PRODUCTBRAIN_API_KEY;
+    if (envKey?.startsWith(API_KEY_PREFIX)) {
+        apiKey = envKey;
+        rawSiteUrl = process.env.CONVEX_SITE_URL;
+    }
+    // 2. Active profile (no project config, no CWD files)
+    if (!apiKey) {
+        const profileConfig = resolveProfileConfig();
+        if (profileConfig?.apiKey?.startsWith(API_KEY_PREFIX)) {
+            apiKey = profileConfig.apiKey;
+            rawSiteUrl = profileConfig.siteUrl;
+        }
+    }
+    // 3. Legacy ~/.config/productbrain/.env
+    if (!apiKey && existsSync(HOME_ENV_PATH)) {
+        const vars = parseEnvVars(readFileSync(HOME_ENV_PATH, 'utf8'));
+        if (vars['PRODUCTBRAIN_API_KEY']?.startsWith(API_KEY_PREFIX)) {
+            apiKey = vars['PRODUCTBRAIN_API_KEY'];
+            rawSiteUrl = vars['CONVEX_SITE_URL'];
+        }
+    }
+    if (!apiKey) {
+        throw new CLIError('No API key found. Run pb login or set PRODUCTBRAIN_API_KEY.', {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            guidance: 'Run `pb login` to set your API key.',
+        });
+    }
+    const siteUrl = (rawSiteUrl || DEFAULT_SITE_URL).replace(/\/$/, '');
+    const allowHttp = isDevMode() && siteUrl.startsWith('http://localhost');
+    if (!siteUrl.startsWith('https://') && !allowHttp) {
+        throw new CLIError(`CONVEX_SITE_URL must use HTTPS for admin operations (got "${siteUrl.slice(0, 30)}…").`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Set CONVEX_SITE_URL to an https:// URL.',
+        });
+    }
+    return { apiKey, siteUrl };
+}
+export { HOME_CONFIG_DIR, HOME_ENV_PATH, readProjectConfig };
 //# sourceMappingURL=config.js.map