fix(cli): quote a profile name a pasted command would otherwise split

The suggestion configure prints is meant to be pasted, and it interpolated the
profile name bare. Profile-name validation is creation-only by design — the
validator says so, because a hand-written `[profile my stack]` has to keep
resolving — so a name carrying whitespace, or a `;` that would end the pasted
command and start another, reaches this message unchecked.

Names that already satisfy the creation rule stay bare; the rest are single
quoted, embedded quotes included. Redaction runs first, so a control character
becomes a space and is then quoted rather than splitting the command.

Author: waleedlatif1

packages/sim-cli/src/commands/configure.test.ts

@@ -232,10 +232,38 @@ describe('configure and the root globals', () => {
     )
   })
 
-  /** The profile name is caller-supplied, so it is redacted like the value. */
+  /**
+   * The profile name is caller-supplied, so it is redacted like the value —
+   * and redaction turns the separator into a space, which the suggestion then
+   * has to quote to stay one argument.
+   */
   it('redacts a control character out of the profile it suggests', async () => {
     await expect(run('-P', 'dev\u2028sim login', '--output', 'json')).rejects.toThrow(
-      'sim configure --profile dev sim login --set-output json'
+      "sim configure --profile 'dev sim login' --set-output json"
+    )
+  })
+
+  /**
+   * Profile-name validation is creation-only by design, so a hand-written
+   * `[profile my stack]` keeps resolving and reaches this suggestion. Unquoted,
+   * a name carrying a `;` would end the pasted command and start another.
+   */
+  it('quotes a profile name a pasted command would otherwise split', async () => {
+    await expect(run('-P', 'my stack', '--output', 'json')).rejects.toThrow(
+      "sim configure --profile 'my stack' --set-output json"
+    )
+    await expect(run('-P', 'a;rm -rf x', '--output', 'json')).rejects.toThrow(
+      "sim configure --profile 'a;rm -rf x' --set-output json"
+    )
+    await expect(run('-P', "it's mine", '--output', 'json')).rejects.toThrow(
+      "sim configure --profile 'it'\\''s mine' --set-output json"
+    )
+  })
+
+  /** A name that already satisfies the creation rule needs no quoting noise. */
+  it('leaves an ordinary profile name bare', async () => {
+    await expect(run('-P', 'dev.2_a-b', '--output', 'json')).rejects.toThrow(
+      'sim configure --profile dev.2_a-b --set-output json'
     )
   })
 

packages/sim-cli/src/commands/configure.ts

@@ -7,7 +7,12 @@ import {
   resolveAuthenticationProfileName,
   writeConfigProfile,
 } from '../config/index'
-import { normalizeEndpoint, normalizeWorkspaceId, redact } from '../config/profile'
+import {
+  normalizeEndpoint,
+  normalizeWorkspaceId,
+  PROFILE_NAME_PATTERN,
+  redact,
+} from '../config/profile'
 import { globalsOf, profileFrom } from '../context'
 import { SimApiError } from '../http/client'
 
@@ -52,6 +57,21 @@ function requireValue(value: string | undefined, flag: string, key: string): voi
  * they arrive through `sim login`, which is the only path that mints a key with
  * a recorded consent behind it.
  */
+/**
+ * Quotes a profile name that a pasted command would otherwise split.
+ *
+ * Profile-name validation is creation-only by design, so a hand-written
+ * `[profile my stack]` keeps resolving — and reaches this suggestion carrying
+ * whitespace, or a `;` that would end the pasted command and start another.
+ * Names that already match the creation rule are left bare, since quoting every
+ * one of them would only add noise to the common case.
+ */
+function quoteProfileArgument(name: string): string {
+  const redacted = redact(name)
+  if (PROFILE_NAME_PATTERN.test(redacted)) return redacted
+  return `'${redacted.replaceAll("'", "'\\''")}'`
+}
+
 export function configureCommand(): Command {
   return new Command('configure')
     .description("Set a profile's endpoint, default workspace, or output format")
@@ -71,7 +91,9 @@ export function configureCommand(): Command {
       ) => {
         const globals = globalsOf(command)
         const selectedProfile = globals.profile || process.env.SIM_PROFILE
-        const profileArg = selectedProfile ? ` --profile ${redact(selectedProfile)}` : ''
+        const profileArg = selectedProfile
+          ? ` --profile ${quoteProfileArgument(selectedProfile)}`
+          : ''
         for (const { option, flag, setFlag } of GLOBAL_FLAG_TWINS) {
           const value = globals[option]
           if (value === undefined) continue