fix(websearch): harden settings-profile hook setup

- fail enabled settings-profile create and launch flows when hook preparation is still unusable

- refresh stale shared hook binaries without rewriting unchanged installs or failing benign races

- add rollback and regression coverage for disabled, stale, invalid, copy, import, and launch paths

tests/unit/api/profile-lifecycle-service.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, it, mock, spyOn } from 'bun:test';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -9,7 +9,11 @@ import {
   importApiProfileBundle,
   registerApiProfileOrphans,
 } from '../../../src/api/services/profile-lifecycle-service';
-import { runWithScopedConfigDir, setGlobalConfigDir } from '../../../src/utils/config-manager';
+import {
+  loadConfigSafe,
+  runWithScopedConfigDir,
+  setGlobalConfigDir,
+} from '../../../src/utils/config-manager';
 
 describe('profile lifecycle service', () => {
   let tempHome = '';
@@ -37,6 +41,8 @@ describe('profile lifecycle service', () => {
   });
 
   afterEach(() => {
+    mock.restore();
+
     if (originalCcsHome === undefined) {
       delete process.env.CCS_HOME;
     } else {
@@ -122,6 +128,60 @@ describe('profile lifecycle service', () => {
     expect(result.skipped).toEqual([]);
   });
 
+  it('does not register orphan profiles when WebSearch hook setup fails', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'extra.settings.json'),
+      JSON.stringify(
+        { env: { ANTHROPIC_BASE_URL: 'https://api.example.com', ANTHROPIC_AUTH_TOKEN: 'token' } },
+        null,
+        2
+      ) + '\n'
+    );
+    fs.writeFileSync(path.join(ccsDir, 'config.json'), JSON.stringify({ profiles: {} }, null, 2) + '\n');
+
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy failed');
+    });
+
+    const result = await runInScopedCcsDir(() => registerApiProfileOrphans({ names: ['extra'] }));
+    const config = await runInScopedCcsDir(() => loadConfigSafe());
+
+    expect(copyFileSpy).toHaveBeenCalled();
+    expect(result.registered).toEqual([]);
+    expect(result.skipped).toHaveLength(1);
+    expect(result.skipped[0]?.reason).toContain('could not prepare the profile hook');
+    expect(config.profiles.extra).toBeUndefined();
+  });
+
+  it('keeps orphan registration non-fatal when WebSearch is disabled', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+
+    fs.writeFileSync(
+      path.join(ccsDir, 'extra.settings.json'),
+      JSON.stringify(
+        { env: { ANTHROPIC_BASE_URL: 'https://api.example.com', ANTHROPIC_AUTH_TOKEN: 'token' } },
+        null,
+        2
+      ) + '\n'
+    );
+    fs.writeFileSync(path.join(ccsDir, 'config.json'), JSON.stringify({ profiles: {} }, null, 2) + '\n');
+    fs.writeFileSync(path.join(ccsDir, 'config.yaml'), 'version: 12\nwebsearch:\n  enabled: false\n', 'utf8');
+
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy should not run when WebSearch is disabled');
+    });
+
+    const result = await runInScopedCcsDir(() => registerApiProfileOrphans({ names: ['extra'] }));
+
+    expect(copyFileSpy).not.toHaveBeenCalled();
+    expect(result.registered).toEqual(['extra']);
+    expect(result.skipped).toEqual([]);
+  });
+
   it('redacts all sensitive env values during export when includeSecrets=false', async () => {
     const ccsDir = path.join(tempHome, '.ccs');
     fs.mkdirSync(ccsDir, { recursive: true });
@@ -160,6 +220,34 @@ describe('profile lifecycle service', () => {
     expect(result.error).toContain('Invalid source profile name');
   });
 
+  it('rolls back copied settings when WebSearch hook setup fails', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.json'),
+      JSON.stringify({ profiles: { source: '~/.ccs/source.settings.json' } }, null, 2) + '\n'
+    );
+    fs.writeFileSync(
+      path.join(ccsDir, 'source.settings.json'),
+      JSON.stringify(
+        { env: { ANTHROPIC_BASE_URL: 'https://api.example.com', ANTHROPIC_AUTH_TOKEN: 'token' } },
+        null,
+        2
+      ) + '\n'
+    );
+
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy failed');
+    });
+
+    const result = await runInScopedCcsDir(() => copyApiProfile('source', 'copy-dest'));
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('could not prepare the profile hook');
+    expect(copyFileSpy).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(ccsDir, 'copy-dest.settings.json'))).toBe(false);
+  });
+
   it('rejects import bundle with invalid profile target', async () => {
     const result = await runInScopedCcsDir(() =>
       importApiProfileBundle({
@@ -179,6 +267,38 @@ describe('profile lifecycle service', () => {
     expect(result.error).toContain('Invalid bundle profile target');
   });
 
+  it('rolls back imported settings when WebSearch hook setup fails', async () => {
+    const ccsDir = path.join(tempHome, '.ccs');
+    fs.mkdirSync(ccsDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(ccsDir, 'config.json'),
+      JSON.stringify({ profiles: {} }, null, 2) + '\n'
+    );
+
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy failed');
+    });
+
+    const result = await runInScopedCcsDir(() =>
+      importApiProfileBundle({
+        schemaVersion: 1,
+        exportedAt: new Date().toISOString(),
+        profile: { name: 'import-failure', target: 'claude' },
+        settings: {
+          env: {
+            ANTHROPIC_BASE_URL: 'https://api.example.com',
+            ANTHROPIC_AUTH_TOKEN: 'token',
+          },
+        },
+      })
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('could not prepare the profile hook');
+    expect(copyFileSpy).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(ccsDir, 'import-failure.settings.json'))).toBe(false);
+  });
+
   it('clears and warns for all redacted sensitive env keys on import', async () => {
     const ccsDir = path.join(tempHome, '.ccs');
     fs.mkdirSync(ccsDir, { recursive: true });

tests/unit/api/profile-writer-anthropic.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, it, mock, spyOn } from 'bun:test';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -15,6 +15,8 @@ describe('profile-writer Anthropic direct', () => {
   });
 
   afterEach(() => {
+    mock.restore();
+
     if (originalCcsHome === undefined) {
       delete process.env.CCS_HOME;
     } else {
@@ -101,4 +103,48 @@ describe('profile-writer Anthropic direct', () => {
     expect(settings.env.ANTHROPIC_AUTH_TOKEN).toBe('sk-or-testkey');
     expect(settings.env.ANTHROPIC_API_KEY).toBe('');
   });
+
+  it('rolls back the created settings file when WebSearch hook installation fails', () => {
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy failed');
+    });
+
+    const result = createApiProfile(
+      'hook-failure',
+      'https://api.z.ai/api/anthropic',
+      'ghp_testkey123',
+      { default: 'glm-5', opus: 'glm-5', sonnet: 'glm-5', haiku: 'glm-5' }
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('could not prepare the profile hook');
+    expect(copyFileSpy).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(tempHome, '.ccs', 'hook-failure.settings.json'))).toBe(false);
+  });
+
+  it('keeps profile creation non-fatal when WebSearch is disabled', () => {
+    fs.mkdirSync(path.join(tempHome, '.ccs'), { recursive: true });
+    fs.writeFileSync(
+      path.join(tempHome, '.ccs', 'config.yaml'),
+      'version: 12\nwebsearch:\n  enabled: false\n',
+      'utf8'
+    );
+
+    const copyFileSpy = spyOn(fs, 'copyFileSync').mockImplementation(() => {
+      throw new Error('copy should not run when WebSearch is disabled');
+    });
+
+    const result = createApiProfile(
+      'disabled-websearch',
+      'https://api.z.ai/api/anthropic',
+      'ghp_testkey123',
+      { default: 'glm-5', opus: 'glm-5', sonnet: 'glm-5', haiku: 'glm-5' }
+    );
+
+    expect(result.success).toBe(true);
+    expect(copyFileSpy).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(tempHome, '.ccs', 'disabled-websearch.settings.json'))).toBe(
+      true
+    );
+  });
 });