test: isolate shared-state test suites for CI stability

- add dependency injection to export-command, binary-manager,
  codex-plan-compatibility, config-command, and usage-syncer
- override process.exit in api-export test to prevent silent
  termination in Bun's parallel test runner
- harden test-environment bootstrap with process.env isolation
- fix auth middleware to avoid config upgrade during checks

tests/unit/commands/config-command.test.ts

@@ -1,4 +1,6 @@
-import { afterEach, beforeEach, describe, expect, it, mock } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { handleConfigCommand } from '../../../src/commands/config-command';
+import { resolveNamedCommand } from '../../../src/commands/named-command-router';
 
 const startServerCalls: Array<Record<string, unknown>> = [];
 const configAuthCalls: string[][] = [];
@@ -12,6 +14,62 @@ let originalConsoleLog: typeof console.log;
 let originalConsoleError: typeof console.error;
 let originalProcessExit: typeof process.exit;
 
+type ConfigCommandDeps = NonNullable<Parameters<typeof handleConfigCommand>[1]>;
+
+function createTestDeps(): ConfigCommandDeps {
+  return {
+    getPort: async () => 3000,
+    openBrowser: async () => undefined,
+    startServer: async (options) => {
+      startServerCalls.push({ ...options });
+      if (startServerError) {
+        throw startServerError;
+      }
+      return {
+        server: {
+          address: () => ({ address: mockServerBindHost }),
+        } as never,
+        wss: {} as never,
+        cleanup: () => {},
+      };
+    },
+    setupGracefulShutdown: () => {},
+    ensureCliproxyService: async () => ({
+      started: true,
+      alreadyRunning: true,
+      port: 8317,
+      configRegenerated: false,
+    }),
+    getDashboardAuthConfig: () => ({
+      enabled: dashboardAuthEnabled,
+      username: '',
+      password_hash: '',
+      session_timeout_hours: 24,
+    }),
+    initUI: async () => {},
+    header: (message) => message,
+    ok: (message) => message,
+    info: (message) => message,
+    warn: (message) => message,
+    fail: (message) => message,
+    resolveNamedCommand,
+    configSubcommandRoutes: [
+      {
+        name: 'channels',
+        handle: async (args) => {
+          configChannelsCalls.push([...args]);
+        },
+      },
+      {
+        name: 'auth',
+        handle: async (args) => {
+          configAuthCalls.push([...args]);
+        },
+      },
+    ],
+  };
+}
+
 beforeEach(() => {
   startServerCalls.length = 0;
   configAuthCalls.length = 0;
@@ -32,138 +90,55 @@ beforeEach(() => {
   console.error = (...args: unknown[]) => {
     errorLines.push(args.map(String).join(' '));
   };
-
-  mock.module('get-port', () => ({
-    default: async () => 3000,
-  }));
-
-  mock.module('open', () => ({
-    default: async () => undefined,
-  }));
-
-  mock.module('../../../src/web-server', () => ({
-    startServer: async (options: Record<string, unknown>) => {
-      startServerCalls.push({ ...options });
-      if (startServerError) {
-        throw startServerError;
-      }
-      return {
-        server: {
-          address: () => ({ address: mockServerBindHost }),
-        } as never,
-        wss: {} as never,
-        cleanup: () => {},
-      };
-    },
-  }));
-
-  mock.module('../../../src/web-server/shutdown', () => ({
-    setupGracefulShutdown: () => {},
-  }));
-
-  mock.module('../../../src/cliproxy/service-manager', () => ({
-    ensureCliproxyService: async () => ({
-      started: true,
-      alreadyRunning: true,
-      port: 8317,
-      configRegenerated: false,
-    }),
-  }));
-
-  mock.module('../../../src/cliproxy/config-generator', () => ({
-    CLIPROXY_DEFAULT_PORT: 8317,
-  }));
-
-  mock.module('../../../src/config/unified-config-loader', () => ({
-    getDashboardAuthConfig: () => ({
-      enabled: dashboardAuthEnabled,
-    }),
-  }));
-
-  const uiModule = {
-    initUI: async () => {},
-    header: (message: string) => message,
-    ok: (message: string) => message,
-    info: (message: string) => message,
-    warn: (message: string) => message,
-    fail: (message: string) => message,
-  };
-  mock.module('../../../src/utils/ui', () => uiModule);
-  mock.module('../../../src/utils/ui.ts', () => uiModule);
-
-  mock.module('../../../src/commands/config-auth', () => ({
-    handleConfigAuthCommand: async (args: string[]) => {
-      configAuthCalls.push([...args]);
-    },
-  }));
-  mock.module('../../../src/commands/config-channels-command', () => ({
-    handleConfigChannelsCommand: async (args: string[]) => {
-      configChannelsCalls.push([...args]);
-    },
-  }));
 });
 
 afterEach(() => {
   console.log = originalConsoleLog;
   console.error = originalConsoleError;
   process.exit = originalProcessExit;
-  mock.restore();
 });
 
-async function loadHandleConfigCommand() {
-  const mod = await import(
-    `../../../src/commands/config-command?test=${Date.now()}-${Math.random()}`
-  );
-  return mod.handleConfigCommand;
-}
-
 describe('config command dashboard startup', () => {
   it('shows help for literal help token instead of starting the dashboard', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
     process.exit = ((code?: number) => {
       throw new Error(`process.exit(${code ?? 0})`);
     }) as typeof process.exit;
 
-    await expect(handleConfigCommand(['help'])).rejects.toThrow('process.exit(0)');
+    await expect(handleConfigCommand(['help'], createTestDeps())).rejects.toThrow('process.exit(0)');
 
     expect(startServerCalls).toHaveLength(0);
     expect(logLines.join('\n')).toContain('Usage: ccs config [command] [options]');
   });
 
   it('routes auth subcommands before dashboard startup', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
-
-    await handleConfigCommand(['auth', 'setup']);
+    await handleConfigCommand(['auth', 'setup'], createTestDeps());
 
     expect(configAuthCalls).toEqual([['setup']]);
     expect(startServerCalls).toHaveLength(0);
   });
 
   it('routes channels subcommands before dashboard startup', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
-
-    await handleConfigCommand(['channels', '--enable']);
+    await handleConfigCommand(['channels', '--enable'], createTestDeps());
 
     expect(configChannelsCalls).toEqual([['--enable']]);
     expect(startServerCalls).toHaveLength(0);
   });
 
   it('rejects unknown config subcommands before dashboard startup', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
     process.exit = ((code?: number) => {
       throw new Error(`process.exit(${code ?? 0})`);
     }) as typeof process.exit;
 
-    await expect(handleConfigCommand(['bogus'])).rejects.toThrow('process.exit(1)');
+    await expect(handleConfigCommand(['bogus'], createTestDeps())).rejects.toThrow(
+      'process.exit(1)'
+    );
 
     expect(startServerCalls).toHaveLength(0);
     expect(errorLines.join('\n')).toContain('Unexpected arguments: bogus');
   });
 
   it('keeps the default startup path free of an explicit host override', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
-
-    await handleConfigCommand([]);
+    await handleConfigCommand([], createTestDeps());
 
     expect(startServerCalls).toHaveLength(1);
     expect(startServerCalls[0]).toEqual({ port: 3000, dev: false });
@@ -179,10 +154,9 @@ describe('config command dashboard startup', () => {
   });
 
   it('passes explicit wildcard hosts through and prints exposure guidance', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
     mockServerBindHost = '0.0.0.0';
 
-    await handleConfigCommand(['--host', '0.0.0.0', '--port', '4100']);
+    await handleConfigCommand(['--host', '0.0.0.0', '--port', '4100'], createTestDeps());
 
     expect(startServerCalls).toHaveLength(1);
     expect(startServerCalls[0]).toEqual({ port: 4100, dev: false, host: '0.0.0.0' });
@@ -198,7 +172,6 @@ describe('config command dashboard startup', () => {
   });
 
   it('fails cleanly when the server cannot bind the requested host', async () => {
-    const handleConfigCommand = await loadHandleConfigCommand();
     startServerError = new Error(
       'Unable to bind 192.0.2.123:4100; the address may be unavailable or the port may already be in use'
     );
@@ -206,9 +179,9 @@ describe('config command dashboard startup', () => {
       throw new Error(`process.exit(${code ?? 0})`);
     }) as typeof process.exit;
 
-    await expect(handleConfigCommand(['--host', '192.0.2.123', '--port', '4100'])).rejects.toThrow(
-      'process.exit(1)'
-    );
+    await expect(
+      handleConfigCommand(['--host', '192.0.2.123', '--port', '4100'], createTestDeps())
+    ).rejects.toThrow('process.exit(1)');
 
     expect(errorLines.join('\n')).toContain(
       'Failed to start server: Unable to bind 192.0.2.123:4100; the address may be unavailable or the port may already be in use'