From ea1d5a30dbebd4fa59e1d443aa138230c1b0a448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=B6=85=E9=A2=84=E6=9C=9F?=
 <chaoyuqi@chaoyuqideMac-mini.local>
Date: Wed, 11 Mar 2026 01:05:33 +0100
Subject: [PATCH] fix: use effectivePreferredProfile for lockedProfileId
 derivation

Addresses Greptile review feedback: lockedProfileId now derives from
effectivePreferredProfile instead of raw preferredProfileId, ensuring
per-agent auth bindings take priority over session-level overrides.

Added integration test for per-agent binding vs user-locked profile
scenario.
---
 src/agents/auth-profiles/order.test.ts | 35 ++++++++++++++++++++++++++
 src/agents/pi-embedded-runner/run.ts   |  3 ++-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/src/agents/auth-profiles/order.test.ts b/src/agents/auth-profiles/order.test.ts
index 3ba355a122b..d4bcd660162 100644
--- a/src/agents/auth-profiles/order.test.ts
+++ b/src/agents/auth-profiles/order.test.ts
@@ -72,6 +72,41 @@ describe("resolveAuthProfileOrder", () => {
 
     expect(order).toEqual(["openai:account1"]);
   });
+
+  it("per-agent binding overrides session-level profile via effectivePreferredProfile", () => {
+    // Simulates the integration scenario where a per-agent binding (account2)
+    // should take priority over a session-level preferred profile (account1).
+    const store: AuthProfileStore = {
+      version: 1,
+      profiles: {
+        "openai:account1": {
+          type: "api_key",
+          provider: "openai",
+          key: "sk-1",
+        },
+        "openai:account2": {
+          type: "api_key",
+          provider: "openai",
+          key: "sk-2",
+        },
+      },
+    };
+
+    // Session requests account1, but per-agent config binds to account2.
+    const sessionPreferred = "openai:account1";
+    const agentAuthBinding = "openai:account2";
+    const effectivePreferred = agentAuthBinding || sessionPreferred;
+
+    const order = resolveAuthProfileOrder({
+      store,
+      provider: "openai",
+      preferredProfile: effectivePreferred,
+    });
+
+    // Per-agent binding (account2) must come first, not the session override (account1)
+    expect(order[0]).toBe("openai:account2");
+    expect(order).toContain("openai:account1");
+  });
 });
 
 describe("AgentEntrySchema auth field", () => {
diff --git a/src/agents/pi-embedded-runner/run.ts b/src/agents/pi-embedded-runner/run.ts
index 3254ed434c6..fc508f1986f 100644
--- a/src/agents/pi-embedded-runner/run.ts
+++ b/src/agents/pi-embedded-runner/run.ts
@@ -420,7 +420,8 @@ export async function runEmbeddedPiAgent(
       )?.auth?.[normalizedProvider];
       const effectivePreferredProfile = agentAuthBinding?.trim() || preferredProfileId;
 
-      let lockedProfileId = params.authProfileIdSource === "user" ? preferredProfileId : undefined;
+      let lockedProfileId =
+        params.authProfileIdSource === "user" ? effectivePreferredProfile : undefined;
       if (lockedProfileId) {
         const lockedProfile = authStore.profiles[lockedProfileId];
         if (