Fix switch and oauth org precedence

[Parker Henderson (parkerhendo)]

Summary

Fixes bt switch and OAuth auth resolution when config.json contains a stale org that disagrees with the selected OAuth profile’s stored org_name.

Problem

A config like this could cause bt to use the correct profile credentials but query the wrong org:

{
  "profile": "BT Staging",
  "org": "braintrustdata.com",
  "project": "Loop"
}

For OAuth profiles, the token is user-scoped, so the stale config org could override the selected profile’s org and cause commands like bt switch to list projects from the wrong workspace.

Repro

Given an OAuth auth profile like:

{
  "profiles": {
    "BT Staging": {
      "auth_kind": "oauth",
      "api_url": "https://staging-api.braintrust.dev",
      "app_url": "https://www.braintrust.dev",
      "org_name": "BT Staging",
      "oauth_client_id": "bt_cli_default"
    }
  }
}

and a global config like:

{
  "profile": "BT Staging",
  "org": "braintrustdata.com",
  "project": "Loop"
}

run:

bt status
bt switch

Before this fix:

• bt status showed profile: BT Staging but org: braintrustdata.com
• bt switch used the BT Staging profile credentials but listed projects from braintrustdata.com
• selecting a project wrote the old/stale org back into config

A second repro path was:

bt switch
# Select org: BT Staging

Before this fix, the project picker could still show projects from the previously configured braintrustdata.com org instead of the selected BT Staging org.

Changes

• For OAuth profiles, auth resolution now prefers:

  1. explicit --org / env org
  2. selected profile’s stored org_name
  3. config org

• Preserves existing API key profile behavior, where config org can still override profile org.

• Updates bt switch project-only auth context to prefer the configured profile over a stale configured org.

• Adds regression tests for:

  • OAuth profile org overriding stale config org
  • API key config-org precedence remaining unchanged
  • bt switch preferring configured profile over stale org

Validation

Ran:

cargo test resolve_auth_config_org_overrides_profile_org -- --nocapture
cargo test resolve_auth_oauth_profile_org_overrides_stale_config_org -- --nocapture
cargo test current_switch_auth_context_prefers_profile_over_stale_org -- --nocapture
cargo test switch::tests -- --nocapture
cargo check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2ff46b156b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[chatgpt-codex-connector]

Replace real org/profile fixtures with synthetic names

The root AGENTS.md Privacy and Test Data section says not to add real organization or profile names/IDs to tests and to use synthetic placeholders instead. This regression test adds an internal-looking profile name and the real braintrustdata.com org, so the committed fixtures should be changed to placeholders like test-profile / test-org while preserving the stale-org scenario.

Useful? React with 👍 / 👎.

[github-actions]

Latest downloadable build artifacts for this PR commit 2ff46b156ba6:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/29389231011
• Download all artifacts (GitHub CLI): gh run download 29389231011 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• artifacts-build-global
• artifacts-build-local-x86_64-apple-darwin
• artifacts-build-local-aarch64-pc-windows-msvc
• artifacts-build-local-x86_64-pc-windows-msvc
• artifacts-build-local-x86_64-unknown-linux-musl
• artifacts-build-local-x86_64-unknown-linux-gnu
• artifacts-build-local-aarch64-apple-darwin
• artifacts-build-local-aarch64-unknown-linux-gnu
• artifacts-plan-dist-manifest
• cargo-dist-cache

[Cedric / ViaDézo1er (viadezo1er)]

❯ bt status
org: ced-test-1
project: aaa
profile: Braintrust SDKs
user: Cédric Halber (cedric@braintrustdata.com)
source: /Users/cedric@braintrustdata.com/.config/bt/config.json
❯ bt switch
✔ Select org · Braintrust SDKs
✔ Select project · Windows bt function push issue
✓ Switched to ced-test-1/Windows bt function push issue
Wrote to /Users/cedric@braintrustdata.com/.config/bt/config.json
❯ bt status
org: ced-test-1
project: Windows bt function push issue
profile: Braintrust SDKs
user: Cédric Halber (cedric@braintrustdata.com)
source: /Users/cedric@braintrustdata.com/.config/bt/config.json

I don't have any env variable related to bt:

❯ env|rg BRA
BRAINTRUST_CODING_API_KEY=sk-...
TRACE_TO_BRAINTRUST=true # used by my pi config
BRAINTRUST_API_KEY_PI_UPLOAD_TRACES=sk-...
BRAINTRUST_PROJECT=cedric-traces # Not BRAINTRUST_DEFAULT_PROJECT, this is a variable my pi config uses

bt switch is still broken, the saved org isn't changed. Also the project lookup gives me the list of projects from the previous org (ced-test-1) not Braintrust SDKs.

[Cedric / ViaDézo1er (viadezo1er)]

See comment above