fix(codex-auth): fail fast on missing active profile

tests/unit/bin/codex-runtime-router.test.ts

@@ -143,6 +143,37 @@ describe('codex-runtime router — non-auth profile resolution', () => {
     expect(code).toBe(-1); // CCS branch: entry must not call process.exit()
   });
 
+  it('fails fast when CCS_CODEX_PROFILE points to a missing registry profile', async () => {
+    writeRegistry({
+      version: '1.0',
+      default: null,
+      profiles: {},
+    });
+    process.env.CCS_CODEX_PROFILE = 'ghost';
+
+    const stderrMessages: string[] = [];
+    const origWrite = process.stderr.write.bind(process.stderr);
+    process.stderr.write = (chunk: string | Uint8Array): boolean => {
+      stderrMessages.push(typeof chunk === 'string' ? chunk : String(chunk));
+      return true;
+    };
+
+    try {
+      require.cache[ccsPath] = { exports: {} } as NodeJS.Module;
+      flushRouterCache();
+      require.cache[ccsPath] = { exports: {} } as NodeJS.Module;
+
+      const { main } = require(routerPath) as { main: (argv: string[]) => Promise<number> };
+      const code = await main(['node', 'codex-runtime', 'chat']);
+
+      expect(code).toBe(1);
+      expect(process.env.CODEX_HOME).toBeUndefined();
+      expect(stderrMessages.join('')).toContain("CCS_CODEX_PROFILE='ghost'");
+    } finally {
+      process.stderr.write = origWrite;
+    }
+  });
+
   it('preserves an explicit CODEX_HOME already in env — does not overwrite', async () => {
     const explicitHome = path.join(tempDir, 'explicit-codex-home');
     fs.mkdirSync(explicitHome, { recursive: true });

tests/unit/codex-auth/resolve-active-profile.test.ts

@@ -78,6 +78,15 @@ describe('resolveActiveProfile', () => {
     expect(stderrMessages.some((m) => m.includes('codex-auth'))).toBe(true);
   });
 
+  it('throws when CCS_CODEX_PROFILE is set and registry YAML is corrupt', () => {
+    fs.mkdirSync(path.dirname(registryPath), { recursive: true });
+    fs.writeFileSync(registryPath, '{ invalid yaml: [[[', { mode: 0o600 });
+
+    expect(() => resolveActiveProfile({ CCS_CODEX_PROFILE: 'work' })).toThrow(
+      /Refusing to fall back to ~\/\.codex/
+    );
+  });
+
   it('returns source=env when CCS_CODEX_PROFILE matches a registry entry', () => {
     const profileDir = makeProfileDir('work');
     writeRegistry({
@@ -132,28 +141,20 @@ describe('resolveActiveProfile', () => {
     expect(result?.source).toBe('env');
   });
 
-  it('returns null and warns when CCS_CODEX_PROFILE names a profile not in registry', () => {
+  it('throws when CCS_CODEX_PROFILE names a profile not in registry', () => {
     writeRegistry({
       version: '1.0',
       default: null,
       profiles: {},
     });
 
-    const stderrMessages: string[] = [];
-    const origWrite = process.stderr.write.bind(process.stderr);
-    const spy = spyOn(process.stderr, 'write').mockImplementation(
-      (msg: string | Uint8Array, ...rest: unknown[]) => {
-        stderrMessages.push(typeof msg === 'string' ? msg : String(msg));
-        return origWrite(msg as string, ...(rest as Parameters<typeof origWrite>).slice(1));
-      }
+    expect(() => resolveActiveProfile({ CCS_CODEX_PROFILE: 'ghost' })).toThrow(
+      /CCS_CODEX_PROFILE='ghost'/
     );
+  });
 
-    const result = resolveActiveProfile({ CCS_CODEX_PROFILE: 'ghost' });
-
-    spy.mockRestore();
-
-    expect(result).toBeNull();
-    expect(stderrMessages.some((m) => m.includes('ghost'))).toBe(true);
+  it('throws when CCS_CODEX_PROFILE is set but registry file is missing', () => {
+    expect(() => resolveActiveProfile({ CCS_CODEX_PROFILE: 'ghost' })).toThrow(/does not exist/);
   });
 
   it('treats empty/whitespace-only CCS_CODEX_PROFILE as unset, falls back to default', () => {