@productbrain/cli 0.1.0-beta.55 → 0.1.0-beta.5504

package/dist/__tests__/preview-key-refresh.test.js

@@ -0,0 +1,126 @@
+/**
+ * WP-458 E2 — refreshPreviewApiKeyFromDisk(): one-shot preview apiKey refresh.
+ *
+ * After a worktree preview is reseeded, seed-preview.mjs Step 6 mints a NEW apiKey into
+ * .productbrain/preview.json, but config.local.json (and the live process.env binding) still
+ * carry the PRE-reseed key — so `pb session start` fails auth with an opaque INTERNAL. This
+ * helper re-reads the fresh key from preview.json so the caller can retry once.
+ *
+ * Uses real temp dirs + cwd override (mirrors config.test.ts) — no fs mocks.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'fs';
+import { resolve } from 'path';
+import { tmpdir } from 'os';
+import { randomUUID } from 'crypto';
+vi.mock('../lib/profiles.js', () => ({
+    resolveProfileConfig: vi.fn(() => null),
+    resolveNamedProfileConfig: vi.fn(() => null),
+    getGlobalActiveProfile: vi.fn(() => null),
+}));
+vi.mock('os', async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual, homedir: vi.fn(() => '/tmp/pb-test-fake-home-' + process.pid) };
+});
+const STALE = 'pb_sk_' + 'a'.repeat(58);
+const FRESH = 'pb_sk_' + 'b'.repeat(58);
+const SITE = 'https://gallant-dog-245.eu-west-1.convex.site';
+describe('refreshPreviewApiKeyFromDisk', () => {
+    let tempDir;
+    const originalCwd = process.cwd;
+    const savedEnv = {};
+    const envKeys = ['PRODUCTBRAIN_API_KEY', 'CONVEX_SITE_URL', 'PB_PROFILE', 'PB_ENV'];
+    let refreshPreviewApiKeyFromDisk;
+    let resetConfigCache;
+    function writePb(file, obj) {
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, file), JSON.stringify(obj, null, 2) + '\n');
+    }
+    function readLocal() {
+        return JSON.parse(readFileSync(resolve(tempDir, '.productbrain', 'config.local.json'), 'utf8'));
+    }
+    beforeEach(async () => {
+        vi.resetAllMocks();
+        for (const key of envKeys) {
+            savedEnv[key] = process.env[key];
+            delete process.env[key];
+        }
+        tempDir = resolve(tmpdir(), `pb-keyrefresh-test-${randomUUID()}`);
+        mkdirSync(tempDir, { recursive: true });
+        process.cwd = () => tempDir;
+        const config = await import('../lib/config.js');
+        refreshPreviewApiKeyFromDisk = config.refreshPreviewApiKeyFromDisk;
+        resetConfigCache = config.resetConfigCache;
+        resetConfigCache();
+    });
+    afterEach(() => {
+        for (const key of envKeys) {
+            if (savedEnv[key] !== undefined)
+                process.env[key] = savedEnv[key];
+            else
+                delete process.env[key];
+        }
+        process.cwd = originalCwd;
+        try {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch { /* ignore */ }
+    });
+    it("returns 'refreshed' when preview.json holds a different valid key", () => {
+        writePb('config.local.json', { preview: true, apiKey: STALE, siteUrl: SITE, workspaceName: 'Preview Workspace', profile: 'product-brain' });
+        writePb('preview.json', { apiKey: FRESH, siteUrl: SITE, workspaceName: 'Preview Workspace' });
+        // Simulate the live binding loadEnv() would have set from the stale config.local.json.
+        process.env.PRODUCTBRAIN_API_KEY = STALE;
+        process.env.CONVEX_SITE_URL = SITE;
+        expect(refreshPreviewApiKeyFromDisk()).toBe('refreshed');
+        // config.local.json now carries the fresh key, preserving sibling keys.
+        const local = readLocal();
+        expect(local.apiKey).toBe(FRESH);
+        expect(local.profile).toBe('product-brain');
+        expect(local.preview).toBe(true);
+        // Live env binding is updated so the next getConfig() uses the fresh key.
+        expect(process.env.PRODUCTBRAIN_API_KEY).toBe(FRESH);
+    });
+    it("returns 'unchanged' when the on-disk key already matches (the failure is not a stale key)", () => {
+        writePb('config.local.json', { preview: true, apiKey: FRESH, siteUrl: SITE });
+        writePb('preview.json', { apiKey: FRESH, siteUrl: SITE });
+        process.env.PRODUCTBRAIN_API_KEY = FRESH;
+        expect(refreshPreviewApiKeyFromDisk()).toBe('unchanged');
+    });
+    it("returns 'unavailable' when preview.json is missing (caller surfaces the explicit error)", () => {
+        writePb('config.local.json', { preview: true, apiKey: STALE, siteUrl: SITE });
+        process.env.PRODUCTBRAIN_API_KEY = STALE;
+        expect(refreshPreviewApiKeyFromDisk()).toBe('unavailable');
+    });
+    it("returns 'unavailable' when preview.json is malformed", () => {
+        writePb('config.local.json', { preview: true, apiKey: STALE, siteUrl: SITE });
+        const pbDir = resolve(tempDir, '.productbrain');
+        mkdirSync(pbDir, { recursive: true });
+        writeFileSync(resolve(pbDir, 'preview.json'), '{ not json');
+        process.env.PRODUCTBRAIN_API_KEY = STALE;
+        expect(refreshPreviewApiKeyFromDisk()).toBe('unavailable');
+    });
+    it("returns 'not-bound' when the worktree is not preview-bound", () => {
+        writePb('config.local.json', { profile: 'product-brain' });
+        writePb('preview.json', { apiKey: FRESH, siteUrl: SITE });
+        expect(refreshPreviewApiKeyFromDisk()).toBe('not-bound');
+    });
+    it("returns 'not-bound' when a real env override differs from the bound key (never clobbers it)", () => {
+        writePb('config.local.json', { preview: true, apiKey: STALE, siteUrl: SITE });
+        writePb('preview.json', { apiKey: FRESH, siteUrl: SITE });
+        // A genuine exported key (not the preview binding) is in play — leave it alone.
+        const realEnvKey = 'pb_sk_' + 'c'.repeat(58);
+        process.env.PRODUCTBRAIN_API_KEY = realEnvKey;
+        expect(refreshPreviewApiKeyFromDisk()).toBe('not-bound');
+        expect(process.env.PRODUCTBRAIN_API_KEY).toBe(realEnvKey);
+    });
+    it("returns 'refreshed' when no env key is set yet but the disk binding is stale", () => {
+        writePb('config.local.json', { preview: true, apiKey: STALE, siteUrl: SITE });
+        writePb('preview.json', { apiKey: FRESH, siteUrl: SITE });
+        // process.env.PRODUCTBRAIN_API_KEY intentionally unset.
+        expect(refreshPreviewApiKeyFromDisk()).toBe('refreshed');
+        expect(readLocal().apiKey).toBe(FRESH);
+    });
+});
+//# sourceMappingURL=preview-key-refresh.test.js.map

package/dist/__tests__/preview-key-refresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-key-refresh.test.js","sourceRoot":"","sources":["../../src/__tests__/preview-key-refresh.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IACvC,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAC5C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuB,CAAC;IAC3D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxC,MAAM,KAAK,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxC,MAAM,IAAI,GAAG,+CAA+C,CAAC;AAE7D,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,OAAe,CAAC;IACpB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAEpF,IAAI,4BAA+F,CAAC;IACpG,IAAI,gBAAuE,CAAC;IAE5E,SAAS,OAAO,CAAC,IAAY,EAAE,GAAY;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,SAAS,SAAS;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QAClE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChD,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;QACnE,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC3C,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;;gBAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;QAC1B,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5I,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9F,uFAAuF;QACvF,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;QAEnC,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,wEAAwE;QACxE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,0EAA0E;QAC1E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAEzC,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAEzC,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAChD,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAEzC,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,gFAAgF;QAChF,MAAM,UAAU,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,UAAU,CAAC;QAE9C,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,wDAAwD;QAExD,MAAM,CAAC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/profiles.test.js

@@ -7,7 +7,7 @@ import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs';
 import { resolve } from 'path';
 // vi.hoisted runs before mock hoisting — safe to compute test paths here
-const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LEGACY_PATH } = vi.hoisted(() => {
+const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LEGACY_PATH, mockClearSession, mockSessionStateRef, mockDiscardSession, mockDiscardAllSessions, mockSessionFileExists, existsSyncOverride, } = vi.hoisted(() => {
     const os = require('os');
     const path = require('path');
     const home = path.resolve(os.tmpdir(), `pb-test-profiles-${process.pid}`);
@@ -17,33 +17,65 @@ const { TEST_HOME, TEST_CONFIG_DIR, TEST_PROFILES_DIR, TEST_ACTIVE_PATH, TEST_LE
         TEST_PROFILES_DIR: path.resolve(home, '.config', 'productbrain', 'profiles'),
         TEST_ACTIVE_PATH: path.resolve(home, '.config', 'productbrain', 'active-profile'),
         TEST_LEGACY_PATH: path.resolve(home, '.config', 'productbrain', '.env'),
+        mockClearSession: vi.fn(),
+        mockSessionStateRef: { current: null },
+        mockDiscardSession: vi.fn(),
+        mockDiscardAllSessions: vi.fn(),
+        mockSessionFileExists: vi.fn(() => false),
+        // Escape hatch for the TOCTOU regression test below — a real ESM module namespace
+        // (`fs`) cannot be vi.spyOn'd directly ("Module namespace is not configurable in
+        // ESM"), so existsSync is wrapped to defer to this override when set, and to the
+        // real implementation otherwise. Every other test in this file exercises real fs.
+        existsSyncOverride: { current: null },
     };
 });
 vi.mock('os', async (importOriginal) => {
     const actual = await importOriginal();
     return { ...actual, homedir: () => TEST_HOME };
 });
+vi.mock('fs', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        existsSync: (path) => existsSyncOverride.current ? existsSyncOverride.current(path) : actual.existsSync(path),
+    };
+});
 // Mock session to track close-on-switch
-const mockClearSession = vi.fn();
-let mockSessionState = null;
 vi.mock('../lib/session.js', () => ({
-    readSession: () => mockSessionState,
+    readSession: () => mockSessionStateRef.current,
     writeSession: vi.fn(),
     clearSession: mockClearSession,
+    discardSession: mockDiscardSession,
+    discardAllSessions: mockDiscardAllSessions,
+    // reset/profile-switch now consider sibling active sessions (Codex re-review).
+    hasAnyActiveSession: () => false,
+    sessionFileExists: mockSessionFileExists,
     addCapturedEntry: vi.fn(),
 }));
+vi.mock('../lib/workspace-probe.js', () => ({
+    probeWorkspace: vi.fn(async () => ({ name: 'Resolved WS' })),
+}));
 // Import after mocks
 import { listProfiles, getActiveProfile, createProfile, useProfile, deleteProfile, resolveProfileConfig, } from '../lib/profiles.js';
+import { resolveProfileListState, runProfileUse, formatProfileList } from '../commands/profile.js';
+import { resetConfigCache } from '../lib/config.js';
+import { resetReportedProfileSnapshot } from '../lib/reportedProfile.js';
+import { setOutputMode } from '../lib/runner.js';
 describe('profiles', () => {
     beforeEach(() => {
+        // Safety net: every TOCTOU test clears this in its own try/finally, but reset here too
+        // so a prior failure can never leak a stubbed existsSync() into an unrelated test.
+        existsSyncOverride.current = null;
         // Clean slate
         if (existsSync(TEST_CONFIG_DIR)) {
             rmSync(TEST_CONFIG_DIR, { recursive: true, force: true });
         }
         mkdirSync(TEST_CONFIG_DIR, { recursive: true });
         delete process.env.PB_PROFILE;
-        mockSessionState = null;
+        mockSessionStateRef.current = null;
         vi.clearAllMocks();
+        mockDiscardSession.mockClear();
+        mockSessionFileExists.mockReturnValue(false);
     });
     afterEach(() => {
         if (existsSync(TEST_HOME)) {
@@ -72,6 +104,79 @@ describe('profiles', () => {
             expect(() => createProfile('', 'pb_sk_test')).toThrow(/Invalid profile name/);
             expect(() => createProfile('-bad', 'pb_sk_test')).toThrow(/Invalid profile name/);
         });
+        describe('overwrite option (TEN-2851)', () => {
+            it('without { overwrite: true }, still refuses an occupied name (default stays fail-closed)', () => {
+                createProfile('occupied', 'pb_sk_old', 'https://old.convex.site');
+                expect(() => createProfile('occupied', 'pb_sk_new', 'https://new.convex.site')).toThrow(/already exists/);
+                // Behavioral, not just "it threw": independent read proves the pre-existing file untouched.
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'occupied.env'), 'utf8');
+                expect(content).toContain('pb_sk_old');
+                expect(content).not.toContain('pb_sk_new');
+            });
+            it('with { overwrite: true }, replaces an occupied profile\'s credentials', () => {
+                createProfile('occupied', 'pb_sk_old', 'https://old.convex.site');
+                createProfile('occupied', 'pb_sk_new', 'https://new.convex.site', { overwrite: true });
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'occupied.env'), 'utf8');
+                expect(content).toContain('pb_sk_new');
+                expect(content).not.toContain('pb_sk_old');
+            });
+            it('{ overwrite: true } on a NON-existent profile still creates it (not overwrite-only)', () => {
+                createProfile('brand-new', 'pb_sk_fresh', undefined, { overwrite: true });
+                expect(listProfiles()).toContain('brand-new');
+            });
+        });
+        describe('TOCTOU-safe write (Copilot review, TEN-2851)', () => {
+            it('a race-created file surfaces PROFILE_ALREADY_EXISTS even when existsSync() lied "no" — proves the guard is the exclusive write, not the stale pre-check', () => {
+                // Simulate the race window: a file is genuinely on disk, but existsSync() is
+                // stubbed to report "not there" — modeling a concurrent create landing AFTER
+                // any existsSync() check would have run and BEFORE the write. If createProfile
+                // still relied on existsSync() to decide whether to write, this would silently
+                // clobber; the exclusive-create ('wx') write path fails on EEXIST regardless of
+                // what existsSync() reported.
+                createProfile('raced', 'pb_sk_original', 'https://original.convex.site');
+                existsSyncOverride.current = () => false;
+                try {
+                    expect(() => createProfile('raced', 'pb_sk_racer', 'https://racer.convex.site')).toThrow(/already exists/);
+                }
+                finally {
+                    existsSyncOverride.current = null;
+                }
+                // Independent read (override already cleared, real fs again) — file untouched.
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'raced.env'), 'utf8');
+                expect(content).toContain('pb_sk_original');
+                expect(content).not.toContain('pb_sk_racer');
+            });
+            it('{ overwrite: true } still replaces correctly even under the same existsSync()-lies-false stub (overwrite path is unaffected by the TOCTOU fix)', () => {
+                createProfile('raced-overwrite', 'pb_sk_original', 'https://original.convex.site');
+                existsSyncOverride.current = () => false;
+                try {
+                    createProfile('raced-overwrite', 'pb_sk_new', 'https://new.convex.site', { overwrite: true });
+                }
+                finally {
+                    existsSyncOverride.current = null;
+                }
+                const content = readFileSync(resolve(TEST_PROFILES_DIR, 'raced-overwrite.env'), 'utf8');
+                expect(content).toContain('pb_sk_new');
+                expect(content).not.toContain('pb_sk_original');
+            });
+        });
+        describe('overwrite never claims a missing active-profile marker (Codex review, WP-628 P2)', () => {
+            it('overwriting an EXISTING profile while active-profile is absent does NOT activate it — overwrite can never be "the first profile"', () => {
+                createProfile('first', 'pb_sk_first');
+                createProfile('second', 'pb_sk_second_old');
+                // Simulate the edge state the review names: profile files remain, but the
+                // active-profile marker is gone (e.g. manually deleted).
+                rmSync(TEST_ACTIVE_PATH, { force: true });
+                expect(existsSync(TEST_ACTIVE_PATH)).toBe(false);
+                createProfile('second', 'pb_sk_second_new', undefined, { overwrite: true });
+                // Before the fix: createProfile's unconditional "first profile → activate" branch
+                // would have written 'second' here, silently activating the overwritten target
+                // globally — contradicting saveKeyAsProfile's own "does not activate globally"
+                // contract. The marker must stay absent; an overwrite of an EXISTING profile is
+                // never "the first profile ever created."
+                expect(existsSync(TEST_ACTIVE_PATH)).toBe(false);
+            });
+        });
     });
     describe('auto-migration from legacy .env', () => {
         it('migrates legacy .env to default profile on first resolveProfileConfig()', () => {
@@ -104,6 +209,9 @@ describe('profiles', () => {
             process.env.PB_PROFILE = 'staging';
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_staging_key');
+            // WP-681 review fix: profileName reports which name ACTUALLY resolved (staging, the
+            // PB_PROFILE override) — never the active-profile file's name (prod).
+            expect(config.profileName).toBe('staging');
         });
         it('active-profile file wins over default', () => {
             createProfile('default', 'pb_sk_default_key');
@@ -111,12 +219,16 @@ describe('profiles', () => {
             useProfile('custom');
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_custom_key');
+            expect(config.profileName).toBe('custom');
         });
         it('falls back to default profile when no active-profile file', () => {
             mkdirSync(TEST_PROFILES_DIR, { recursive: true });
             writeFileSync(resolve(TEST_PROFILES_DIR, 'default.env'), 'PRODUCTBRAIN_API_KEY=pb_sk_fallback\n', { mode: 0o600 });
             const config = resolveProfileConfig();
             expect(config.apiKey).toBe('pb_sk_fallback');
+            // WP-681 review fix: profileName is 'default' — the level that actually resolved —
+            // never a stale/missing active-profile file name.
+            expect(config.profileName).toBe('default');
         });
     });
     describe('cannot delete active profile', () => {
@@ -150,6 +262,106 @@ describe('profiles', () => {
             expect(() => useProfile('nonexistent')).toThrow(/does not exist/);
         });
     });
+    describe('profile list state', () => {
+        it('reports repo-local profile as effective active profile when local config is present', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            createProfile('just-steady', 'pb_sk_steady');
+            useProfile('product-brain');
+            const prevCwd = process.cwd();
+            const projectDir = resolve(TEST_HOME, 'repo');
+            const pbDir = resolve(projectDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.local.json'), JSON.stringify({ profile: 'just-steady' }));
+            try {
+                process.chdir(projectDir);
+                const state = resolveProfileListState();
+                expect(state.active).toBe('just-steady');
+                expect(state.activeSource).toBe('local');
+                expect(state.localActive).toBe('just-steady');
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                process.chdir(prevCwd);
+            }
+        });
+        it('reports global active profile when no repo-local profile is present', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            useProfile('product-brain');
+            // Must not run from a real repo cwd — findProjectRoot walks up and picks up
+            // the workspace's config.local.json, which would flip activeSource to local.
+            const prevCwd = process.cwd();
+            const isolatedDir = resolve(TEST_HOME, 'no-local-profile');
+            mkdirSync(isolatedDir, { recursive: true });
+            try {
+                process.chdir(isolatedDir);
+                const state = resolveProfileListState();
+                expect(state.active).toBe('product-brain');
+                expect(state.activeSource).toBe('global');
+                expect(state.localActive).toBeNull();
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                process.chdir(prevCwd);
+            }
+        });
+        it('does not mark global as active in a declared project with no pin', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            useProfile('product-brain');
+            const prevCwd = process.cwd();
+            const savedKey = process.env.PRODUCTBRAIN_API_KEY;
+            delete process.env.PRODUCTBRAIN_API_KEY;
+            const projectDir = resolve(TEST_HOME, 'unpinned-project');
+            const pbDir = resolve(projectDir, '.productbrain');
+            mkdirSync(pbDir, { recursive: true });
+            writeFileSync(resolve(pbDir, 'config.json'), JSON.stringify({ siteUrl: 'https://project-gateway.example.com' }));
+            try {
+                process.chdir(projectDir);
+                resetConfigCache();
+                const state = resolveProfileListState();
+                expect(state.active).toBeNull();
+                expect(state.activeSource).not.toBe('global');
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                if (savedKey !== undefined)
+                    process.env.PRODUCTBRAIN_API_KEY = savedKey;
+                process.chdir(prevCwd);
+                resetConfigCache();
+            }
+        });
+        it('does not mark any profile active when PRODUCTBRAIN_API_KEY is exported (TEN-3240)', () => {
+            createProfile('product-brain', 'pb_sk_product');
+            useProfile('product-brain');
+            const savedKey = process.env.PRODUCTBRAIN_API_KEY;
+            process.env.PRODUCTBRAIN_API_KEY = 'pb_sk_exported_key_0123456789';
+            try {
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+                const state = resolveProfileListState();
+                // The export supplied the credential, so `product-brain` is listed but is NOT active.
+                expect(state.active).toBeNull();
+                expect(state.activeSource).toBe('env-key');
+                // Codex P2: the pretty list must SAY why nothing is marked active, or it reads as a
+                // broken list — and with zero profiles it would otherwise advise creating a shadowed one.
+                const pretty = formatProfileList(state);
+                expect(pretty).toContain('PRODUCTBRAIN_API_KEY');
+                expect(formatProfileList({ ...state, profiles: [] })).toContain('PRODUCTBRAIN_API_KEY');
+                // Codex P2 r2: must not promise the profiles win — a preview worktree's direct binding
+                // outranks every one of them, so unsetting the key still leaves them unused.
+                expect(pretty).not.toContain('for these profiles to take effect');
+                expect(pretty).toContain('which binding takes over');
+                expect(state.globalActive).toBe('product-brain');
+            }
+            finally {
+                if (savedKey !== undefined)
+                    process.env.PRODUCTBRAIN_API_KEY = savedKey;
+                else
+                    delete process.env.PRODUCTBRAIN_API_KEY;
+                resetConfigCache();
+                resetReportedProfileSnapshot();
+            }
+        });
+    });
     describe('profile file format', () => {
         it('stores apiKey and optional siteUrl', () => {
             createProfile('with-url', 'pb_sk_test', 'https://custom.convex.site');
@@ -164,5 +376,168 @@ describe('profiles', () => {
             expect(content).not.toContain('CONVEX_SITE_URL');
         });
     });
+    function makeRepo(profile) {
+        const repo = resolve(TEST_HOME, 'repo');
+        rmSync(repo, { recursive: true, force: true }); // fresh each call — no cross-test bleed of config.local.json
+        const pb = resolve(repo, '.productbrain');
+        mkdirSync(pb, { recursive: true });
+        if (profile)
+            writeFileSync(resolve(pb, 'config.local.json'), JSON.stringify({ profile }));
+        return repo;
+    }
+    describe('runProfileUse reconcile', () => {
+        const prevCwd = process.cwd();
+        afterEach(() => process.chdir(prevCwd));
+        it('default: reconciles an existing repo pin AND discards the session', async () => {
+            createProfile('product-brain', 'pb_live_x', 'https://example.convex.site');
+            createProfile('preview-ws', 'pb_live_y', 'https://example.convex.site');
+            const repo = makeRepo('preview-ws'); // repo pinned to the preview
+            useProfile('preview-ws');
+            process.chdir(repo);
+            mockSessionStateRef.current = { sessionId: 's-old' };
+            mockSessionFileExists.mockReturnValue(true);
+            await runProfileUse({ name: 'product-brain' });
+            const pin = JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8'));
+            expect(pin.profile).toBe('product-brain');
+            expect(getActiveProfile()).toBe('product-brain');
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
+        });
+        it('default: no repo pin -> flips global + discards session, writes no pin', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo(); // no pin
+            process.chdir(repo);
+            mockSessionStateRef.current = { sessionId: 's1' };
+            mockSessionFileExists.mockReturnValue(true);
+            await runProfileUse({ name: 'b' });
+            expect(getActiveProfile()).toBe('b');
+            expect(existsSync(resolve(repo, '.productbrain', 'config.local.json'))).toBe(false);
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
+        });
+        it('default: discards a stale CLOSED MARKER (file exists, no active session) on switch', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a');
+            process.chdir(repo);
+            mockSessionStateRef.current = null; // readSession() === null (closed marker)
+            mockSessionFileExists.mockReturnValue(true); // …but the marker file still exists
+            await runProfileUse({ name: 'b' });
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
+        });
+        it('--local: still writes the pin when the project has config.json and no pin yet (S2 repair path)', async () => {
+            createProfile('a', 'pb_live_a');
+            const repo = makeRepo();
+            writeFileSync(resolve(repo, '.productbrain', 'config.json'), JSON.stringify({ siteUrl: 'https://project.example.com' }));
+            process.chdir(repo);
+            await runProfileUse({ name: 'a', local: true });
+            expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('a');
+        });
+        it('--local: writes only the repo pin and discards the session', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            useProfile('a');
+            const repo = makeRepo('a');
+            process.chdir(repo);
+            mockSessionStateRef.current = { sessionId: 's1' };
+            mockSessionFileExists.mockReturnValue(true);
+            await runProfileUse({ name: 'b', local: true });
+            expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('b');
+            expect(getActiveProfile()).toBe('a'); // global untouched
+            expect(mockDiscardAllSessions).toHaveBeenCalled();
+        });
+        it('--global: with a differing repo pin, does NOT discard session', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a'); // repo pinned to a
+            process.chdir(repo);
+            mockSessionStateRef.current = { sessionId: 's1' };
+            mockSessionFileExists.mockReturnValue(true);
+            await runProfileUse({ name: 'b', global: true });
+            expect(getActiveProfile()).toBe('b');
+            expect(JSON.parse(readFileSync(resolve(repo, '.productbrain', 'config.local.json'), 'utf8')).profile).toBe('a'); // pin untouched
+            expect(mockDiscardAllSessions).not.toHaveBeenCalled();
+        });
+        // DEC-1632 / TEN-3398 / WP-720: the point-of-action replacement for the removed ambient
+        // pin-vs-global disagreement warning. `pb profile use --global` in a directory with a
+        // repo-local pin says so ONCE, right here, naming the pin and stating plainly that commands
+        // run in this repo will still use it — never again on every subsequent read/write. This
+        // exact mechanism already existed in profile.ts (`pinnedElsewhere`) before this slice; it
+        // was untested, so this pins its text now that it is the sole replacement for the notice.
+        it('--global: with a differing repo pin, names it ONCE in a point-of-action message (not an ambient one)', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a'); // repo pinned to a
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b', global: true });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toContain('Switched global profile to "b".');
+                expect(out).toContain('Note: this repo is pinned to "a" via config.local.json — the global switch won\'t change it here.');
+                expect(out).toContain('Run `pb use b` (no flag) to switch this repo too.');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
+        });
+        it('--global: with NO repo pin, prints no point-of-action note — nothing diverges to name', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo(); // no pin
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b', global: true });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).not.toContain('is pinned to');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
+        });
+        it('default (no flags): reconciles the pin itself instead of naming a divergence — no point-of-action note either', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a'); // repo pinned to a
+            process.chdir(repo);
+            setOutputMode('pretty');
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b' }); // no --local/--global -> reconcile
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).not.toContain('is pinned to');
+                expect(out).toContain('(updated repo-local pin in .productbrain/config.local.json)');
+            }
+            finally {
+                writeSpy.mockRestore();
+                setOutputMode('auto');
+            }
+        });
+        it('rejects --local and --global together', async () => {
+            createProfile('a', 'pb_live_a');
+            await expect(runProfileUse({ name: 'a', local: true, global: true })).rejects.toThrow(/both/i);
+        });
+        it('warns when PB_PROFILE env will override the switch', async () => {
+            createProfile('a', 'pb_live_a');
+            createProfile('b', 'pb_live_b');
+            const repo = makeRepo('a');
+            process.chdir(repo);
+            process.env.PB_PROFILE = 'a';
+            const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+            try {
+                await runProfileUse({ name: 'b' });
+                const out = writeSpy.mock.calls.map((c) => String(c[0])).join('');
+                expect(out).toMatch(/PB_PROFILE/);
+            }
+            finally {
+                writeSpy.mockRestore();
+                delete process.env.PB_PROFILE;
+            }
+        });
+    });
 });
 //# sourceMappingURL=profiles.test.js.map