skillrepo 2.0.0 → 3.1.0

package/src/test/lib/cli-config.test.mjs

@@ -0,0 +1,407 @@
+/**
+ * Unit tests for src/lib/cli-config.mjs (PR2 of #646).
+ *
+ * Covers:
+ *   • resolveFlags — every flag, the priority order (CLI flag > config
+ *     file > env var > default), error paths
+ *   • effectiveVendors — defaults, --global override, explicit list
+ *   • parseVendorList edge cases (alias, all, empty, unknown)
+ *
+ * The cli-config helper is shared by all four PR2 commands and PR3a's
+ * write commands, so coverage here is load-bearing.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { resolveFlags, effectiveVendors } from "../../lib/cli-config.mjs";
+import { CliError, EXIT_AUTH, EXIT_VALIDATION } from "../../lib/errors.mjs";
+
+let sandbox;
+let originalHome;
+let originalEnv;
+
+function setupSandbox() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-config-"));
+  mkdirSync(join(sandbox, "home", ".claude", "skillrepo"), { recursive: true });
+  originalHome = process.env.HOME;
+  // Snapshot the env vars we mutate so tests don't bleed into each other
+  originalEnv = {
+    SKILLREPO_ACCESS_KEY: process.env.SKILLREPO_ACCESS_KEY,
+    SKILLREPO_URL: process.env.SKILLREPO_URL,
+  };
+  process.env.HOME = join(sandbox, "home");
+  delete process.env.SKILLREPO_ACCESS_KEY;
+  delete process.env.SKILLREPO_URL;
+}
+
+function teardownSandbox() {
+  process.env.HOME = originalHome;
+  if (originalEnv.SKILLREPO_ACCESS_KEY === undefined) {
+    delete process.env.SKILLREPO_ACCESS_KEY;
+  } else {
+    process.env.SKILLREPO_ACCESS_KEY = originalEnv.SKILLREPO_ACCESS_KEY;
+  }
+  if (originalEnv.SKILLREPO_URL === undefined) {
+    delete process.env.SKILLREPO_URL;
+  } else {
+    process.env.SKILLREPO_URL = originalEnv.SKILLREPO_URL;
+  }
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+function writeConfig(obj) {
+  writeFileSync(
+    join(sandbox, "home", ".claude", "skillrepo", "config.json"),
+    JSON.stringify(obj),
+  );
+}
+
+// ── resolveFlags — priority order ──────────────────────────────────────
+
+describe("resolveFlags — credential priority", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("uses --key and --url when provided (highest priority)", () => {
+    writeConfig({ apiKey: "config_key", serverUrl: "https://config.example" });
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    process.env.SKILLREPO_URL = "https://env.example";
+
+    const flags = resolveFlags(["--key", "flag_key", "--url", "https://flag.example"]);
+    assert.equal(flags.apiKey, "flag_key");
+    assert.equal(flags.serverUrl, "https://flag.example");
+  });
+
+  it("falls back to config file when CLI flags absent", () => {
+    writeConfig({ apiKey: "config_key", serverUrl: "https://config.example" });
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    process.env.SKILLREPO_URL = "https://env.example";
+
+    const flags = resolveFlags([]);
+    assert.equal(flags.apiKey, "config_key");
+    assert.equal(flags.serverUrl, "https://config.example");
+  });
+
+  it("falls back to env vars when no config file", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    process.env.SKILLREPO_URL = "https://env.example";
+
+    const flags = resolveFlags([]);
+    assert.equal(flags.apiKey, "env_key");
+    assert.equal(flags.serverUrl, "https://env.example");
+  });
+
+  it("falls back to DEFAULT_URL when nothing provides a URL", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    const flags = resolveFlags([]);
+    assert.equal(flags.serverUrl, "https://skillrepo.dev");
+  });
+
+  it("throws authError when no key is configured anywhere", () => {
+    assert.throws(
+      () => resolveFlags([]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_AUTH && /No access key/.test(err.message),
+    );
+  });
+
+  it("requireAuth: false skips the no-key error", () => {
+    const flags = resolveFlags([], { requireAuth: false });
+    assert.equal(flags.apiKey, null);
+  });
+
+  it("ignores corrupt config file gracefully", () => {
+    writeFileSync(
+      join(sandbox, "home", ".claude", "skillrepo", "config.json"),
+      "this is not json {{{",
+    );
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    const flags = resolveFlags([]);
+    assert.equal(flags.apiKey, "env_key");
+  });
+
+  it("merges flag override with config-file fallback (mixed)", () => {
+    writeConfig({ apiKey: "config_key", serverUrl: "https://config.example" });
+    // Override only the URL via flag; key still comes from config
+    const flags = resolveFlags(["--url", "https://flag.example"]);
+    assert.equal(flags.apiKey, "config_key");
+    assert.equal(flags.serverUrl, "https://flag.example");
+  });
+});
+
+// ── resolveFlags — skipConfig (round-1 review fix) ────────────────────
+
+describe("resolveFlags — skipConfig", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  // This option was introduced in the round-1 PR3b fix because `init`
+  // needs to own its credential lifecycle end-to-end. Before this
+  // option, `resolveFlags` would silently inject the cached config key
+  // AND eagerly default `serverUrl` to the production URL — making
+  // init's `--force` and stale-key branches dead code. These tests
+  // lock the skipConfig contract: (1) config file is ignored,
+  // (2) production-URL default does NOT apply (caller must supply its
+  // own), (3) env vars still apply because they're explicit runtime
+  // state, not a cached credential.
+
+  it("skipConfig: true ignores the config file entirely", () => {
+    writeConfig({ apiKey: "config_key", serverUrl: "https://config.example" });
+    const flags = resolveFlags([], { requireAuth: false, skipConfig: true });
+    assert.equal(
+      flags.apiKey,
+      null,
+      "config-file key must NOT leak through when skipConfig is set",
+    );
+    assert.equal(
+      flags.serverUrl,
+      null,
+      "config-file URL must NOT leak through when skipConfig is set",
+    );
+  });
+
+  it("skipConfig: true does NOT apply the https://skillrepo.dev default", () => {
+    // Without skipConfig, an empty argv would return the production
+    // URL. With skipConfig, serverUrl stays null so the caller can
+    // decide what to do. This is the specific bug that made init's
+    // `!serverUrl && existingConfig` branch dead code in round 0.
+    const flags = resolveFlags([], { requireAuth: false, skipConfig: true });
+    assert.equal(flags.serverUrl, null);
+    assert.notEqual(flags.serverUrl, "https://skillrepo.dev");
+  });
+
+  it("skipConfig: true still consumes SKILLREPO_URL / SKILLREPO_ACCESS_KEY env vars", () => {
+    // Env vars are explicit runtime state, not cached credentials —
+    // they should still resolve under skipConfig. This matches the
+    // init.mjs flow: `init` reads the env directly in its own
+    // credential collection step too, so the behavior is consistent
+    // whether init is called via `resolveFlags` or not.
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    process.env.SKILLREPO_URL = "https://env.example";
+    const flags = resolveFlags([], { requireAuth: false, skipConfig: true });
+    assert.equal(flags.apiKey, "env_key");
+    assert.equal(flags.serverUrl, "https://env.example");
+  });
+
+  it("skipConfig: true still honors --key and --url flags (highest priority)", () => {
+    writeConfig({ apiKey: "config_key", serverUrl: "https://config.example" });
+    process.env.SKILLREPO_ACCESS_KEY = "env_key";
+    const flags = resolveFlags(
+      ["--key", "flag_key", "--url", "https://flag.example"],
+      { requireAuth: false, skipConfig: true },
+    );
+    // Flags still win — the option only suppresses the config-file
+    // fallback, it doesn't disable flag parsing.
+    assert.equal(flags.apiKey, "flag_key");
+    assert.equal(flags.serverUrl, "https://flag.example");
+  });
+});
+
+// ── resolveFlags — flag parsing ────────────────────────────────────────
+
+describe("resolveFlags — flag parsing", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("parses --global", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--global"]);
+    assert.equal(flags.global, true);
+  });
+
+  it("parses --json", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--json"]);
+    assert.equal(flags.json, true);
+  });
+
+  it("parses -k as alias for --key", () => {
+    const flags = resolveFlags(["-k", "k1"]);
+    assert.equal(flags.apiKey, "k1");
+  });
+
+  it("parses -u as alias for --url", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["-u", "https://x"]);
+    assert.equal(flags.serverUrl, "https://x");
+  });
+
+  it("parses --ide claudeCode", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--ide", "claudeCode"]);
+    assert.deepEqual(flags.vendors, ["claudeCode"]);
+  });
+
+  it("parses --ide alias 'claude' as claudeCode", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--ide", "claude"]);
+    assert.deepEqual(flags.vendors, ["claudeCode"]);
+  });
+
+  it("parses --ide multi-vendor", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--ide", "claude,cursor,windsurf"]);
+    assert.deepEqual(flags.vendors, ["claudeCode", "cursor", "windsurf"]);
+  });
+
+  it("parses --ide all as the full vendor list", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--ide", "all"]);
+    assert.deepEqual(flags.vendors, ["claudeCode", "cursor", "windsurf", "vscode"]);
+  });
+
+  it("rejects --ide cursor,all (mixing all with explicit vendors is ambiguous)", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["--ide", "cursor,all"]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION && /cannot mix/.test(err.message),
+    );
+  });
+
+  it("rejects --ide all,cursor in the other order too", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["--ide", "all,cursor"]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("accepts --ide all,all (degenerate case dedupes to the full set)", () => {
+    // The `all` token is hard-coded to mean the full vendor list. A
+    // user passing it twice is a degenerate input but unambiguous —
+    // both `all`s expand to the same set, so we accept it. This test
+    // locks the behavior so a future tightening of parseVendorList
+    // doesn't accidentally start rejecting it.
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const flags = resolveFlags(["--ide", "all,all"]);
+    assert.deepEqual(flags.vendors, ["claudeCode", "cursor", "windsurf", "vscode"]);
+  });
+
+  it("rejects unknown --ide vendor", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["--ide", "jetbrains"]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("rejects empty --ide list", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["--ide", ","]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("rejects unknown flag without acceptPositional", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["--bogus"]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+});
+
+// ── resolveFlags — positional handling ─────────────────────────────────
+
+describe("resolveFlags — positional callback", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("invokes acceptPositional for non-flag args", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const captured = [];
+    resolveFlags(["@alice/skill"], {
+      acceptPositional(arg) {
+        captured.push(arg);
+        return 1;
+      },
+    });
+    assert.deepEqual(captured, ["@alice/skill"]);
+  });
+
+  it("respects the consume count from acceptPositional", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    const captured = [];
+    resolveFlags(["--limit", "50", "@alice/skill"], {
+      acceptPositional(arg, i, all) {
+        if (arg === "--limit") {
+          captured.push(["limit", all[i + 1]]);
+          return 2;
+        }
+        captured.push(["query", arg]);
+        return 1;
+      },
+    });
+    assert.deepEqual(captured, [["limit", "50"], ["query", "@alice/skill"]]);
+  });
+
+  it("treats positional as unknown when acceptPositional returns false", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["random"], { acceptPositional: () => false }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("rejects positional when acceptPositional returns 0 (would loop forever)", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["random"], { acceptPositional: () => 0 }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("rejects positional when acceptPositional returns a negative number", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["random"], { acceptPositional: () => -1 }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("rejects positional when acceptPositional returns a non-integer", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["random"], { acceptPositional: () => 1.5 }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("treats positional as unknown when no callback provided", () => {
+    process.env.SKILLREPO_ACCESS_KEY = "k";
+    assert.throws(
+      () => resolveFlags(["random"]),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+});
+
+// ── effectiveVendors ───────────────────────────────────────────────────
+
+describe("effectiveVendors", () => {
+  it("returns ['claudeCode'] by default", () => {
+    assert.deepEqual(effectiveVendors({ vendors: null, global: false }), ["claudeCode"]);
+  });
+
+  it("returns undefined for global mode", () => {
+    assert.equal(effectiveVendors({ vendors: null, global: true }), undefined);
+  });
+
+  it("global overrides explicit vendors", () => {
+    assert.equal(
+      effectiveVendors({ vendors: ["cursor"], global: true }),
+      undefined,
+    );
+  });
+
+  it("returns explicit vendors when set", () => {
+    assert.deepEqual(
+      effectiveVendors({ vendors: ["claudeCode", "cursor"], global: false }),
+      ["claudeCode", "cursor"],
+    );
+  });
+});

package/src/test/lib/config.test.mjs

@@ -0,0 +1,257 @@
+/**
+ * Unit tests for src/lib/config.mjs (PR3b of #646).
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  writeFileSync,
+  existsSync,
+  readFileSync,
+  statSync,
+  chmodSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  readConfig,
+  writeConfig,
+  clearConfig,
+  CONFIG_SCHEMA_VERSION,
+} from "../../lib/config.mjs";
+import { globalConfigPath } from "../../lib/paths.mjs";
+import { CliError, EXIT_VALIDATION, EXIT_DISK } from "../../lib/errors.mjs";
+
+let sandbox;
+let originalHome;
+
+function setupSandbox() {
+  sandbox = mkdtempSync(join(tmpdir(), "cli-config-mjs-"));
+  mkdirSync(join(sandbox, "home"), { recursive: true });
+  originalHome = process.env.HOME;
+  process.env.HOME = join(sandbox, "home");
+}
+
+function teardownSandbox() {
+  process.env.HOME = originalHome;
+  if (sandbox) rmSync(sandbox, { recursive: true, force: true });
+}
+
+// ── readConfig ─────────────────────────────────────────────────────────
+
+describe("readConfig", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("returns null when the file does not exist", () => {
+    assert.equal(readConfig(), null);
+  });
+
+  it("reads a valid config file", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        schemaVersion: CONFIG_SCHEMA_VERSION,
+        apiKey: "sk_live_abc",
+        serverUrl: "https://example.com",
+        accountSlug: "alice",
+      }),
+    );
+    const result = readConfig();
+    assert.equal(result.apiKey, "sk_live_abc");
+    assert.equal(result.serverUrl, "https://example.com");
+    assert.equal(result.accountSlug, "alice");
+  });
+
+  it("accepts a legacy v2.0.0 config file with no schemaVersion", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        apiKey: "sk_live_abc",
+        serverUrl: "https://example.com",
+      }),
+    );
+    const result = readConfig();
+    assert.equal(result.apiKey, "sk_live_abc");
+    assert.equal(result.schemaVersion, CONFIG_SCHEMA_VERSION);
+  });
+
+  it("returns null on corrupt JSON", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(path, "not json {{{");
+    assert.equal(readConfig(), null);
+  });
+
+  it("returns null on unknown future schema version", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        schemaVersion: 999,
+        apiKey: "sk_live_abc",
+        serverUrl: "https://example.com",
+      }),
+    );
+    assert.equal(readConfig(), null);
+  });
+
+  it("returns null when apiKey is missing", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(path, JSON.stringify({ serverUrl: "https://example.com" }));
+    assert.equal(readConfig(), null);
+  });
+
+  it("returns null when serverUrl is missing", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(path, JSON.stringify({ apiKey: "sk_live_abc" }));
+    assert.equal(readConfig(), null);
+  });
+
+  it("returns null when file is an empty object", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(path, "{}");
+    assert.equal(readConfig(), null);
+  });
+
+  it("returns null when file is a JSON array (not object)", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(path, "[]");
+    assert.equal(readConfig(), null);
+  });
+});
+
+// ── writeConfig ────────────────────────────────────────────────────────
+
+describe("writeConfig", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("creates a new config file", () => {
+    const action = writeConfig({
+      apiKey: "sk_live_abc",
+      serverUrl: "https://example.com",
+      accountSlug: "alice",
+    });
+    assert.equal(action, "created");
+    const result = readConfig();
+    assert.equal(result.apiKey, "sk_live_abc");
+    assert.equal(result.accountSlug, "alice");
+    assert.equal(result.schemaVersion, CONFIG_SCHEMA_VERSION);
+    assert.ok(result.writtenAt); // timestamp present
+  });
+
+  it("updates an existing config file", () => {
+    writeConfig({ apiKey: "sk_live_old", serverUrl: "https://old.com" });
+    const action = writeConfig({
+      apiKey: "sk_live_new",
+      serverUrl: "https://new.com",
+    });
+    assert.equal(action, "updated");
+    const result = readConfig();
+    assert.equal(result.apiKey, "sk_live_new");
+    assert.equal(result.serverUrl, "https://new.com");
+  });
+
+  it("creates parent directory if missing", () => {
+    // sandbox HOME has no .claude/skillrepo/ yet
+    writeConfig({ apiKey: "sk_live_abc", serverUrl: "https://example.com" });
+    assert.ok(existsSync(globalConfigPath()));
+  });
+
+  it("preserves unknown fields from an existing config", () => {
+    const path = globalConfigPath();
+    mkdirSync(join(process.env.HOME, ".claude", "skillrepo"), { recursive: true });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        schemaVersion: CONFIG_SCHEMA_VERSION,
+        apiKey: "sk_live_old",
+        serverUrl: "https://old.com",
+        futureField: "preserve me",
+      }),
+    );
+    writeConfig({
+      apiKey: "sk_live_new",
+      serverUrl: "https://new.com",
+    });
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    assert.equal(raw.futureField, "preserve me");
+    assert.equal(raw.apiKey, "sk_live_new");
+  });
+
+  it("sets 0600 permissions on POSIX", { skip: process.platform === "win32" || process.getuid?.() === 0 }, () => {
+    writeConfig({ apiKey: "sk_live_abc", serverUrl: "https://example.com" });
+    const path = globalConfigPath();
+    const mode = statSync(path).mode & 0o777;
+    assert.equal(mode, 0o600, `Expected 0o600, got ${mode.toString(8)}`);
+  });
+
+  it("throws validationError on missing apiKey", () => {
+    assert.throws(
+      () => writeConfig({ serverUrl: "https://example.com" }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("throws validationError on missing serverUrl", () => {
+    assert.throws(
+      () => writeConfig({ apiKey: "sk_live_abc" }),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("throws validationError on null config", () => {
+    assert.throws(
+      () => writeConfig(null),
+      (err) => err instanceof CliError && err.exitCode === EXIT_VALIDATION,
+    );
+  });
+
+  it("throws diskError when parent dir is read-only", { skip: process.platform === "win32" || process.getuid?.() === 0 }, () => {
+    // Create the grandparent dir and make the parent path non-writable
+    const grandParent = join(process.env.HOME, ".claude");
+    mkdirSync(grandParent, { recursive: true });
+    chmodSync(grandParent, 0o555);
+
+    try {
+      assert.throws(
+        () => writeConfig({ apiKey: "sk_live_abc", serverUrl: "https://example.com" }),
+        (err) => err instanceof CliError && err.exitCode === EXIT_DISK,
+      );
+    } finally {
+      chmodSync(grandParent, 0o755);
+    }
+  });
+});
+
+// ── clearConfig ────────────────────────────────────────────────────────
+
+describe("clearConfig", () => {
+  beforeEach(setupSandbox);
+  afterEach(teardownSandbox);
+
+  it("returns false when no config exists", () => {
+    assert.equal(clearConfig(), false);
+  });
+
+  it("removes an existing config file", () => {
+    writeConfig({ apiKey: "sk_live_abc", serverUrl: "https://example.com" });
+    assert.ok(existsSync(globalConfigPath()));
+    assert.equal(clearConfig(), true);
+    assert.ok(!existsSync(globalConfigPath()));
+  });
+});