fix(cli): stop a refusal being swallowed, and gate example ids by name

A blank root flag was refused everywhere except `profiles`, where the catch
that lets a broken profile still list absorbed it and the command exited 0
after printing the table. The refusal now carries its own error class, which
is what the listing rethrows on — the two are distinguished by type rather
than by matching message text, and a genuinely broken profile still lists.

The unknown-profile message redacted the name the caller typed but not the
suggestion or the list of configured names beside it, which come from the
same file and are equally attacker-influenced once it has been hand-edited.
Those are redacted now, as is every other message in these two files that
quotes a name read out of the config, and the profile listing flattens the
names it renders the way it already flattened the error column.

The example-id audit judged a uuid by its digit texture, on the premise that
a real one essentially never looks hand-authored. Measured against ten
million generated ids, 0.81% of them do — one in 124, where this change
alone replaced six. Requiring each digit exactly twice takes that to zero
but rejects all fourteen placeholders now in the specs, so it is no cheaper
than the alternative. The audit now holds the eighteen ids the specs
actually use, which is one file rather than the twenty-seven a reserved
format would touch, and a new id fails until someone lists it — which is the
review the check exists to force.

Author: waleedlatif1

packages/sim-cli/src/commands/auth.test.ts

@@ -10,7 +10,6 @@ const mocks = vi.hoisted(() => ({
   listProfiles: vi.fn<() => string[]>(() => []),
   request: vi.fn(),
   readCredentialsProfile: vi.fn<() => Record<string, string>>(() => ({})),
-  ProfileConfigError: class ProfileConfigError extends Error {},
   resolveAuthenticationProfileName: vi.fn((profile: string) => profile),
   pollForKey: vi.fn(async () => ({
     apiKey: 'sim-key',
@@ -49,10 +48,17 @@ vi.mock('../auth/device-flow', () => ({
  */
 vi.mock('../config/index', async () => ({
   ...(await import('../config/profile').then(
-    ({ FORBIDDEN_IN_VALUE, normalizeWorkspaceId, OUTPUT_FORMATS, validateProfileName }) => ({
+    ({
       FORBIDDEN_IN_VALUE,
       normalizeWorkspaceId,
       OUTPUT_FORMATS,
+      ProfileConfigError,
+      validateProfileName,
+    }) => ({
+      FORBIDDEN_IN_VALUE,
+      normalizeWorkspaceId,
+      OUTPUT_FORMATS,
+      ProfileConfigError,
       validateProfileName,
     })
   )),
@@ -62,7 +68,6 @@ vi.mock('../config/index', async () => ({
   deleteProfile: mocks.deleteProfile,
   listAuthenticationDependents: mocks.listAuthenticationDependents,
   listProfiles: mocks.listProfiles,
-  ProfileConfigError: mocks.ProfileConfigError,
   readCredentialsProfile: mocks.readCredentialsProfile,
   resolveAuthenticationProfileName: mocks.resolveAuthenticationProfileName,
   writeConfigProfile: mocks.writeConfigProfile,
@@ -74,6 +79,7 @@ vi.mock('../context', () => ({
   clientFrom: () => ({ client: { request: mocks.request }, profile: mocks.profileFrom() }),
 }))
 
+import { ProfileConfigError, ProfileOverrideError } from '../config/profile'
 import { SimApiError } from '../http/client'
 import { loginCommand, logoutCommand, profilesCommand, whoamiCommand } from './auth'
 
@@ -607,7 +613,7 @@ describe('profiles command', () => {
     // nothing, alone among the commands, because it never resolved at all.
     mocks.listProfiles.mockReturnValue(['default'])
     mocks.profileFrom.mockImplementation(() => {
-      throw new mocks.ProfileConfigError('Unknown profile "bogus".')
+      throw new ProfileConfigError('Unknown profile "bogus".')
     })
 
     await expect(profiles('list', '--profile', 'bogus')).rejects.toThrow('Unknown profile "bogus".')
@@ -665,13 +671,11 @@ describe('profiles command', () => {
     // it throws for exactly the profile this command exists to show.
     mocks.listProfiles.mockReturnValue(['broken', 'default'])
     mocks.profileFrom.mockImplementation(() => {
-      throw new mocks.ProfileConfigError('Profile "broken" references missing auth_profile "gone".')
+      throw new ProfileConfigError('Profile "broken" references missing auth_profile "gone".')
     })
     mocks.resolveAuthenticationProfileName.mockImplementation((profile) => {
       if (profile === 'broken') {
-        throw new mocks.ProfileConfigError(
-          'Profile "broken" references missing auth_profile "gone".'
-        )
+        throw new ProfileConfigError('Profile "broken" references missing auth_profile "gone".')
       }
       return profile
     })
@@ -689,7 +693,7 @@ describe('profiles command', () => {
     // profiles` must fail exactly like `sim profiles --profile typo`.
     mocks.listProfiles.mockReturnValue(['default'])
     mocks.profileFrom.mockImplementation(() => {
-      throw new mocks.ProfileConfigError('Unknown profile "bogus".')
+      throw new ProfileConfigError('Unknown profile "bogus".')
     })
     process.env.SIM_PROFILE = 'bogus'
 
@@ -706,7 +710,7 @@ describe('profiles command', () => {
     // exit 0. The catch exists to tolerate a broken *profile*, not a bad flag.
     mocks.listProfiles.mockReturnValue(['default'])
     mocks.profileFrom.mockImplementation(() => {
-      throw new mocks.ProfileConfigError('Unknown output format "jsonl" from env.')
+      throw new ProfileConfigError('Unknown output format "jsonl" from env.')
     })
     process.env.SIM_OUTPUT = 'jsonl'
 
@@ -718,15 +722,28 @@ describe('profiles command', () => {
     }
   })
 
+  it('refuses a blank root flag rather than absorbing it into the broken-profile fallback', async () => {
+    // The tolerance below exists for a profile that will not resolve. A blank
+    // `--workspace` is the caller's own argument, and swallowing it listed
+    // profiles and exited 0 where every other command exits 1.
+    mocks.listProfiles.mockReturnValue(['default'])
+    mocks.profileFrom.mockImplementation(() => {
+      throw new ProfileOverrideError('--workspace requires a value.')
+    })
+
+    await expect(profiles('list', '--workspace', '')).rejects.toThrow(
+      '--workspace requires a value.'
+    )
+    expect(console.log).not.toHaveBeenCalled()
+  })
+
   it('marks a broken profile and still lists the rest', async () => {
     // `profiles` is the command someone runs *because* a profile is broken, and
     // one bad auth_profile used to abort the listing with nothing shown at all.
     mocks.listProfiles.mockReturnValue(['broken', 'default', 'dev'])
     mocks.resolveAuthenticationProfileName.mockImplementation((profile) => {
       if (profile === 'broken') {
-        throw new mocks.ProfileConfigError(
-          'Profile "broken" references missing auth_profile "gone".'
-        )
+        throw new ProfileConfigError('Profile "broken" references missing auth_profile "gone".')
       }
       return profile
     })

packages/sim-cli/src/commands/auth.ts

@@ -28,6 +28,7 @@ import {
   writeConfigProfile,
   writeCredentialsProfile,
 } from '../config/index'
+import { ProfileOverrideError, redact } from '../config/profile'
 import { clientFrom, globalsOf, profileFrom } from '../context'
 import {
   type GetMetaResponse,
@@ -91,15 +92,15 @@ function presentAuthentication(source: SettingSource): {
 async function confirmProfileOverwrite(profileName: string): Promise<boolean> {
   if (!process.stdin.isTTY) {
     throw new SimApiError(
-      `Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`,
+      `Profile "${redact(profileName)}" already exists. Re-run with --yes to overwrite it.`,
       0
     )
   }
 
   const prompt = createInterface({ input: process.stdin, output: process.stderr })
   try {
     const answer = await prompt.question(
-      `Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `
+      `Profile "${redact(profileName)}" already exists. Replace its API key and login defaults? (y/N) `
     )
     return answer.trim().toLowerCase() === 'y' || answer.trim().toLowerCase() === 'yes'
   } finally {
@@ -117,7 +118,7 @@ function validateNewProfileName(profileName: string): void {
   validateProfileName(profileName)
   if (listProfiles().includes(profileName)) {
     throw new SimApiError(
-      `Profile "${profileName}" already exists. Remove it first with: sim logout --all --profile ${profileName}`,
+      `Profile "${redact(profileName)}" already exists. Remove it first with: sim logout --all --profile ${redact(profileName)}`,
       0
     )
   }
@@ -160,13 +161,13 @@ function requireStoredAuthentication(profile: ResolvedProfile): string {
   const storedKey = readCredentialsProfile(authProfile).api_key
   if (profile.sources.apiKey !== 'credentials' || !storedKey) {
     throw new SimApiError(
-      `Cannot create a shared profile from "${profile.name}": the active API key is not stored. Run: sim login --profile ${authProfile}`,
+      `Cannot create a shared profile from "${redact(profile.name)}": the active API key is not stored. Run: sim login --profile ${redact(authProfile)}`,
       0
     )
   }
   if (profile.sources.endpoint === 'flag' || profile.sources.endpoint === 'env') {
     throw new SimApiError(
-      `Cannot create a shared profile from "${profile.name}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${authProfile} --set-endpoint ${profile.endpoint}`,
+      `Cannot create a shared profile from "${redact(profile.name)}": the active endpoint comes from ${profile.sources.endpoint}. Save it with: sim configure --profile ${redact(authProfile)} --set-endpoint ${profile.endpoint}`,
       0
     )
   }
@@ -255,10 +256,10 @@ function addProfileCommand(): Command {
         workspace: normalizeWorkspaceId(workspace.id, 'the workspace response'),
       })
 
-      console.log(chalk.green(`✓ Added profile "${profileName}" in ${configPath()}`))
+      console.log(chalk.green(`✓ Added profile "${safeOneLine(profileName)}" in ${configPath()}`))
       console.log(`  Workspace: ${safeOneLine(workspace.name)} (${workspace.id})`)
-      console.log(`  Authentication: ${authProfile}`)
-      console.log(chalk.dim(`  Try: sim --profile ${profileName} whoami`))
+      console.log(`  Authentication: ${safeOneLine(authProfile)}`)
+      console.log(chalk.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`))
     })
 }
 
@@ -277,7 +278,7 @@ export function loginCommand(): Command {
 
         if (authProfile !== profile.name) {
           throw new SimApiError(
-            `Profile "${profile.name}" shares authentication with "${authProfile}". Run: sim login --profile ${authProfile}`,
+            `Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Run: sim login --profile ${redact(authProfile)}`,
             0
           )
         }
@@ -304,7 +305,7 @@ export function loginCommand(): Command {
         )
 
         console.log(
-          `Signing in to ${chalk.bold(profile.endpoint)} as profile ${chalk.bold(profile.name)}`
+          `Signing in to ${chalk.bold(profile.endpoint)} as profile ${chalk.bold(safeOneLine(profile.name))}`
         )
         console.log(`\nPairing code: ${chalk.bold(auth.pairing)}`)
         console.log(
@@ -386,35 +387,37 @@ export function logoutCommand(): Command {
         const dependents = listAuthenticationDependents(profileName)
         if (dependents.length > 0) {
           throw new SimApiError(
-            `Cannot remove authentication profile "${profileName}" because it is used by: ${dependents.join(', ')}. Remove those profiles first.`,
+            `Cannot remove authentication profile "${redact(profileName)}" because it is used by: ${dependents.map(redact).join(', ')}. Remove those profiles first.`,
             0
           )
         }
         const removed = deleteProfile(profileName)
         if (!removed.config && !removed.credentials) {
-          console.log(chalk.dim(`Nothing stored for profile "${profileName}".`))
+          console.log(chalk.dim(`Nothing stored for profile "${safeOneLine(profileName)}".`))
           return
         }
-        console.log(chalk.green(`✓ Removed profile "${profileName}".`))
+        console.log(chalk.green(`✓ Removed profile "${safeOneLine(profileName)}".`))
         return
       }
 
       const profile = profileFrom(command)
       const authProfile = resolveAuthenticationProfileName(profile.name)
       if (authProfile !== profile.name) {
         throw new SimApiError(
-          `Profile "${profile.name}" shares authentication with "${authProfile}". Log out of the authentication profile instead: sim logout --profile ${authProfile}`,
+          `Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Log out of the authentication profile instead: sim logout --profile ${redact(authProfile)}`,
           0
         )
       }
 
       if (!readCredentialsProfile(profile.name).api_key) {
-        console.log(chalk.dim(`No stored key for profile "${profile.name}".`))
+        console.log(chalk.dim(`No stored key for profile "${safeOneLine(profile.name)}".`))
         return
       }
 
       writeCredentialsProfile(profile.name, null)
-      console.log(chalk.green(`✓ Removed the stored key for profile "${profile.name}".`))
+      console.log(
+        chalk.green(`✓ Removed the stored key for profile "${safeOneLine(profile.name)}".`)
+      )
       // The key still exists server-side; leaving that unsaid invites the
       // assumption that logging out revoked it.
       console.log(chalk.dim('  The key itself is still active — revoke it in Settings → API keys.'))
@@ -522,7 +525,7 @@ async function verifyProfile(
       status: 'unauthenticated',
       workspace: null,
       keyType: null,
-      detail: `no API key — run: sim login --profile ${profile.name}`,
+      detail: `no API key — run: sim login --profile ${safeOneLine(profile.name)}`,
     }
   }
 
@@ -536,7 +539,7 @@ async function verifyProfile(
       status: 'no-workspace',
       workspace: null,
       keyType,
-      detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`,
+      detail: `no workspace to check against — run: sim configure --profile ${safeOneLine(profile.name)} --set-workspace <id>`,
     }
   }
 
@@ -663,9 +666,9 @@ interface ProfileRow {
 
 const PROFILE_COLUMNS: Column<ProfileRow>[] = [
   { header: '', value: (row) => (row.active ? chalk.green('*') : ' ') },
-  { header: 'profile', value: (row) => text(row.name) },
+  { header: 'profile', value: (row) => safeOneLine(row.name) },
   { header: 'key', value: (row) => (row.error ? text(null) : row.hasKey ? 'yes' : 'no') },
-  { header: 'auth', value: (row) => text(row.authProfile) },
+  { header: 'auth', value: (row) => (row.authProfile ? safeOneLine(row.authProfile) : text(null)) },
   { header: 'error', value: (row) => (row.error ? chalk.red(safeOneLine(row.error)) : text(null)) },
 ]
 
@@ -707,6 +710,12 @@ function profileListingContext(command: Command): { activeName: string; output:
     return { activeName: profile.name, output: profile.output }
   } catch (error) {
     if (!(error instanceof ProfileConfigError)) throw error
+    // A blank `--profile`/`--endpoint`/`--workspace` is the caller's own
+    // argument, not a broken profile. The tolerance below exists so a listing
+    // still happens when the config is unreadable; letting it also absorb a
+    // refused flag turned `sim --workspace "" profiles` into a successful
+    // listing while every other command exits 1 on the same argv.
+    if (error instanceof ProfileOverrideError) throw error
 
     const globals = globalsOf(command)
     const named = globals.profile || process.env.SIM_PROFILE

packages/sim-cli/src/config/profile.test.ts

@@ -10,6 +10,7 @@ import {
   listAuthenticationDependents,
   listProfiles,
   OUTPUT_FORMATS,
+  ProfileOverrideError,
   resolveAuthenticationProfileName,
   resolveProfile,
   validateProfileName,
@@ -525,6 +526,16 @@ describe('blank root flags', () => {
     expect(() => resolveProfile({ profile: '' })).toThrow(/--profile requires a value/)
   })
 
+  /**
+   * `profiles` tolerates a profile that will not resolve, so the refusal has to
+   * be tellable apart from a broken profile by something the wording cannot
+   * break — otherwise a blank flag is absorbed and the listing exits 0.
+   */
+  it('raises the refusal as its own error class', () => {
+    expect(() => resolveProfile({ workspaceId: '' })).toThrow(ProfileOverrideError)
+    expect(() => resolveProfile({ profile: 'unknown' })).not.toThrow(ProfileOverrideError)
+  })
+
   it('still reads an exported-but-empty environment variable as unset', () => {
     // The convention every profile-based CLI follows, and the reason the empty
     // string cannot simply become significant everywhere.
@@ -590,6 +601,32 @@ describe('redaction of rejected values', () => {
     expect(message).not.toMatch(FORBIDDEN_IN_VALUE)
   })
 
+  /**
+   * The header line is split on `\n`, so a stored name cannot carry one — but
+   * U+2028 is a line separator the reader keeps and `sanitize` does not strip,
+   * which is why the same redaction the typed name already got has to cover the
+   * two halves of this message that come out of the config file.
+   */
+  it('redacts the suggestion and the configured list, not just the typed name', () => {
+    writeFileSync(configPath(), '[profile st\u2028aging]\nworkspace = ws_1\n')
+
+    const message = messageOf(() => resolveProfile({ profile: 'st\u2028agng' }))
+    expect(message).toBe(
+      'Unknown profile "st agng". Did you mean "st aging"? Configured profiles: st aging.'
+    )
+    expect(message).not.toMatch(FORBIDDEN_IN_VALUE)
+  })
+
+  it('redacts both names an auth_profile refusal quotes', () => {
+    // ESC rather than U+2028 here: the value reader drops a line separator, so
+    // the setting would never be seen at all.
+    writeFileSync(configPath(), '[profile de\u001bv]\nauth_profile = mis\u001bsing\n')
+
+    const message = messageOf(() => resolveAuthenticationProfileName('de\u001bv'))
+    expect(message).toBe('Profile "de v" references missing auth_profile "mis sing".')
+    expect(message).not.toMatch(FORBIDDEN_IN_VALUE)
+  })
+
   it('redacts the format in the unknown-output-format refusal', () => {
     process.env.SIM_OUTPUT = 'ev\nil'