From 2cfcdfa31eb7c518fcd8ab6d13b3cc6079b0235f Mon Sep 17 00:00:00 2001
From: phil-accelbyte <225106921+phil-accelbyte@users.noreply.github.com>
Date: Mon, 4 May 2026 23:28:51 +0800
Subject: [PATCH 1/3] fix(test): gate ProfileConfig import behind cfg(unix)

The import was unused on Windows because the only callers are inside
#[cfg(unix)] blocks, producing a build warning under cargo test on
windows-latest.
---
 tests/security/config_permissions.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/security/config_permissions.rs b/tests/security/config_permissions.rs
index dc39f5a..18ae23a 100644
--- a/tests/security/config_permissions.rs
+++ b/tests/security/config_permissions.rs
@@ -1,3 +1,4 @@
+#[cfg(unix)]
 use ags::runtime::config::ProfileConfig;
 
 // ── Config file permissions (Unix only) ──

From 9c80223041d35d31e0558375e9122b553386a61d Mon Sep 17 00:00:00 2001
From: phil-accelbyte <225106921+phil-accelbyte@users.noreply.github.com>
Date: Mon, 4 May 2026 23:40:44 +0800
Subject: [PATCH 2/3] fix(test): isolate dry_run tests from shared host config

Both test_dry_run_shows_request and test_dry_run_no_status_on_stderr
were calling ags() (raw cargo binary) instead of ags_isolated(), so
they depended on shared global config state. On Windows the order of
parallel test execution sometimes left no active profile in place
when these tests ran, producing a 'No active profile' failure.

Switching to ags_isolated() gives each test a unique AGS_HOME temp
dir; the binary auto-creates a default profile there on first run.
---
 tests/functional/iam/dry_run.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/iam/dry_run.rs b/tests/functional/iam/dry_run.rs
index bd4dbdb..3a43a96 100644
--- a/tests/functional/iam/dry_run.rs
+++ b/tests/functional/iam/dry_run.rs
@@ -1,10 +1,10 @@
-use crate::common::cli_helpers::ags;
+use crate::common::cli_helpers::ags_isolated;
 use predicates::prelude::*;
 
 /// --dry-run prints the HTTP method, path, and auth header without making a real request
 #[test]
 fn test_dry_run_shows_request() {
-    ags()
+    ags_isolated()
         .args([
             "--dry-run",
             "--namespace",
@@ -23,7 +23,7 @@ fn test_dry_run_shows_request() {
 /// --dry-run produces no stderr output so stdout can be cleanly piped for inspection
 #[test]
 fn test_dry_run_no_status_on_stderr() {
-    ags()
+    ags_isolated()
         .args([
             "--dry-run",
             "--namespace",

From 7a1bc7477dba84011e5c2578a02b2cc4b44d7358 Mon Sep 17 00:00:00 2001
From: phil-accelbyte <225106921+phil-accelbyte@users.noreply.github.com>
Date: Mon, 4 May 2026 23:49:24 +0800
Subject: [PATCH 3/3] fix(test): isolate scope_version cli helper with unique
 AGS_HOME

scope_version.rs defines its own cli() helper that set AGS_NO_KEYCHAIN
but not AGS_HOME, so the binary read profile state from the host
machine and from whatever other parallel tests had written. On macOS
runners this surfaced as 'No active profile' for
test_default_contract_routes_to_admin_default_version when the test
ran before any other test had set up a profile.

Adds the same per-process+per-thread unique AGS_HOME pattern used by
ags_isolated().
---
 tests/scope_version.rs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/scope_version.rs b/tests/scope_version.rs
index aeaad68..c8e2d3c 100644
--- a/tests/scope_version.rs
+++ b/tests/scope_version.rs
@@ -25,11 +25,18 @@ impl CmdOutput {
 }
 
 /// Spawn the `ags` binary with the given args and return its output.
+///
+/// Uses a unique `AGS_HOME` per call so tests don't share profile state
+/// with each other or with the host machine's real config.
 fn cli(args: &[&str]) -> CmdOutput {
+    let unique_dir = std::env::temp_dir()
+        .join(format!("ags-test-{}", std::process::id()))
+        .join(format!("{:?}", std::thread::current().id()));
     let inner = Command::cargo_bin("ags")
         .unwrap()
         .args(args)
         .env("AGS_NO_KEYCHAIN", "1")
+        .env("AGS_HOME", unique_dir)
         .output()
         .expect("failed to execute ags binary");
     CmdOutput { inner }