Fix security review followups from #161 (#162)

* Fix security review followups from PR #161

- Resolve symlinks on CWD in repoConfigPath and localConfigPaths so
  trust-boundary comparisons are consistent (both sides now resolved)
- Remove redundant duplicate RequireSecureURL check after profile merge
- Fix isConfigCmd docstring placement (was fused with transformCobraError)

* Fail closed when symlink resolution fails in config path discovery

repoConfigPath and localConfigPaths now return empty/nil when
EvalSymlinks(cwd) fails, rather than falling back to the unresolved
path. Prevents trust-boundary bypass under unusual filesystem conditions.

Author: jeremy

internal/cli/root.go

@@ -84,12 +84,6 @@ func NewRootCmd() *cobra.Command {
 					}
 					return fmt.Errorf("base_url (%s): %w\nFix with: basecamp config unset base_url", source, err)
 				}
-				if profileName != "" {
-					// Re-validate: profile may have changed base_url
-					if err := hostutil.RequireSecureURL(cfg.BaseURL); err != nil {
-						return fmt.Errorf("base_url (from profile %q): %w\nFix with: basecamp config unset base_url", profileName, err)
-					}
-				}
 			}
 
 			// Resolve behavior preferences: explicit flag > config > version.IsDev()
@@ -377,8 +371,6 @@ func promptForProfile(cfg *config.Config) (string, error) {
 	return selected.ID, nil
 }
 
-// transformCobraError transforms Cobra's default error messages to match the
-// Bash CLI format for consistency with existing tests and user expectations.
 // isConfigCmd returns true if cmd is "config" or any of its subcommands.
 // Used to skip HTTPS enforcement so users can repair a bad base_url.
 func isConfigCmd(cmd *cobra.Command) bool {
@@ -390,6 +382,8 @@ func isConfigCmd(cmd *cobra.Command) bool {
 	return false
 }
 
+// transformCobraError transforms Cobra's default error messages to match the
+// Bash CLI format for consistency with existing tests and user expectations.
 func transformCobraError(err error) error {
 	msg := err.Error()
 

internal/config/config.go

@@ -410,7 +410,15 @@ func repoConfigPath() string {
 	// Walk up to find .git directory, then look for .basecamp/config.json.
 	// Bounded by $HOME: only search within the home directory tree.
 	// If CWD is outside $HOME (e.g., /tmp), no repo config is trusted.
-	dir, _ := os.Getwd()
+	dir, err := os.Getwd()
+	if err != nil {
+		return "" // fail closed: can't determine CWD
+	}
+	resolved, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return "" // fail closed: can't resolve symlinks for trust boundary
+	}
+	dir = resolved
 	home, _ := os.UserHomeDir()
 	if resolved, err := filepath.EvalSymlinks(home); err == nil {
 		home = resolved
@@ -466,7 +474,15 @@ func isInsideDir(child, parent string) bool {
 //   - Inside a git repo: only paths at or below the repo root
 //   - Outside a git repo: only the current working directory (no parent traversal)
 func localConfigPaths(repoConfigPath string) []string {
-	dir, _ := os.Getwd()
+	dir, err := os.Getwd()
+	if err != nil {
+		return nil // fail closed: can't determine CWD
+	}
+	resolved, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return nil // fail closed: can't resolve symlinks for trust boundary
+	}
+	dir = resolved
 	var paths []string
 
 	// Determine trust boundary (resolve symlinks for reliable comparison