fix(plaidlogin,cli,config): reject team switch without force in same environment

When a user has full sandbox credentials for TeamA and runs
, the command
now returns PLAID_CREDENTIALS_OVERWRITE_REQUIRED (exit code 10)
instead of letting the OAuth flow complete and then failing with an
opaque CONFIG_WRITE_FAILED.

Changes:
- login.go: add explicit mismatch-team check before write; use
  LoadProviderConfig so only plaid errors surface.
- login.go: set effectiveForce=true when any existing credential is
  present so ConfigureProvider overwrites instead of conflict-error.
- config.go: add LoadProviderConfig to resolve one provider block
  without requiring full config validity.
- cli.go: map PLAID_CREDENTIALS_OVERWRITE_REQUIRED to safety/10.
- errors.go: add ErrorPlaidCredentialsOverwriteRequired constant.
- tests: add TestRunLoginOverwritesRotatedSecretForSameTeamAndEnvironment
  and update existing mismatch-team test to assert the correct code.
- CONTRACTS.md: document the new error code.

This closes the review comment from PR #3 about same-environment
team switches silently ending in CONFIG_WRITE_FAILED.

Author: thedavidweng

docs/CONTRACTS.md

@@ -163,6 +163,7 @@ Shared command error codes include:
 | `DASHBOARD_TOKEN_REFRESH_FAILED` | `auth` | false | 3 | Stored Dashboard refresh token cannot refresh; rerun `money plaid login`. |
 | `DASHBOARD_CONTRACT_CHANGED` | `api` | false | 6 | Plaid Dashboard private response shape no longer matches the known CLI-compatible contract. |
 | `PLAID_DASHBOARD_LOGIN_REJECTED` | `auth` | false | 3 | Plaid rejected the CLI-compatible Dashboard OAuth path. |
+| `PLAID_CREDENTIALS_OVERWRITE_REQUIRED` | `safety` | false | 10 | Existing Plaid API credentials would be replaced and `--force` is required. |
 | `PLAID_ENVIRONMENT_NOT_PROVISIONED` | `validation` | false | 2 | Dashboard returned no secret for the selected Plaid environment. |
 | `READ_ONLY_VIOLATION` | `safety` | false | 4 | The command would mutate local config, env, store, or auth files while read-only mode is enabled. |
 

internal/cli/cli.go

@@ -1405,6 +1405,9 @@ func plaidLoginError(command string, err error) error {
 	case plaidlogin.ErrorTeamSelectionRequired, plaidlogin.ErrorPlaidEnvironmentNotProvisioned, plaidlogin.ErrorInvalidEnum:
 		category = contracts.CategoryValidation
 		exitCode = 2
+	case plaidlogin.ErrorPlaidCredentialsOverwriteRequired:
+		category = contracts.CategorySafety
+		exitCode = 10
 	case plaidlogin.ErrorAPIKeysFetchRequired:
 		category = contracts.CategoryAuth
 		exitCode = 3

internal/config/config.go

@@ -170,6 +170,32 @@ func Load(options Options) (Config, error) {
 	return cfg, nil
 }
 
+// LoadProviderConfig resolves only one provider block without requiring the
+// rest of the config to resolve successfully.
+func LoadProviderConfig(options Options, provider string) (ProviderConfig, error) {
+	meta, raw, err := resolveMetadataAndRaw(options)
+	if err != nil {
+		return ProviderConfig{}, err
+	}
+	mergedEnv, err := mergedEnvironment(options, meta.EnvPath)
+	if err != nil {
+		return ProviderConfig{}, err
+	}
+	fields, ok := raw.Providers[provider]
+	if !ok {
+		return ProviderConfig{Fields: map[string]string{}}, nil
+	}
+	resolved := ProviderConfig{Fields: map[string]string{}}
+	for name, node := range fields {
+		value, _, err := resolveValue("providers."+provider+"."+name, node, mergedEnv, isSecretField(name))
+		if err != nil {
+			return ProviderConfig{}, err
+		}
+		resolved.Fields[name] = value
+	}
+	return resolved, nil
+}
+
 func ResolveMetadata(options Options) (Metadata, error) {
 	meta, _, err := resolveMetadataAndRaw(options)
 	return meta, err

internal/config/metadata_test.go

@@ -151,6 +151,44 @@ providers: {}
 	}
 }
 
+func TestLoadProviderConfigIgnoresUnrelatedProviderEnvErrors(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.yaml")
+	key := base64.RawURLEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+
+	if err := os.WriteFile(configPath, []byte(`
+database:
+  path: ./money.db
+  encryption_key:
+    env: MONEY_DB_ENCRYPTION_KEY
+providers:
+  plaid:
+    client_id:
+      env: PLAID_CLIENT_ID
+    secret:
+      env: PLAID_SECRET
+    environment: sandbox
+  bridge:
+    client_id:
+      env: BRIDGE_CLIENT_ID
+    client_secret:
+      env: BRIDGE_CLIENT_SECRET
+`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, ".env"), []byte("MONEY_DB_ENCRYPTION_KEY="+key+"\nPLAID_CLIENT_ID=client\nPLAID_SECRET=secret\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	provider, err := LoadProviderConfig(Options{ConfigPath: configPath, Env: map[string]string{}}, "plaid")
+	if err != nil {
+		t.Fatalf("LoadProviderConfig: %v", err)
+	}
+	if provider.Fields["client_id"] != "client" || provider.Fields["secret"] != "secret" || provider.Fields["environment"] != "sandbox" {
+		t.Fatalf("provider fields = %#v", provider.Fields)
+	}
+}
+
 func containsAll(value string, needles ...string) bool {
 	for _, needle := range needles {
 		if !strings.Contains(value, needle) {

internal/plaidlogin/errors.go

@@ -3,16 +3,17 @@ package plaidlogin
 import "fmt"
 
 const (
-	ErrorBaseConfigMissing              = "BASE_CONFIG_MISSING"
-	ErrorNotLoggedIn                    = "NOT_LOGGED_IN"
-	ErrorTeamSelectionRequired          = "TEAM_SELECTION_REQUIRED"
-	ErrorAPIKeysFetchRequired           = "API_KEYS_FETCH_REQUIRED"
-	ErrorDashboardTokenRefreshFailed    = "DASHBOARD_TOKEN_REFRESH_FAILED"
-	ErrorDashboardContractChanged       = "DASHBOARD_CONTRACT_CHANGED"
-	ErrorPlaidDashboardLoginRejected    = "PLAID_DASHBOARD_LOGIN_REJECTED"
-	ErrorPlaidEnvironmentNotProvisioned = "PLAID_ENVIRONMENT_NOT_PROVISIONED"
-	ErrorReadOnlyViolation              = "READ_ONLY_VIOLATION"
-	ErrorInvalidEnum                    = "INVALID_ENUM"
+	ErrorBaseConfigMissing                 = "BASE_CONFIG_MISSING"
+	ErrorNotLoggedIn                       = "NOT_LOGGED_IN"
+	ErrorTeamSelectionRequired             = "TEAM_SELECTION_REQUIRED"
+	ErrorAPIKeysFetchRequired              = "API_KEYS_FETCH_REQUIRED"
+	ErrorDashboardTokenRefreshFailed       = "DASHBOARD_TOKEN_REFRESH_FAILED"
+	ErrorDashboardContractChanged          = "DASHBOARD_CONTRACT_CHANGED"
+	ErrorPlaidDashboardLoginRejected       = "PLAID_DASHBOARD_LOGIN_REJECTED"
+	ErrorPlaidCredentialsOverwriteRequired = "PLAID_CREDENTIALS_OVERWRITE_REQUIRED"
+	ErrorPlaidEnvironmentNotProvisioned    = "PLAID_ENVIRONMENT_NOT_PROVISIONED"
+	ErrorReadOnlyViolation                 = "READ_ONLY_VIOLATION"
+	ErrorInvalidEnum                       = "INVALID_ENUM"
 )
 
 type Error struct {

internal/plaidlogin/login.go

@@ -91,7 +91,7 @@ func RunLogin(ctx context.Context, opts LoginOptions) (LoginResult, error) {
 
 	keysWritten := 0
 	credentialAction := "written"
-	loaded, loadErr := config.Load(config.Options{ConfigPath: meta.ConfigPath, Profile: opts.Profile})
+	currentPlaid, loadErr := config.LoadProviderConfig(config.Options{ConfigPath: meta.ConfigPath, Profile: opts.Profile}, "plaid")
 
 	// Determine effective force flag.
 	// When loadErr is a MissingEnvError for plaid fields, credentials are
@@ -109,9 +109,21 @@ func RunLogin(ctx context.Context, opts LoginOptions) (LoginResult, error) {
 		}
 	}
 
-	if loadErr == nil && loaded.Providers["plaid"].Fields["client_id"] != "" && loaded.Providers["plaid"].Fields["client_id"] == keys.ClientID && loaded.Providers["plaid"].Fields["secret"] != "" && loaded.Providers["plaid"].Fields["environment"] == environment && !opts.Force {
+	currentClientID := currentPlaid.Fields["client_id"]
+	currentSecret := currentPlaid.Fields["secret"]
+	currentEnvironment := currentPlaid.Fields["environment"]
+	if !opts.Force && currentClientID != "" && currentSecret != "" && currentClientID != keys.ClientID {
+		return LoginResult{}, Error{
+			Code:    ErrorPlaidCredentialsOverwriteRequired,
+			Message: "Plaid credentials already exist for a different team; rerun with --force to overwrite them",
+		}
+	}
+	if currentClientID != "" && currentSecret != "" && currentClientID == keys.ClientID && currentSecret == secret && currentEnvironment == environment && !opts.Force {
 		credentialAction = "preserved_existing"
 	} else {
+		if currentClientID != "" || currentSecret != "" {
+			effectiveForce = true
+		}
 		configResult, err := config.ConfigureProvider(meta.ConfigPath, opts.Profile, config.PlaidSpec, map[string]string{
 			"client_id": keys.ClientID,
 			"secret":    secret,

internal/plaidlogin/login_test.go

@@ -3,6 +3,7 @@ package plaidlogin
 import (
 	"context"
 	"encoding/base64"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -150,6 +151,45 @@ providers:
 	}
 }
 
+func TestRunLoginOverwritesRotatedSecretForSameTeamAndEnvironment(t *testing.T) {
+	configPath, envPath := writeLoginConfig(t, `
+providers:
+  plaid:
+    client_id:
+      env: PLAID_CLIENT_ID
+    secret:
+      env: PLAID_SECRET
+    environment: sandbox
+`)
+	key := base64.RawURLEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+	if err := os.WriteFile(envPath, []byte("MONEY_DB_ENCRYPTION_KEY="+key+"\nPLAID_CLIENT_ID=existing-client\nPLAID_SECRET=existing-secret\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	server := loginFakeDashboard(t, "existing-client", "rotated-secret")
+	defer server.Close()
+	result, err := RunLogin(context.Background(), LoginOptions{
+		ConfigPath:   configPath,
+		Environment:  "sandbox",
+		CallbackCode: "auth-code",
+		RedirectPort: 49152,
+		CodeVerifier: "verifier",
+		State:        "state",
+		HTTPClient:   server.Client(),
+		TokenURL:     server.URL + "/oauth/token",
+		DashboardURL: server.URL,
+	})
+	if err != nil {
+		t.Fatalf("RunLogin: %v", err)
+	}
+	if result.CredentialAction != "written" || result.KeysWritten != 2 {
+		t.Fatalf("result = %#v", result)
+	}
+	envContent, _ := os.ReadFile(envPath)
+	if !strings.Contains(string(envContent), "PLAID_SECRET=rotated-secret") {
+		t.Fatalf("env was not updated:\n%s", string(envContent))
+	}
+}
+
 func TestRunLoginRejectsMismatchedTeamCredentialsWithoutForce(t *testing.T) {
 	configPath, envPath := writeLoginConfig(t, `
 providers:
@@ -180,7 +220,8 @@ providers:
 	if err == nil {
 		t.Fatal("expected error for mismatched team credentials without --force")
 	}
-	if !strings.Contains(err.Error(), "Plaid credentials could not be written") {
+	var dashErr Error
+	if !errors.As(err, &dashErr) || dashErr.Code != ErrorPlaidCredentialsOverwriteRequired {
 		t.Fatalf("expected credential write error, got %v", err)
 	}
 	envContent, _ := os.ReadFile(envPath)
@@ -189,6 +230,46 @@ providers:
 	}
 }
 
+func TestRunLoginOverwritesMismatchedTeamCredentialsWithForce(t *testing.T) {
+	configPath, envPath := writeLoginConfig(t, `
+providers:
+  plaid:
+    client_id:
+      env: PLAID_CLIENT_ID
+    secret:
+      env: PLAID_SECRET
+    environment: sandbox
+`)
+	key := base64.RawURLEncoding.EncodeToString([]byte("0123456789abcdef0123456789abcdef"))
+	if err := os.WriteFile(envPath, []byte("MONEY_DB_ENCRYPTION_KEY="+key+"\nPLAID_CLIENT_ID=team-a-client\nPLAID_SECRET=team-a-secret\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	server := loginFakeDashboard(t, "team-b-client", "team-b-secret")
+	defer server.Close()
+	result, err := RunLogin(context.Background(), LoginOptions{
+		ConfigPath:   configPath,
+		Environment:  "sandbox",
+		Force:        true,
+		CallbackCode: "auth-code",
+		RedirectPort: 49152,
+		CodeVerifier: "verifier",
+		State:        "state",
+		HTTPClient:   server.Client(),
+		TokenURL:     server.URL + "/oauth/token",
+		DashboardURL: server.URL,
+	})
+	if err != nil {
+		t.Fatalf("RunLogin: %v", err)
+	}
+	if result.CredentialAction != "written" || result.KeysWritten != 2 {
+		t.Fatalf("result = %#v", result)
+	}
+	envContent, _ := os.ReadFile(envPath)
+	if !strings.Contains(string(envContent), "PLAID_CLIENT_ID=team-b-client") || !strings.Contains(string(envContent), "PLAID_SECRET=team-b-secret") {
+		t.Fatalf("env should be overwritten with force:\n%s", string(envContent))
+	}
+}
+
 func TestRunLoginPromptsForMultiTeamSelection(t *testing.T) {
 	configPath, _ := writeLoginConfig(t, "")
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -313,7 +394,7 @@ providers:
 		TokenURL:     server.URL + "/oauth/token",
 		DashboardURL: server.URL,
 	})
-	if !isPlaidLoginCode(err, "CONFIG_WRITE_FAILED") {
+	if !isPlaidLoginCode(err, ErrorPlaidCredentialsOverwriteRequired) {
 		t.Fatalf("err = %#v", err)
 	}
 }