@productbrain/cli 0.1.0-beta.4809 → 0.1.0-beta.4818

package/dist/__tests__/config-prod-fallthrough.test.js

@@ -1,9 +1,12 @@
 /**
  * TEN-2382 (CLI per-site decision): the published CLI's prod default is intended,
- * so prod fall-through is NOT warned in general. The ONE exception is the
- * preview-scrub misroute: a preview binding whose apiKey is present but whose
- * siteUrl was scrubbed gets its key dropped (STD-261 atomic guard at config.ts:385)
- * and silently resolves to the production gateway. That single case warns.
+ * so prod fall-through is NOT warned in general. The ONE exception is a CLAIMED
+ * binding that cannot be completed — config.local.json carrying the `preview`
+ * marker OR an apiKey of its own. Such a file has declared which workspace this
+ * repo talks to, so it must resolve to its own atomic apiKey+siteUrl pair and
+ * refuses before any profile pin or production fallback rather than borrowing
+ * another gateway (SF-3 / STD-261). The claim is the credential, not the marker:
+ * a scrubbed binding that kept its key still refuses even with no `preview: true`.
  */
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
@@ -23,7 +26,7 @@ vi.mock('os', async (importOriginal) => {
         homedir: vi.fn(() => '/tmp/pb-test-fake-home-' + process.pid),
     };
 });
-describe('TEN-2382 CLI preview-scrub misroute warning', () => {
+describe('TEN-2382 CLI preview-scrub misroute refusal', () => {
     let tempDir;
     const originalCwd = process.cwd;
     const savedEnv = {};
@@ -56,13 +59,11 @@ describe('TEN-2382 CLI preview-scrub misroute warning', () => {
         vi.restoreAllMocks();
     });
     const writeLocalConfig = (obj) => writeFileSync(resolve(tempDir, '.productbrain', 'config.local.json'), JSON.stringify(obj));
-    it('warns when a preview key has no siteUrl and resolution falls to prod', () => {
-        writeLocalConfig({ apiKey: 'pb_sk_preview_test' }); // no siteUrl — the scrub edge
+    it('refuses when a marked preview binding has no siteUrl', () => {
+        writeLocalConfig({ apiKey: 'pb_sk_preview_test', preview: true });
         const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
-        const cfg = resolveConfig();
-        expect(cfg.source).toBe('default');
-        expect(cfg.siteUrl).toBe(DEFAULT_SITE_URL.replace(/\/$/, ''));
-        expect(stderr.mock.calls.some((c) => String(c[0]).includes(DEFAULT_SITE_URL))).toBe(true);
+        expect(() => resolveConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+        expect(stderr).not.toHaveBeenCalled();
     });
     it('does NOT warn for a plain unconfigured CLI (no local binding)', () => {
         const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
@@ -70,10 +71,20 @@ describe('TEN-2382 CLI preview-scrub misroute warning', () => {
         expect(cfg.source).toBe('default');
         expect(stderr.mock.calls.some((c) => String(c[0]).includes(DEFAULT_SITE_URL))).toBe(false);
     });
-    it('does NOT warn when CONVEX_SITE_URL redirects away from prod', () => {
+    it('refuses a marker-less key rather than borrowing CONVEX_SITE_URL from the shell', () => {
+        // Same shape as the marked case above minus the marker — a scrub that cleared `preview`
+        // and `siteUrl` but kept the key. An exported CONVEX_SITE_URL is another gateway, not
+        // this binding's own, so it must not complete the pair.
         writeLocalConfig({ apiKey: 'pb_sk_preview_test' });
         process.env.CONVEX_SITE_URL = 'https://my-preview.convex.site';
         const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
+        expect(() => resolveConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+        expect(stderr).not.toHaveBeenCalled();
+    });
+    it('does NOT warn when CONVEX_SITE_URL redirects away from prod and no local key claims a binding', () => {
+        // The file's original point: an ordinary redirect is not a misroute, so nothing is warned.
+        process.env.CONVEX_SITE_URL = 'https://my-preview.convex.site';
+        const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
         const cfg = resolveConfig();
         expect(cfg.siteUrl).toBe('https://my-preview.convex.site');
         expect(stderr.mock.calls.some((c) => String(c[0]).includes(DEFAULT_SITE_URL))).toBe(false);

package/dist/__tests__/config-prod-fallthrough.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-prod-fallthrough.test.js","sourceRoot":"","sources":["../../src/__tests__/config-prod-fallthrough.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACvC,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAC5C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC;KAC9D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,OAAe,CAAC;IACpB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpF,IAAI,aAAiE,CAAC;IACtE,IAAI,gBAAuE,CAAC;IAE5E,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,uBAAuB,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3C,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAE,EAAE,CACxC,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,mBAAmB,CAAC,EACtD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CACpB,CAAC;IAEJ,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,gBAAgB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,8BAA8B;QAClF,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,gBAAgB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,gCAAgC,CAAC;QAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config-prod-fallthrough.test.js","sourceRoot":"","sources":["../../src/__tests__/config-prod-fallthrough.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACvC,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAC5C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC;KAC9D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,IAAI,OAAe,CAAC;IACpB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpF,IAAI,aAAiE,CAAC;IACtE,IAAI,gBAAuE,CAAC;IAE5E,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,uBAAuB,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3C,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAE,EAAE,CACxC,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,mBAAmB,CAAC,EACtD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CACpB,CAAC;IAEJ,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,gBAAgB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,wFAAwF;QACxF,sFAAsF;QACtF,wDAAwD;QACxD,gBAAgB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,gCAAgC,CAAC;QAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,2FAA2F;QAC3F,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,gCAAgC,CAAC;QAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CACvE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/config.test.js

@@ -6,7 +6,7 @@
  */
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'fs';
-import { resolve } from 'path';
+import { dirname, resolve } from 'path';
 import { tmpdir } from 'os';
 import { randomUUID } from 'crypto';
 // Mock the profiles module to prevent real profile config from leaking in
@@ -318,6 +318,208 @@ describe('config resolution', () => {
                 expect(result.reason).toContain('No API key');
             }
         });
+        it('names the FILE, not CONVEX_SITE_URL, when a file supplied the non-HTTPS URL', () => {
+            // A file-sourced siteUrl outranks CONVEX_SITE_URL everywhere except an env-key override, so
+            // "set CONVEX_SITE_URL" would send the operator back through the same failure.
+            process.env.CONVEX_SITE_URL = 'https://this-would-never-win.example.com';
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+                apiKey: 'pb_sk_preview_key_0123456789abcdef',
+                siteUrl: 'http://insecure.example.com',
+                preview: true,
+            }));
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.reason).toMatch(/must use HTTPS/i);
+                // The binding supplies its own URL, so the repair is that file alone — naming a profile
+                // it may also pin would point at something that does not control this URL.
+                expect(result.guidance).toContain('.productbrain/config.local.json');
+                expect(result.guidance).not.toMatch(/profile/i);
+                expect(result.guidance).not.toMatch(/CONVEX_SITE_URL/);
+            }
+        });
+        it('names CONVEX_SITE_URL when the environment did supply the non-HTTPS URL', () => {
+            process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_env_key';
+            process.env.CONVEX_SITE_URL = 'http://insecure.example.com';
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('CONVEX_SITE_URL');
+            }
+        });
+        // ── The URL's origin is NOT the credential's origin ────────────────────────────────────
+        //
+        // Every credential branch below step 2a prefers `.productbrain/config.json`'s siteUrl over
+        // its own, so a result labelled `profile`/`cwd` can still be carrying config.json's URL.
+        // Naming the credential's source would send the operator to edit a file that does not
+        // control the failing URL — the same failure, one detour later.
+        it('names config.json — not the profile — when config.json supplied the non-HTTPS URL', async () => {
+            const { resolveProfileConfig } = await import('../lib/profiles.js');
+            resolveProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_global_profile_key',
+                siteUrl: 'https://profile-would-have-been-fine.example.com',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'http://insecure.example.com' }));
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('.productbrain/config.json');
+                expect(result.guidance).not.toMatch(/profile/i);
+                expect(result.reason).toContain('.productbrain/config.json');
+            }
+        });
+        it('names config.json — not the .env file — when a CWD .env supplied the credential', () => {
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'http://insecure.example.com' }));
+            writeFileSync(resolve(tempDir, '.env'), 'PRODUCTBRAIN_API_KEY=pb_sk_cwd_key\nCONVEX_SITE_URL=https://cwd-would-have-been-fine.example.com\n');
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('.productbrain/config.json');
+                expect(result.guidance).not.toMatch(/\.env file/);
+            }
+        });
+        it('names the profile the repo pin points at, not just "the profile it pins"', async () => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            resolveNamedProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_pinned_key_0123456789',
+                siteUrl: 'http://insecure.example.com',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'pinned-workspace' }));
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('pinned-workspace');
+            }
+        });
+        it('names the CWD env file that actually won, not the generic .env', () => {
+            // CWD_ENV_PATHS scans .env.mcp first, so a generic "the .env file" label would send the
+            // operator to edit a file the cascade never read.
+            writeFileSync(resolve(tempDir, '.env.mcp'), 'PRODUCTBRAIN_API_KEY=pb_sk_cwd_key\nCONVEX_SITE_URL=http://insecure.example.com\n');
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('.env.mcp');
+            }
+        });
+        it('tells the operator to unset PRODUCTBRAIN_API_KEY — not to run pb login — for a bad exported key', () => {
+            // An exported key wins step 1 of the cascade, and `pb login` writes to a profile or the
+            // legacy home file — both of which lose to it. "Run pb login" would loop forever.
+            process.env.PRODUCTBRAIN_API_KEY = 'bad_prefix_key';
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-key');
+                expect(result.guidance).toMatch(/Unset PRODUCTBRAIN_API_KEY|replace it/);
+                // `pb login` may only be named to explain why it cannot help — never as the instruction.
+                expect(result.guidance).not.toMatch(/Run `pb login`/);
+                expect(result.guidance).toMatch(/cannot repair/);
+                expect(result.nextCommand).not.toBe('pb login');
+            }
+        });
+        it('still points a stored malformed key at pb login — login CAN repair that one', async () => {
+            const { resolveProfileConfig } = await import('../lib/profiles.js');
+            resolveProfileConfig.mockReturnValue({
+                apiKey: 'bad_prefix_key',
+                siteUrl: 'https://profile.example.com',
+            });
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-key');
+                expect(result.guidance).toMatch(/pb login/);
+                expect(result.nextCommand).toBe('pb login');
+            }
+        });
+        // ── Which profile actually supplied it ──────────────────────────────────────────────────
+        //
+        // resolveProfileConfig() reaches a credential four ways — PB_PROFILE, the active-profile
+        // marker, a `default` fallback, and the legacy ~/.config/productbrain/.env — and reports the
+        // winner's name. A fixed "the active profile" label sends the operator to edit a profile that
+        // supplied nothing, so the same failure comes straight back.
+        it('names the PB_PROFILE-selected profile, not "the active profile", for its non-HTTPS URL', async () => {
+            const { resolveProfileConfig, getGlobalActiveProfile } = await import('../lib/profiles.js');
+            // A DIFFERENT profile is globally active. PB_PROFILE outranks it in profiles.ts, which
+            // returns the selected name alongside the credential (profiles.ts resolveProfileConfig 1).
+            getGlobalActiveProfile.mockReturnValue('main-workspace');
+            process.env.PB_PROFILE = 'preview-workspace';
+            resolveProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_selected_profile_key',
+                siteUrl: 'http://insecure.example.com',
+                profileName: 'preview-workspace',
+            });
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-url');
+                expect(result.guidance).toContain('the profile "preview-workspace"');
+                expect(result.guidance).not.toContain('the active profile');
+                // The globally active profile did not supply this URL and must not be named.
+                expect(result.guidance).not.toContain('main-workspace');
+            }
+        });
+        it('names the `default` fallback profile for a malformed stored key', async () => {
+            const { resolveProfileConfig } = await import('../lib/profiles.js');
+            // No PB_PROFILE and no active-profile marker: profiles.ts falls back to `default`, which is
+            // a real file the operator can open — "the active profile" is not.
+            resolveProfileConfig.mockReturnValue({
+                apiKey: 'bad_prefix_key',
+                siteUrl: 'https://profile.example.com',
+                profileName: 'default',
+            });
+            resetConfigCache();
+            const result = getConfigSafe();
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.kind).toBe('invalid-key');
+                expect(result.reason).toContain('the profile "default"');
+                expect(result.reason).not.toContain('the active profile');
+            }
+        });
+        it('does NOT call the legacy home config "the active profile" — it is not a named profile', async () => {
+            // resolveConfig() step 4 labels the legacy ~/.config/productbrain/.env `profile`, but it
+            // carries no profile name at all, so naming a profile there would be a fabrication.
+            const { HOME_ENV_PATH } = await import('../lib/config.js');
+            mkdirSync(dirname(HOME_ENV_PATH), { recursive: true });
+            writeFileSync(HOME_ENV_PATH, 'PRODUCTBRAIN_API_KEY=bad_prefix_key\n');
+            try {
+                resetConfigCache();
+                const result = getConfigSafe();
+                expect(result.ok).toBe(false);
+                if (!result.ok) {
+                    expect(result.kind).toBe('invalid-key');
+                    expect(result.reason).not.toContain('the active profile');
+                    expect(result.reason).toContain('the stored profile configuration');
+                }
+            }
+            finally {
+                // The fake home is shared by every test in this file; a stray legacy .env would supply a
+                // credential to the cases that assert none is found.
+                rmSync(HOME_ENV_PATH, { force: true });
+            }
+        });
         it('returns { ok: true } with correct source when key exists in env', () => {
             process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_test_key';
             process.env.CONVEX_SITE_URL = 'https://test.example.com';
@@ -542,7 +744,7 @@ describe('config resolution', () => {
             expect(result.apiKey).toBe('pb_sk_profile_key');
             expect(result.source).toBe('project');
         });
-        it('rejects apiKey that does not start with API_KEY_PREFIX', () => {
+        it('rejects a preview binding whose apiKey does not start with API_KEY_PREFIX', () => {
             const pbDir = resolve(tempDir, '.productbrain');
             mkdirSync(pbDir, { recursive: true });
             writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
@@ -551,10 +753,9 @@ describe('config resolution', () => {
                 preview: true,
             }));
             resetConfigCache();
-            const result = resolveConfig();
-            // Should not pick up the invalid-prefix key
-            expect(result.apiKey).toBeUndefined();
-            expect(result.source).toBe('default');
+            // A present-but-malformed key is unusable, not absent — the refusal must say so, or the
+            // operator goes looking for a key that is sitting right there in the file.
+            expect(() => resolveConfig()).toThrow(/incomplete preview binding.*not a valid pb_sk_ key/i);
         });
         it('SF-3: does NOT bind a preview apiKey that has no siteUrl (never borrows config.json gateway)', () => {
             const pbDir = resolve(tempDir, '.productbrain');
@@ -564,12 +765,143 @@ describe('config resolution', () => {
             // Preview key present but its OWN siteUrl is absent (hand-edit / partial preview.json).
             writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ apiKey: 'pb_sk_preview_key_0123456789abcdef', preview: true }));
             resetConfigCache();
+            // The preview key must NOT be bound or allowed to fall through. Pairing it with
+            // config.json's real-dev gateway would send a preview credential to the wrong deployment.
+            expect(() => resolveConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+        });
+        it('S5: an incomplete preview binding is diagnosed before a sibling profile pin', async () => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            resolveNamedProfileConfig.mockReturnValue(null);
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+                profile: 'repo-pin',
+                apiKey: 'pb_sk_preview_key_0123456789abcdef',
+                preview: true,
+                workspaceName: 'Preview Workspace',
+            }));
+            resetConfigCache();
+            expect(() => resolveConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+            expect(() => getConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+        });
+        // ── Marker-less bindings: the claim is the credential, not the `preview` stamp ──────────
+        //
+        // A config.local.json carrying an apiKey is asserting which workspace this repo talks to
+        // whether or not `pb:preview` stamped `preview: true` — a hand-written or partially-scrubbed
+        // file is exactly the case that must not be skipped.
+        it('binds a marker-less apiKey + siteUrl pair and does NOT defer to a sibling profile pin', async () => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            // A perfectly resolvable pin sits in the same file — it names a DIFFERENT tenant, so
+            // adopting it would silently retarget every read and write.
+            resolveNamedProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_sibling_pin_key',
+                siteUrl: 'https://sibling-pin.example.com',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+                profile: 'sibling-pin',
+                apiKey: 'pb_sk_markerless_key_0123456789',
+                siteUrl: 'https://markerless.convex.site',
+                // no `preview: true` marker
+            }));
+            resetConfigCache();
             const result = resolveConfig();
-            // The preview key must NOT be bound — pairing it with config.json's real-dev gateway would
-            // send a preview credential to a non-preview deployment (STD-261). Branch is skipped entirely.
-            expect(result.apiKey).not.toBe('pb_sk_preview_key_0123456789abcdef');
-            expect(result.apiKey).toBeUndefined();
-            expect(result.source).toBe('default');
+            expect(result.apiKey).toBe('pb_sk_markerless_key_0123456789');
+            expect(result.siteUrl).toBe('https://markerless.convex.site');
+            expect(result.source).toBe('project');
+        });
+        it('refuses a marker-less apiKey with no siteUrl instead of resolving to the default gateway', () => {
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ apiKey: 'pb_sk_markerless_key_0123456789' }));
+            resetConfigCache();
+            // Silently falling through would send this credential to the production gateway (STD-261).
+            expect(() => resolveConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+        });
+        it('S5: the marker-less refusal also holds through the loadEnv() cascade', () => {
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ apiKey: 'pb_sk_markerless_key_0123456789' }));
+            resetConfigCache();
+            expect(() => getConfig()).toThrow(/incomplete preview binding.*missing deployment URL/i);
+            // The refusal must not leave a half-bound credential behind for the next caller.
+            expect(process.env.PRODUCTBRAIN_API_KEY).toBeUndefined();
+        });
+        // A present-but-non-string apiKey is a corrupt or hand-written binding, not an absent one.
+        // Treating it as absent would let the sibling profile pin supply a DIFFERENT tenant's
+        // credential — the workspace substitution this path exists to prevent.
+        it.each([
+            ['a number', 12345],
+            ['an empty string', ''],
+            ['a boolean', true],
+            ['an object', { key: 'pb_sk_nested' }],
+        ])('refuses a marker-less binding whose apiKey is %s, rather than adopting the sibling pin', async (_label, apiKey) => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            // A perfectly resolvable pin naming a DIFFERENT tenant sits in the same file.
+            resolveNamedProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_sibling_pin_key',
+                siteUrl: 'https://sibling-pin.example.com',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'sibling-pin', apiKey, siteUrl: 'https://markerless.convex.site' }));
+            resetConfigCache();
+            expect(() => resolveConfig()).toThrow(/not a valid pb_sk_ key/i);
+        });
+        it('treats an explicitly null apiKey as absent — JSON null means "no value"', async () => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            resolveNamedProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_pin_key',
+                siteUrl: 'https://pinned.example.com',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'pinned-workspace', apiKey: null }));
+            resetConfigCache();
+            const result = resolveConfig();
+            expect(result.apiKey).toBe('pb_sk_pin_key');
+            expect(result.source).toBe('project');
+        });
+        it('leaves the ordinary pin-only path untouched — the widened claim test must not swallow it', async () => {
+            const { resolveNamedProfileConfig } = await import('../lib/profiles.js');
+            resolveNamedProfileConfig.mockReturnValue({
+                apiKey: 'pb_sk_pin_only_key',
+            });
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            // Committed gateway + pin with no siteUrl of its own: the pin path's normal shape.
+            writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'https://project-gateway.example.com' }));
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'pin-only-workspace' }));
+            resetConfigCache();
+            const result = resolveConfig();
+            expect(result.apiKey).toBe('pb_sk_pin_only_key');
+            expect(result.siteUrl).toBe('https://project-gateway.example.com');
+            expect(result.source).toBe('project');
+        });
+    });
+    describe('readLocalProjectConfig() — apiKey validity', () => {
+        it('withholds a malformed apiKey and flags it so diagnostics can name the fault', async () => {
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ apiKey: 'sk_bad_prefix_key', siteUrl: 'https://my-preview.convex.site' }));
+            const { readLocalProjectConfig } = await import('../lib/config.js');
+            const local = readLocalProjectConfig();
+            // Withheld from `apiKey` so it can never bind, but not reported as absent either.
+            expect(local?.apiKey).toBeUndefined();
+            expect(local?.apiKeyMalformed).toBe(true);
+        });
+        it('loads a valid apiKey with no malformed flag', async () => {
+            const pbDir = resolve(tempDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({
+                apiKey: 'pb_sk_preview_key_0123456789abcdef',
+                siteUrl: 'https://my-preview.convex.site',
+            }));
+            const { readLocalProjectConfig } = await import('../lib/config.js');
+            const local = readLocalProjectConfig();
+            expect(local?.apiKey).toBe('pb_sk_preview_key_0123456789abcdef');
+            expect(local?.apiKeyMalformed).toBeUndefined();
         });
     });
     describe('getPreviewBinding()', () => {