[Hackathon] fix(credentials): a profile header with a trailing comment moves its keys into the profile above, and the next write loses a key #651

Verified against (commit SHA or released version)

commit a18d37c

Discord Username / User ID

neromtoobad

What does this improvement do?

parseCredentials only recognises a section header that is exactly [name]. A hand-edited credentials file with a comment on the header line, such as:

[default]
api_key = sk-user-DEFAULTKEY

[prod]  # production account
api_key = sk-user-PRODKEY

parses as { default: { apiKey: 'sk-user-PRODKEY' } }. The unreadable header line is skipped, but the parser is still inside [default], so prod's key overwrites the default one. As a result:

• auth status and every default-profile command silently authenticate as the prod account.
• --profile prod fails with "No credentials are stored for profile prod" (exit 3).
• The next command that writes the file (for example setup --profile staging …) saves that parsed state. The original default key is lost, and the [prod] section disappears.

Repro at a18d37c: node -e "import('./dist/lib/credentials.js').then(m => console.log(m.parseCredentials('[default]\napi_key = A\n[prod] # c\napi_key = B\n')))" prints { default: { apiKey: 'B' } }. The same happens with a ; comment.

Details / implementation notes

• Root cause: in src/lib/credentials.ts (parseCredentials), the header pattern /^\[([^\]]+)\]$/ is anchored. When a header doesn't match, currentEntry keeps pointing at the previous section.
• Fix (PR ready):
  • Accept an optional trailing #/; comment after a header (/^\[([^\]]+)\]\s*(?:[#;].*)?$/).
  • Make any other line starting with [ reset the current section, so keys under a header the parser can't read never land in another profile.
  • Two unit tests, which fail before the change.
• This is a different root cause from [Hackathon] fix(credentials): setup / auth remove replace a symlinked ~/.testsprite/credentials with a new file and delete every comment and unknown key in it #495 (comment and symlink handling on rewrite).

Confirmations

• I have searched existing issues and this is not a duplicate.
• I have provided my Discord identity above for reward coordination.