fix(config): mention the config-file fallback in project-id guidance, dedupe dangerous-key checks, prettier pass

Author: Andy00L

src/commands/test.ts

@@ -9176,10 +9176,14 @@ export function createTestCommand(deps: TestDeps = {}): Command {
 
       if (isAll) {
         // --all path: wave-ordered fresh batch run.
-        const projectId = resolveProjectId(cmdOpts.project, deps, resolveCommonOptions(command).profile);
+        const projectId = resolveProjectId(
+          cmdOpts.project,
+          deps,
+          resolveCommonOptions(command).profile,
+        );
         requireProjectId(
           projectId,
-          '--all requires a project id - pass --project <id> or set TESTSPRITE_PROJECT_ID',
+          '--all requires a project id - pass --project <id>, set TESTSPRITE_PROJECT_ID, or set project_id in ~/.testsprite/config (or TESTSPRITE_CONFIG_FILE)',
         );
         // --target-url has no effect on the --all batch path: a BE test's base
         // URL is baked into its code, and the unified engine resolves each
@@ -9826,7 +9830,7 @@ function resolveProjectId(
 }
 function requireProjectId(
   projectId: string | undefined,
-  message = 'is required; pass --project <id>, set TESTSPRITE_PROJECT_ID, or set project_id in ~/.testsprite/config',
+  message = 'is required; pass --project <id>, set TESTSPRITE_PROJECT_ID, or set project_id in the config file (~/.testsprite/config or TESTSPRITE_CONFIG_FILE)',
 ): asserts projectId is string {
   if (typeof projectId !== 'string' || projectId.length === 0) {
     throw localValidationError('project', message);

src/lib/credentials.ts

@@ -100,6 +100,8 @@ const CREDENTIALS_LOCK_RETRY_MS = 25;
 const CREDENTIALS_LOCK_WAIT_MS = 5_000;
 const CREDENTIALS_LOCK_STALE_MS = 30_000;
 
+const DANGEROUS_INI_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 /**
  * Generic hardened INI walk shared by the credentials file and the settings
  * config file (`~/.testsprite/config`). Returns every `[section]`'s raw
@@ -120,11 +122,7 @@ export function parseIniFile(content: string): Record<string, Record<string, str
       const sectionName = sectionMatch[1]!.trim();
       // Defense in depth alongside the null-prototype accumulator: never treat a
       // prototype-polluting key as a profile section. Skip its key=value lines.
-      if (
-        sectionName === '__proto__' ||
-        sectionName === 'constructor' ||
-        sectionName === 'prototype'
-      ) {
+      if (DANGEROUS_INI_KEYS.has(sectionName)) {
         currentEntry = null;
         continue;
       }
@@ -145,7 +143,7 @@ export function parseIniFile(content: string): Record<string, Record<string, str
     const rawValue = line.slice(eqIndex + 1).trim();
     // Same guard for keys: `__proto__ = x` must never become a property write
     // on a shared prototype when a caller copies the section into a plain map.
-    if (rawKey === '__proto__' || rawKey === 'constructor' || rawKey === 'prototype') continue;
+    if (DANGEROUS_INI_KEYS.has(rawKey)) continue;
     currentEntry[rawKey] = rawValue;
   }
   // Return plain objects so callers (and test matchers) see normal prototypes.