fix(config): warn instead of reporting OK when config set can't persist (1.1.121)

When the active config is in read-only mode — because it was overridden by an
environment variable (e.g. SOCKET_CLI_API_TOKEN / SOCKET_SECURITY_API_TOKEN),
SOCKET_CLI_CONFIG, or --config — `updateConfigValue` applies the change in
memory only and does not write it to disk. `socket config set` nonetheless led
with a reassuring `OK` / "was updated" and tucked the "not persisted" caveat
into an easy-to-miss trailing line. A later `socket config get` then showed
nothing, making it look like the set had silently failed.

outputConfigSet now surfaces the read-only case as a prominent warning (and a
GitHub-style > [\!WARNING] block in markdown output) instead of `OK`, and the
message spells out why the value was not saved and how to make persistence work.
Exit code stays 0 since the in-memory change is still applied for the run.

Add a command-level regression test and bump the CLI to 1.1.121.

Author: mtorp

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.121](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.121) - 2026-06-17
+
+### Fixed
+- `socket config set` no longer reports a misleading `OK` when the value cannot be saved. When the active config is in read-only mode (because it was overridden by an environment variable such as `SOCKET_CLI_API_TOKEN` / `SOCKET_SECURITY_API_TOKEN`, by `SOCKET_CLI_CONFIG`, or by `--config`), the change applies to the current run only. The command now warns clearly that the value was not saved to disk and how to make persistence work, so a subsequent `socket config get` no longer appears to silently lose the value.
+
 ## [1.1.120](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.120) - 2026-06-12
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.120",
+  "version": "1.1.121",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT",

src/commands/config/cmd-config-set.test.mts

@@ -114,4 +114,19 @@ describe('socket config get', async () => {
       expect(code, 'dry-run should exit with code 0 if input ok').toBe(0)
     },
   )
+
+  cmdit(
+    ['config', 'set', 'defaultOrg', 'my-test-org', FLAG_CONFIG, '{}'],
+    'should warn (not report OK) when an override prevents persisting',
+    async cmd => {
+      const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
+      // The --config override marks the config read-only, so the change is
+      // applied in-memory only. The user must be clearly told it was not saved
+      // rather than seeing a reassuring "OK".
+      const combined = `${stdout}\n${stderr}`
+      expect(combined).toContain('NOT saved to disk')
+      expect(stdout).not.toContain('OK')
+      expect(code, 'an in-memory-only change should still exit 0').toBe(0)
+    },
+  )
 })

src/commands/config/output-config-set.mts

@@ -22,20 +22,30 @@ export async function outputConfigSet(
     return
   }
 
+  // A non-empty `data` payload means the change was applied in-memory only and
+  // was NOT persisted to disk (an env var / --config override puts the config
+  // in read-only mode). Surface that prominently instead of a reassuring "OK"
+  // so the user isn't misled into thinking a later `config get` will reflect it.
+  const notPersistedNote = result.data
+
   if (outputKind === 'markdown') {
     logger.log(`# Update config`)
     logger.log('')
     logger.log(result.message)
-    if (result.data) {
+    if (notPersistedNote) {
       logger.log('')
-      logger.log(result.data)
-    }
-  } else {
-    logger.log(`OK`)
-    logger.log(result.message)
-    if (result.data) {
-      logger.log('')
-      logger.log(result.data)
+      logger.log('> [!WARNING]')
+      logger.log(`> ${notPersistedNote}`)
     }
+    return
   }
+
+  if (notPersistedNote) {
+    logger.warn(result.message)
+    logger.warn(notPersistedNote)
+    return
+  }
+
+  logger.log(`OK`)
+  logger.log(result.message)
 }

src/utils/config.mts

@@ -344,7 +344,12 @@ export function updateConfigValue<Key extends keyof LocalConfig>(
     return {
       ok: true,
       message: `Config key '${key}' was ${wasDeleted ? 'deleted' : `updated`}`,
-      data: 'Change applied but not persisted; current config is overridden through env var or flag',
+      data:
+        'Change applied for this run only — NOT saved to disk. The config is ' +
+        'overridden by an environment variable or --config flag (e.g. ' +
+        'SOCKET_CLI_API_TOKEN / SOCKET_SECURITY_API_TOKEN, SOCKET_CLI_CONFIG, ' +
+        'or --config), which puts it in read-only mode. Remove the override to ' +
+        'persist changes.',
     }
   }
 

src/utils/config.test.mts

@@ -30,7 +30,7 @@ describe('utils/config', () => {
         updateConfigValue('defaultOrg', 'fake_test_org'),
       ).toMatchInlineSnapshot(`
         {
-          "data": "Change applied but not persisted; current config is overridden through env var or flag",
+          "data": "Change applied for this run only — NOT saved to disk. The config is overridden by an environment variable or --config flag (e.g. SOCKET_CLI_API_TOKEN / SOCKET_SECURITY_API_TOKEN, SOCKET_CLI_CONFIG, or --config), which puts it in read-only mode. Remove the override to persist changes.",
           "message": "Config key 'defaultOrg' was updated",
           "ok": true,
         }