@productbrain/cli 0.1.0-beta.77 → 0.1.0-beta.7700

package/dist/__tests__/session-resume-backstop.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-resume-backstop.test.d.ts.map

package/dist/__tests__/session-resume-backstop.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume-backstop.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-resume-backstop.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session-resume-backstop.test.js

@@ -0,0 +1,139 @@
+/**
+ * pb session start — resume workspace-mismatch backstop. TEN-2189 / WP-456 E2 (codex PR #145).
+ *
+ * The 2h auto-resume reads a closed marker and calls agent.resumeSession with the PREVIOUS
+ * session id. If the binding flipped (pb:preview/pb:real) or the profile switched since close,
+ * the current workspace differs from the marker's workspace and the resume would be a
+ * cross-workspace resume the deployment rejects. runSessionStart must detect the workspace
+ * mismatch, discard the stale marker, and start fresh instead.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mockKernelCall = vi.fn();
+vi.mock('../lib/client.js', () => ({
+    kernelCall: (...a) => mockKernelCall(...a),
+    kernelCallWithSession: vi.fn(),
+}));
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn(() => Promise.resolve({ apiKey: 'pb_sk_test', siteUrl: 'https://test.convex.site' })),
+    resolveEffectiveProfile: () => ({ profile: 'product-brain', source: 'local' }),
+    readLocalProjectConfig: () => ({ profile: 'product-brain' }),
+}));
+const mockReadSession = vi.fn(() => null);
+const mockReadClosedMarker = vi.fn(() => null);
+const mockDiscardSession = vi.fn();
+const mockWriteSession = vi.fn();
+vi.mock('../lib/session.js', () => ({
+    readSession: () => mockReadSession(),
+    readClosedMarker: () => mockReadClosedMarker(),
+    discardSession: () => mockDiscardSession(),
+    writeSession: (...a) => mockWriteSession(...a),
+    clearSession: vi.fn(),
+    sessionFileExists: vi.fn(() => false),
+    addCapturedEntry: vi.fn(),
+    // WP-479 E2: commands/session.ts imports the shared 2h resume-window constant from here.
+    RESUME_WINDOW_MS: 2 * 60 * 60 * 1000,
+}));
+vi.mock('../lib/runner.js', () => ({ isJsonMode: () => true }));
+vi.mock('../lib/profiles.js', () => ({ getActiveProfile: () => 'product-brain' }));
+vi.mock('../commands/handshake.js', () => ({ runHandshake: vi.fn(() => Promise.resolve()) }));
+// session.ts now resolves its profile label through the reporting leaf and names its write target
+// (WP-700). Both are mocked here so these tests keep exercising session lifecycle only, without
+// this file's partial `../lib/config.js` mock having to satisfy the leaf's own imports.
+vi.mock('../lib/reportedProfile.js', () => ({
+    resolveReportedProfile: vi.fn(() => ({ profile: 'product-brain', source: 'local' })),
+    isEnvKeyBinding: vi.fn(() => false),
+}));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => { }) }));
+import { runSessionStart } from '../commands/session.js';
+const recentClose = new Date(Date.now() - 60_000).toISOString(); // 1 min ago, inside 2h window
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockReadSession.mockReturnValue(null);
+    mockKernelCall.mockReset();
+});
+describe('runSessionStart resume backstop', () => {
+    it('discards the marker and starts fresh when the current workspace differs (cross-workspace)', async () => {
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'preview-sess', closedAt: recentClose,
+            workspaceId: 'ws-PREVIEW', workspaceName: 'Preview',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-REAL', keyId: 'key1' });
+            if (method === 'agent.startSession') {
+                return Promise.resolve({ sessionId: 'fresh-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw' });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            // Backstop fired: stale marker discarded, NO cross-workspace resume attempted, fresh start.
+            expect(mockDiscardSession).toHaveBeenCalled();
+            const methods = mockKernelCall.mock.calls.map((c) => c[0]);
+            expect(methods).not.toContain('agent.resumeSession');
+            expect(methods).toContain('agent.startSession');
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+    it('resumes normally when the marker workspace matches the current binding', async () => {
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'same-sess', closedAt: recentClose,
+            workspaceId: 'ws-REAL', workspaceName: 'Real',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-REAL', keyId: 'key1' });
+            if (method === 'agent.resumeSession') {
+                return Promise.resolve({ sessionId: 'resumed-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw' });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            const methods = mockKernelCall.mock.calls.map((c) => c[0]);
+            expect(methods).toContain('agent.resumeSession');
+            expect(methods).not.toContain('agent.startSession');
+            expect(mockDiscardSession).not.toHaveBeenCalled();
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+    // TASK-439 (WP-777): --role used to be dropped entirely on this path — resumeSession was called
+    // with no role argument at all, regardless of what the caller passed.
+    it('forwards --role to agent.resumeSession and surfaces the server read-back (TASK-439)', async () => {
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'same-sess', closedAt: recentClose,
+            workspaceId: 'ws-REAL', workspaceName: 'Real',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-REAL', keyId: 'key1' });
+            if (method === 'agent.resumeSession') {
+                return Promise.resolve({
+                    sessionId: 'resumed-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw',
+                    roleEntryId: 'entry-role-20', roleName: 'Builder',
+                });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart({ role: 'ROL-20' });
+            const resumeCall = mockKernelCall.mock.calls.find((c) => c[0] === 'agent.resumeSession');
+            expect(resumeCall?.[1]).toMatchObject({ role: 'ROL-20' });
+            const jsonWrites = writeSpy.mock.calls.map((c) => String(c[0])).filter((s) => s.trim().startsWith('{'));
+            const payload = JSON.parse(jsonWrites[jsonWrites.length - 1]);
+            expect(payload.roleEntryId).toBe('entry-role-20');
+            expect(payload.roleName).toBe('Builder');
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+});
+//# sourceMappingURL=session-resume-backstop.test.js.map

package/dist/__tests__/session-resume-backstop.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume-backstop.test.js","sourceRoot":"","sources":["../../src/__tests__/session-resume-backstop.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC/B,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACrD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC3B,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAC/E;IACD,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;CAC7D,CAAC,CAAC,CAAC;AAGJ,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC1C,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACjC,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;IACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,EAAE;IAC9C,cAAc,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE;IAC1C,YAAY,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzD,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACrC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACnF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9F,kGAAkG;AAClG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,8BAA8B;AAE/F,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,SAAS,EAAE,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;YAChD,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS;SACpD,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,4FAA4F;YAC5F,MAAM,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW;YAC7C,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM;SAC9C,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACpD,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,sEAAsE;IACtE,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW;YAC7C,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM;SAC9C,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;oBACpF,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC;YACzF,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session-role-name-sanitize.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-role-name-sanitize.test.d.ts.map

package/dist/__tests__/session-role-name-sanitize.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-role-name-sanitize.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-role-name-sanitize.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session-role-name-sanitize.test.js

@@ -0,0 +1,120 @@
+/**
+ * pb session start — "Acting as role: <name>" terminal-injection guard. TASK-439 round 1
+ * pre-review (PRRT_kwDORS4ils6mP_fm): the resume path printed the SERVER-SUPPLIED role name raw
+ * — a role renamed to contain a newline/control sequence could inject a spoofed extra line (or
+ * worse, an escape sequence) into the terminal. Both the fresh-start and resume read-backs now
+ * run the role name through `sanitizeSingleLineField` (the same single-line-safe sanitizer
+ * `../lib/strip.js` already centralizes for every other formatter in this package) before
+ * interpolating it — this file proves BOTH call sites, in plain-text (non-JSON) mode, where the
+ * raw string actually reaches the terminal (JSON mode already escapes it via JSON.stringify).
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mockKernelCall = vi.fn();
+vi.mock('../lib/client.js', () => ({
+    kernelCall: (...a) => mockKernelCall(...a),
+    kernelCallWithSession: vi.fn(),
+}));
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn(() => Promise.resolve({ apiKey: 'pb_sk_test', siteUrl: 'https://test.convex.site' })),
+    resolveEffectiveProfile: () => ({ profile: 'product-brain', source: 'local' }),
+    readLocalProjectConfig: () => ({ profile: 'product-brain' }),
+}));
+const mockReadSession = vi.fn(() => null);
+const mockReadClosedMarker = vi.fn(() => null);
+vi.mock('../lib/session.js', () => ({
+    readSession: () => mockReadSession(),
+    readClosedMarker: () => mockReadClosedMarker(),
+    discardSession: vi.fn(),
+    writeSession: vi.fn(),
+    clearSession: vi.fn(),
+    sessionFileExists: vi.fn(() => false),
+    addCapturedEntry: vi.fn(),
+    RESUME_WINDOW_MS: 2 * 60 * 60 * 1000,
+}));
+// Plain-text mode: unlike session-resume-backstop.test.ts (JSON-mocked), the raw role-name
+// string only reaches the terminal on THIS branch.
+vi.mock('../lib/runner.js', () => ({ isJsonMode: () => false }));
+vi.mock('../lib/profiles.js', () => ({ getActiveProfile: () => 'product-brain' }));
+vi.mock('../commands/handshake.js', () => ({ runHandshake: vi.fn(() => Promise.resolve()) }));
+vi.mock('../lib/reportedProfile.js', () => ({
+    resolveReportedProfile: vi.fn(() => ({ profile: 'product-brain', source: 'local' })),
+    isEnvKeyBinding: vi.fn(() => false),
+}));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => { }) }));
+import { runSessionStart } from '../commands/session.js';
+const EVIL_ROLE_NAME = 'Builder\nFAKE LINE: rm -rf /\r\x1b[31mred';
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockReadSession.mockReturnValue(null);
+    mockReadClosedMarker.mockReturnValue(null);
+    mockKernelCall.mockReset();
+});
+/** No "Acting as role" write contains a raw embedded \n, \r, or ESC — the words from a malicious
+ *  role name may still appear (sanitizing deletes/collapses, it doesn't censor content), but only
+ *  ever as inert text on the ONE line the write already owns, never a spoofed second line or a
+ *  terminal escape sequence. */
+function assertNoRawInjection(writeSpy) {
+    for (const call of writeSpy.mock.calls) {
+        const chunk = String(call[0]);
+        if (!chunk.includes('Acting as role'))
+            continue;
+        expect(chunk).not.toMatch(/\n.*\S/); // a trailing \n before EOL is fine; embedded content after one is not
+        expect(chunk).not.toContain('\r');
+        expect(chunk).not.toContain('\x1b');
+    }
+}
+describe('session start/resume — role name sanitized before terminal print', () => {
+    it('fresh start: a role name with embedded control chars is sanitized in "Acting as role"', async () => {
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-1', keyId: 'key1' });
+            if (method === 'agent.startSession') {
+                return Promise.resolve({
+                    sessionId: 'fresh-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw',
+                    roleEntryId: 'entry-role-1', roleName: EVIL_ROLE_NAME,
+                });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            const activityLine = writeSpy.mock.calls.map((c) => String(c[0])).find((s) => s.includes('Acting as role'));
+            expect(activityLine).toBeDefined();
+            expect(activityLine).toBe('Acting as role: Builder FAKE LINE: rm -rf /red\n');
+            assertNoRawInjection(writeSpy);
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+    it('resume: a role name with embedded control chars is sanitized in "Acting as role"', async () => {
+        const recentClose = new Date(Date.now() - 60_000).toISOString();
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'prev-sess', closedAt: recentClose, workspaceId: 'ws-1', workspaceName: 'Real',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-1', keyId: 'key1' });
+            if (method === 'agent.resumeSession') {
+                return Promise.resolve({
+                    sessionId: 'resumed-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw',
+                    roleEntryId: 'entry-role-1', roleName: EVIL_ROLE_NAME,
+                });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            const activityLine = writeSpy.mock.calls.map((c) => String(c[0])).find((s) => s.includes('Acting as role'));
+            expect(activityLine).toBeDefined();
+            expect(activityLine).toBe('Acting as role: Builder FAKE LINE: rm -rf /red\n');
+            assertNoRawInjection(writeSpy);
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+});
+//# sourceMappingURL=session-role-name-sanitize.test.js.map

package/dist/__tests__/session-role-name-sanitize.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-role-name-sanitize.test.js","sourceRoot":"","sources":["../../src/__tests__/session-role-name-sanitize.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC/B,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACrD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC3B,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAC/E;IACD,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;CAC7D,CAAC,CAAC,CAAC;AAGJ,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC1C,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9D,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;IACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,EAAE;IAC9C,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACrC,CAAC,CAAC,CAAC;AAEJ,2FAA2F;AAC3F,mDAAmD;AACnD,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACjE,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACnF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9F,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,cAAc,GAAG,2CAA2C,CAAC;AAEnE,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,SAAS,EAAE,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH;;;gCAGgC;AAChC,SAAS,oBAAoB,CAAC,QAAqC;IACjE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAChD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE;QAC3G,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1F,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;oBAClF,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC5G,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC9E,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;SAC1F,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1F,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;oBACpF,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc;iBACtD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC5G,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC9E,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session-start-key-refresh.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-start-key-refresh.test.d.ts.map

package/dist/__tests__/session-start-key-refresh.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start-key-refresh.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-start-key-refresh.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session-start-key-refresh.test.js

@@ -0,0 +1,191 @@
+/**
+ * WP-458 E2 — `pb session start` auto-recovers from a stale preview apiKey.
+ *
+ * After a preview reseed, the locally-bound apiKey is stale and the first kernel call fails with
+ * an opaque INTERNAL. session start must refresh the key from preview.json and retry ONCE; if it
+ * cannot recover it must surface a clean, actionable error (never the opaque INTERNAL); and on the
+ * real Chain (not preview-bound) it must rethrow the original error untouched (never mask).
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+const kernelCall = vi.fn();
+vi.mock('../lib/client.js', () => ({
+    kernelCall: (...args) => kernelCall(...args),
+    kernelCallWithSession: vi.fn(),
+}));
+const refreshPreviewApiKeyFromDisk = vi.fn();
+const readLocalProjectConfig = vi.fn();
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn(() => Promise.resolve({ apiKey: 'pb_sk_test', siteUrl: 'https://test.convex.site' })),
+    readLocalProjectConfig: () => readLocalProjectConfig(),
+    resolveEffectiveProfile: () => ({ profile: 'product-brain', source: 'local' }),
+    refreshPreviewApiKeyFromDisk: () => refreshPreviewApiKeyFromDisk(),
+}));
+const readSession = vi.fn(() => null);
+vi.mock('../lib/session.js', () => ({
+    readSession: () => readSession(),
+    writeSession: vi.fn(),
+    clearSession: vi.fn(),
+    discardSession: vi.fn(),
+    sessionFileExists: () => false,
+    readClosedMarker: () => null,
+}));
+vi.mock('../lib/runner.js', () => ({ isJsonMode: () => true }));
+vi.mock('../lib/prompts.js', () => ({ confirm: vi.fn(), isInteractive: () => false }));
+vi.mock('../lib/profiles.js', () => ({ getActiveProfile: () => 'product-brain' }));
+vi.mock('../formatters/session.js', () => ({
+    formatSessionStart: () => '',
+    formatSessionClose: () => '',
+    FEEDBACK_SUBMIT_HINT: 'hint',
+}));
+// session.ts now resolves its profile label through the reporting leaf and names its write target
+// (WP-700). Both are mocked here so these tests keep exercising session lifecycle only, without
+// this file's partial `../lib/config.js` mock having to satisfy the leaf's own imports.
+vi.mock('../lib/reportedProfile.js', () => ({
+    resolveReportedProfile: vi.fn(() => ({ profile: 'product-brain', source: 'local' })),
+    isEnvKeyBinding: vi.fn(() => false),
+}));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => { }) }));
+const PREVIEW_BOUND = { preview: true, apiKey: 'pb_sk_stale', siteUrl: 'https://test.convex.site' };
+const REAL_BOUND = { profile: 'product-brain' };
+function opaqueInternal() {
+    return new CLIError('boom', { code: ErrorCode.INTERNAL, category: 'internal' });
+}
+let runSessionStart;
+beforeEach(async () => {
+    vi.clearAllMocks();
+    kernelCall.mockReset();
+    refreshPreviewApiKeyFromDisk.mockReset();
+    readLocalProjectConfig.mockReset();
+    readSession.mockReset();
+    readSession.mockReturnValue(null);
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    ({ runSessionStart } = await import('../commands/session.js'));
+});
+describe('runSessionStart preview-key auto-refresh', () => {
+    it('RESTARTS rather than re-stamping when a reseed refreshes the key (Codex P1 r10)', async () => {
+        // A reseed can mint a REPLACEMENT workspace, not just a new key for the same one, so blessing
+        // the existing marker would hand the write guard a session belonging to the orphaned one.
+        readSession.mockReturnValue({
+            sessionId: 's-old', workspaceId: 'w-old', workspaceName: 'Old',
+            startedAt: '2026-01-01T00:00:00Z', entriesCaptured: [], profile: 'product-brain',
+            bindingFingerprint: 'oldfingerprint00',
+        });
+        readLocalProjectConfig.mockReturnValue({ preview: true });
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        kernelCall.mockImplementation(async (fn) => {
+            if (fn === 'resolveWorkspace')
+                return { _id: 'w-new', keyId: 'k1' };
+            if (fn === 'agent.startSession')
+                return { sessionId: 's-new', workspaceName: 'New', initiatedBy: 'cli', toolsScope: 'rw' };
+            return {};
+        });
+        await runSessionStart({ json: true });
+        // A fresh session was opened against the CURRENT workspace, not the old marker reused.
+        expect(kernelCall).toHaveBeenCalledWith('agent.startSession', expect.anything());
+    });
+    it('refreshes from preview.json and retries once on a stale-key INTERNAL', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async (fn) => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // first kernel call with the stale key
+            if (fn === 'resolveWorkspace')
+                return { _id: 'ws1', keyId: 'key1' };
+            if (fn === 'agent.startSession')
+                return { sessionId: 'sess1', workspaceName: 'Preview Workspace' };
+            return {};
+        });
+        await runSessionStart();
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+        // First (failed) call + retry's resolveWorkspace + agent.startSession.
+        expect(kernelCall).toHaveBeenCalledWith('agent.startSession', expect.anything());
+    });
+    it('surfaces a clean, actionable error (no opaque INTERNAL) when preview.json is unavailable', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('unavailable'); // preview.json missing/malformed
+        kernelCall.mockRejectedValue(opaqueInternal());
+        await expect(runSessionStart()).rejects.toMatchObject({
+            message: expect.stringContaining('preview.json'),
+        });
+        // It must NOT re-attempt with the same key.
+        expect(kernelCall).toHaveBeenCalledTimes(1);
+    });
+    it('rethrows the ORIGINAL error (no relabel) when the bound key is current — not a stale-key failure', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('unchanged'); // the key on disk is not stale
+        kernelCall.mockRejectedValue(opaqueInternal());
+        // The opaque INTERNAL was not a key problem, so the genuine error must surface untouched —
+        // it must NOT be relabelled as a preview-key rejection.
+        await expect(runSessionStart()).rejects.toThrow('boom');
+        expect(kernelCall).toHaveBeenCalledTimes(1);
+    });
+    it('rethrows the original error untouched on the real Chain (not preview-bound)', async () => {
+        readLocalProjectConfig.mockReturnValue(REAL_BOUND);
+        kernelCall.mockRejectedValue(opaqueInternal());
+        await expect(runSessionStart()).rejects.toThrow('boom');
+        expect(refreshPreviewApiKeyFromDisk).not.toHaveBeenCalled();
+    });
+    it('only retries once — a second failure after refresh surfaces a clean error', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        kernelCall.mockRejectedValue(opaqueInternal()); // both attempts fail
+        await expect(runSessionStart()).rejects.toMatchObject({
+            message: expect.stringContaining('preview.json'),
+        });
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+    });
+    it('preserves a non-stale-key retry failure after refresh (does not relabel it)', async () => {
+        // The first call fails on the stale key, the refresh succeeds, but the retry fails for a
+        // DIFFERENT reason (backend unreachable). The user must see that real error, not the
+        // preview-key message (Codex P2).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async () => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // stale key
+            throw new Error('backend unreachable'); // retry: not a stale-key-shaped failure
+        });
+        await expect(runSessionStart()).rejects.toThrow('backend unreachable');
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+    });
+    it('keeps the read-only-key guidance when the refreshed key resolves to a read-only scope', async () => {
+        // The refresh succeeded with a different (valid) key, but it has read-only scope, so the retry
+        // hits establishSession's local guard which throws an AUTH_INVALID. Although that is auth-shaped,
+        // it is NOT a rejected preview key — the readwrite-key guidance must surface, not reseed/rebind
+        // (Codex P2: only the opaque INTERNAL is relabelled on the retry path).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async (fn) => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // first call: stale key
+            if (fn === 'resolveWorkspace')
+                return { _id: 'ws1', keyId: null }; // retry: read-only scope
+            return {};
+        });
+        await expect(runSessionStart()).rejects.toThrow('read-only scope');
+    });
+    it('proactively refreshes a stale preview key when a session is already active (no kernel call)', async () => {
+        // An already-active session returns a status report without any kernel call, so the catch-based
+        // recovery never fires. It must still rebind the fresh key from disk so the next pb write does
+        // not fail with the stale one (Codex P2).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        readSession.mockReturnValue({
+            sessionId: 'active1',
+            workspaceName: 'Preview Workspace',
+            startedAt: 'now',
+            entriesCaptured: [],
+            profile: 'product-brain',
+        });
+        await runSessionStart();
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=session-start-key-refresh.test.js.map

package/dist/__tests__/session-start-key-refresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start-key-refresh.test.js","sourceRoot":"","sources":["../../src/__tests__/session-start-key-refresh.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACvD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,MAAM,4BAA4B,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7C,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACvC,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC7G,sBAAsB,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE;IACtD,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,4BAA4B,EAAE,GAAG,EAAE,CAAC,4BAA4B,EAAE;CACnE,CAAC,CAAC,CAAC;AAEJ,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAgB,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACrD,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAChC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;CAC7B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACnF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC5B,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC5B,oBAAoB,EAAE,MAAM;CAC7B,CAAC,CAAC,CAAC;AAEJ,kGAAkG;AAClG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAGnG,MAAM,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACpG,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAEhD,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,IAAI,eAA2E,CAAC;AAEhF,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,UAAU,CAAC,SAAS,EAAE,CAAC;IACvB,4BAA4B,CAAC,SAAS,EAAE,CAAC;IACzC,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACnC,WAAW,CAAC,SAAS,EAAE,CAAC;IACxB,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,8FAA8F;QAC9F,0FAA0F;QAC1F,WAAW,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;YAC9D,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe;YAChF,kBAAkB,EAAE,kBAAkB;SACvC,CAAC,CAAC;QACH,sBAAsB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpE,IAAI,EAAE,KAAK,oBAAoB;gBAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC3H,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,uFAAuF;QACvF,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAC,uCAAuC;YAC5E,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACpE,IAAI,EAAE,KAAK,oBAAoB;gBAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;YACnG,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,uEAAuE;QACvE,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,iCAAiC;QAC9F,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACjD,CAAC,CAAC;QACH,4CAA4C;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,+BAA+B;QAC1F,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,2FAA2F;QAC3F,wDAAwD;QACxD,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAErE,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,yFAAyF;QACzF,qFAAqF;QACrF,kCAAkC;QAClC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACvC,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAW,YAAY;YAC3D,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAQ,wCAAwC;QACzF,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvE,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,+FAA+F;QAC/F,kGAAkG;QAClG,gGAAgG;QAChG,wEAAwE;QACxE,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAiB,wBAAwB;YAC7E,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,yBAAyB;YAC5F,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,gGAAgG;QAChG,+FAA+F;QAC/F,0CAA0C;QAC1C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,WAAW,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,mBAAmB;YAClC,SAAS,EAAE,KAAK;YAChB,eAAe,EAAE,EAAE;YACnB,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QAEH,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}