fix(auth): close shared-context isolation edge cases

tests/unit/account-context.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from 'bun:test';
 import {
   MAX_CONTEXT_GROUP_LENGTH,
   isValidAccountProfileName,
+  policyToAccountContextMetadata,
   resolveAccountContextPolicy,
   resolveCreateAccountContext,
 } from '../../src/auth/account-context';
@@ -28,4 +29,15 @@ describe('account context helpers', () => {
     expect(resolved.mode).toBe('shared');
     expect(resolved.group).toBe('default');
   });
+
+  it('round-trips shared policy metadata with normalized context group', () => {
+    const metadata = policyToAccountContextMetadata({
+      mode: 'shared',
+      group: 'Sprint-A',
+    });
+
+    const resolved = resolveAccountContextPolicy(metadata);
+    expect(resolved.mode).toBe('shared');
+    expect(resolved.group).toBe('sprint-a');
+  });
 });

tests/unit/auth-list-context.test.ts

@@ -85,4 +85,78 @@ describe('auth list context metadata', () => {
     expect(work?.context_mode).toBe('shared');
     expect(work?.context_group).toBe('sprint-a');
   });
+
+  it('prefers unified context metadata over legacy when profile names overlap', async () => {
+    const ccsDir = path.join(tempRoot, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'profiles.json'),
+      JSON.stringify(
+        {
+          version: '2.0.0',
+          profiles: {
+            work: {
+              type: 'account',
+              created: '2026-01-01T00:00:00.000Z',
+              last_used: null,
+              context_mode: 'isolated',
+            },
+          },
+          default: null,
+        },
+        null,
+        2
+      )
+    );
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.yaml'),
+      [
+        'version: 8',
+        'accounts:',
+        '  work:',
+        '    created: "2026-02-01T00:00:00.000Z"',
+        '    last_used: null',
+        '    context_mode: shared',
+        '    context_group: sprint-a',
+        'profiles: {}',
+        'cliproxy:',
+        '  oauth_accounts: {}',
+        '  providers: {}',
+        '  variants: {}',
+      ].join('\n'),
+      'utf8'
+    );
+
+    const registry = new ProfileRegistry();
+    const instanceMgr = new InstanceManager();
+    const lines: string[] = [];
+    const originalLog = console.log;
+    console.log = (...args: unknown[]) => {
+      lines.push(args.map(String).join(' '));
+    };
+
+    try {
+      await handleList(
+        {
+          registry,
+          instanceMgr,
+          version: 'test',
+        },
+        ['--json']
+      );
+    } finally {
+      console.log = originalLog;
+    }
+
+    const payload = JSON.parse(lines.join('\n')) as {
+      profiles: Array<{ name: string; context_mode?: string; context_group?: string | null }>;
+    };
+    const work = payload.profiles.find((profile) => profile.name === 'work');
+
+    expect(work).toBeTruthy();
+    expect(work?.context_mode).toBe('shared');
+    expect(work?.context_group).toBe('sprint-a');
+  });
 });

tests/unit/config/migration-manager.test.ts

@@ -169,4 +169,46 @@ describe('migration-manager legacy kimi compatibility', () => {
     expect(unified?.accounts.personal.context_mode).toBe('isolated');
     expect(unified?.accounts.personal.context_group).toBeUndefined();
   });
+
+  it('normalizes valid legacy shared groups and drops invalid ones during migration', async () => {
+    fs.writeFileSync(
+      path.join(ccsDir, 'profiles.json'),
+      JSON.stringify(
+        {
+          default: 'work',
+          profiles: {
+            work: {
+              type: 'account',
+              created: '2026-02-01T00:00:00.000Z',
+              last_used: null,
+              context_mode: 'shared',
+              context_group: 'Sprint-A',
+            },
+            broken: {
+              type: 'account',
+              created: '2026-02-02T00:00:00.000Z',
+              last_used: null,
+              context_mode: 'shared',
+              context_group: '###',
+            },
+          },
+        },
+        null,
+        2
+      )
+    );
+
+    const result = await migrate(false);
+    expect(result.success).toBe(true);
+    expect(
+      result.warnings.some((warning) =>
+        warning.includes('Skipped invalid context group for account "broken"')
+      )
+    ).toBe(true);
+
+    const unified = loadUnifiedConfig();
+    expect(unified?.accounts.work.context_group).toBe('sprint-a');
+    expect(unified?.accounts.broken.context_mode).toBe('shared');
+    expect(unified?.accounts.broken.context_group).toBeUndefined();
+  });
 });

tests/unit/web-server/account-routes-context.test.ts

@@ -0,0 +1,133 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
+import express from 'express';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import type { Server } from 'http';
+import accountRoutes from '../../../src/web-server/routes/account-routes';
+
+async function getJson<T>(baseUrl: string, routePath: string): Promise<T> {
+  const response = await fetch(`${baseUrl}${routePath}`);
+  expect(response.status).toBe(200);
+  return (await response.json()) as T;
+}
+
+describe('web-server account-routes context normalization', () => {
+  let server: Server;
+  let baseUrl = '';
+  let tempHome = '';
+  let originalCcsHome: string | undefined;
+  let originalCcsUnified: string | undefined;
+
+  beforeAll(async () => {
+    const app = express();
+    app.use('/api/accounts', accountRoutes);
+
+    await new Promise<void>((resolve, reject) => {
+      server = app.listen(0, '127.0.0.1');
+      const handleError = (error: Error) => reject(error);
+      server.once('error', handleError);
+      server.once('listening', () => {
+        server.off('error', handleError);
+        resolve();
+      });
+    });
+
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+      throw new Error('Unable to resolve test server port');
+    }
+    baseUrl = `http://127.0.0.1:${address.port}`;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  beforeEach(() => {
+    tempHome = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-account-routes-context-'));
+    originalCcsHome = process.env.CCS_HOME;
+    originalCcsUnified = process.env.CCS_UNIFIED_CONFIG;
+
+    process.env.CCS_HOME = tempHome;
+    process.env.CCS_UNIFIED_CONFIG = '1';
+  });
+
+  afterEach(() => {
+    if (originalCcsHome !== undefined) process.env.CCS_HOME = originalCcsHome;
+    else delete process.env.CCS_HOME;
+
+    if (originalCcsUnified !== undefined) process.env.CCS_UNIFIED_CONFIG = originalCcsUnified;
+    else delete process.env.CCS_UNIFIED_CONFIG;
+
+    if (tempHome && fs.existsSync(tempHome)) {
+      fs.rmSync(tempHome, { recursive: true, force: true });
+    }
+  });
+
+  it('normalizes invalid persisted account context metadata in API response', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.yaml'),
+      [
+        'version: 8',
+        'accounts:',
+        '  work:',
+        '    created: "2026-02-01T00:00:00.000Z"',
+        '    last_used: null',
+        '    context_mode: weird',
+        '    context_group: "###"',
+        'profiles: {}',
+        'cliproxy:',
+        '  oauth_accounts: {}',
+        '  providers: {}',
+        '  variants: {}',
+      ].join('\n'),
+      'utf8'
+    );
+
+    const payload = await getJson<{
+      accounts: Array<{ name: string; context_mode?: string; context_group?: string }>;
+    }>(baseUrl, '/api/accounts');
+
+    const work = payload.accounts.find((account) => account.name === 'work');
+    expect(work).toBeTruthy();
+    expect(work?.context_mode).toBe('isolated');
+    expect(work && 'context_group' in work).toBe(false);
+  });
+
+  it('falls back shared accounts with invalid groups to default shared group', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.yaml'),
+      [
+        'version: 8',
+        'accounts:',
+        '  work:',
+        '    created: "2026-02-01T00:00:00.000Z"',
+        '    last_used: null',
+        '    context_mode: shared',
+        '    context_group: "###"',
+        'profiles: {}',
+        'cliproxy:',
+        '  oauth_accounts: {}',
+        '  providers: {}',
+        '  variants: {}',
+      ].join('\n'),
+      'utf8'
+    );
+
+    const payload = await getJson<{
+      accounts: Array<{ name: string; context_mode?: string; context_group?: string }>;
+    }>(baseUrl, '/api/accounts');
+
+    const work = payload.accounts.find((account) => account.name === 'work');
+    expect(work).toBeTruthy();
+    expect(work?.context_mode).toBe('shared');
+    expect(work?.context_group).toBe('default');
+  });
+});

tests/unit/web-server/config-routes-account-context.test.ts

@@ -0,0 +1,141 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
+import express from 'express';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import type { Server } from 'http';
+import configRoutes from '../../../src/web-server/routes/config-routes';
+import { createEmptyUnifiedConfig } from '../../../src/config/unified-config-types';
+
+async function putJson(baseUrl: string, routePath: string, body: unknown): Promise<Response> {
+  return fetch(`${baseUrl}${routePath}`, {
+    method: 'PUT',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+describe('web-server config-routes account context validation', () => {
+  let server: Server;
+  let baseUrl = '';
+  let tempHome = '';
+  let originalCcsHome: string | undefined;
+
+  beforeAll(async () => {
+    const app = express();
+    app.use(express.json());
+    app.use('/api/config', configRoutes);
+
+    await new Promise<void>((resolve, reject) => {
+      server = app.listen(0, '127.0.0.1');
+      const handleError = (error: Error) => reject(error);
+      server.once('error', handleError);
+      server.once('listening', () => {
+        server.off('error', handleError);
+        resolve();
+      });
+    });
+
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+      throw new Error('Unable to resolve test server port');
+    }
+    baseUrl = `http://127.0.0.1:${address.port}`;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  beforeEach(() => {
+    tempHome = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-config-routes-context-'));
+    originalCcsHome = process.env.CCS_HOME;
+    process.env.CCS_HOME = tempHome;
+    fs.mkdirSync(path.join(tempHome, '.ccs'), { recursive: true });
+  });
+
+  afterEach(() => {
+    if (originalCcsHome !== undefined) process.env.CCS_HOME = originalCcsHome;
+    else delete process.env.CCS_HOME;
+
+    if (tempHome && fs.existsSync(tempHome)) {
+      fs.rmSync(tempHome, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects invalid account context_mode values', async () => {
+    const response = await putJson(baseUrl, '/api/config', {
+      version: 8,
+      accounts: {
+        work: {
+          created: '2026-01-01T00:00:00.000Z',
+          last_used: null,
+          context_mode: 'weird',
+        },
+      },
+      profiles: {},
+      cliproxy: { oauth_accounts: {}, providers: [], variants: {} },
+    });
+
+    expect(response.status).toBe(400);
+    const payload = (await response.json()) as { error: string };
+    expect(payload.error).toContain('context_mode');
+  });
+
+  it('rejects context_group when mode is not shared', async () => {
+    const response = await putJson(baseUrl, '/api/config', {
+      version: 8,
+      accounts: {
+        work: {
+          created: '2026-01-01T00:00:00.000Z',
+          last_used: null,
+          context_mode: 'isolated',
+          context_group: 'sprint-a',
+        },
+      },
+      profiles: {},
+      cliproxy: { oauth_accounts: {}, providers: [], variants: {} },
+    });
+
+    expect(response.status).toBe(400);
+    const payload = (await response.json()) as { error: string };
+    expect(payload.error).toContain('context_group requires context_mode=shared');
+  });
+
+  it('rejects invalid shared context_group names', async () => {
+    const response = await putJson(baseUrl, '/api/config', {
+      version: 8,
+      accounts: {
+        work: {
+          created: '2026-01-01T00:00:00.000Z',
+          last_used: null,
+          context_mode: 'shared',
+          context_group: '###',
+        },
+      },
+      profiles: {},
+      cliproxy: { oauth_accounts: {}, providers: [], variants: {} },
+    });
+
+    expect(response.status).toBe(400);
+    const payload = (await response.json()) as { error: string };
+    expect(payload.error).toContain('context_group');
+  });
+
+  it('accepts valid shared context metadata', async () => {
+    const config = createEmptyUnifiedConfig();
+    config.accounts.work = {
+      created: '2026-01-01T00:00:00.000Z',
+      last_used: null,
+      context_mode: 'shared',
+      context_group: 'Sprint-A',
+    };
+    const response = await putJson(baseUrl, '/api/config', config);
+
+    expect(response.status).toBe(200);
+    const payload = (await response.json()) as { success: boolean };
+    expect(payload.success).toBe(true);
+  });
+});