fix(cliproxy): prevent management key leak on runtime proxy overrides (#1386)

* fix(cliproxy): clear yaml management key on runtime overrides

* style: apply prettier formatting

src/cliproxy/proxy/__tests__/proxy-config-resolver.test.js

@@ -294,6 +294,33 @@ describe('proxy-config-resolver', () => {
         expect(config.managementKey).toBe('remote-management-key');
       });
 
+      it('should clear YAML management key when CLI overrides remote host', () => {
+        const { config } = resolveProxyConfig(['--proxy-host', 'cli-host.example.com'], {
+          remote: {
+            host: 'yaml-host.example.com',
+            auth_token: 'remote-auth-token',
+            management_key: 'remote-management-key',
+          },
+        });
+        expect(config.mode).toBe('remote');
+        expect(config.host).toBe('cli-host.example.com');
+        expect(config.managementKey).toBeUndefined();
+      });
+
+      it('should clear YAML management key when ENV overrides auth token', () => {
+        process.env.CCS_PROXY_AUTH_TOKEN = 'env-auth-token';
+        const { config } = resolveProxyConfig([], {
+          remote: {
+            host: 'yaml-host.example.com',
+            auth_token: 'remote-auth-token',
+            management_key: 'remote-management-key',
+          },
+        });
+        expect(config.mode).toBe('remote');
+        expect(config.authToken).toBe('env-auth-token');
+        expect(config.managementKey).toBeUndefined();
+      });
+
       it('should allow CLI --proxy-host to override YAML enabled:false', () => {
         const { config } = resolveProxyConfig(['--proxy-host', 'cli-host'], {
           remote: { enabled: false, host: 'yaml-host' },

src/cliproxy/proxy/proxy-config-resolver.ts

@@ -291,7 +291,19 @@ export function resolveProxyConfig(
 
   // Merge auth token: CLI > ENV > config.yaml
   resolved.authToken = cliFlags.authToken ?? envConfig.authToken ?? yamlConfig.remote?.auth_token;
-  resolved.managementKey = yamlConfig.remote?.management_key;
+
+  // Keep YAML management key only when remote target/auth are not overridden via CLI/ENV.
+  // Prevents leaking a saved management key to a different runtime target.
+  const hasRuntimeRemoteOverride =
+    cliFlags.host !== undefined ||
+    envConfig.host !== undefined ||
+    cliFlags.port !== undefined ||
+    envConfig.port !== undefined ||
+    cliFlags.protocol !== undefined ||
+    envConfig.protocol !== undefined ||
+    cliFlags.authToken !== undefined ||
+    envConfig.authToken !== undefined;
+  resolved.managementKey = hasRuntimeRemoteOverride ? undefined : yamlConfig.remote?.management_key;
 
   // Merge timeout: CLI > ENV > config.yaml > default (2000ms in executor)
   resolved.timeout = cliFlags.timeout ?? envConfig.timeout ?? yamlConfig.remote?.timeout;