feat(FN-2225): merge fusion/fn-2225

packages/cli/src/commands/daemon.ts

@@ -125,6 +125,11 @@ function maskToken(token: string): string {
   return `${token.slice(0, 6)}...${token.slice(-4)}`;
 }
 
+function isValidDaemonToken(token: string): boolean {
+  // Accept generated tokens (fn_<32 hex>) and user-provided prefixed variants.
+  return /^fn_[A-Za-z0-9_-]{8,}$/.test(token);
+}
+
 export interface DaemonOptions {
   /** Port to listen on (default: 0 for random port) */
   port?: number;
@@ -178,9 +183,10 @@ export async function runDaemon(opts: DaemonOptions = {}) {
     const settingsStore = new GlobalSettingsStore(globalDir);
     const tokenManager = new DaemonTokenManager(settingsStore);
 
-    // Check for token in environment (fallback)
+    // Check for token in environment (fallback). Ignore legacy/invalid values
+    // so daemon auth always uses the expected fn_* token format.
     const envToken = process.env.FUSION_DAEMON_TOKEN;
-    if (envToken) {
+    if (envToken && isValidDaemonToken(envToken)) {
       daemonToken = envToken;
     } else {
       // Get or create token

packages/cli/vitest.config.ts

@@ -8,11 +8,12 @@ process.env.VITEST_MAX_WORKERS = String(maxWorkers);
 
 export default defineConfig({
   resolve: {
-    alias: {
-      "@fusion/core": resolve(__dirname, "../core/src/index.ts"),
-      "@fusion/core/gh-cli": resolve(__dirname, "../core/src/gh-cli.ts"),
-      "@fusion/test-utils": resolve(__dirname, "../core/src/__test-utils__/workspace.ts"),
-    },
+    // Use ordered aliases so the subpath match is resolved before @fusion/core.
+    alias: [
+      { find: "@fusion/core/gh-cli", replacement: resolve(__dirname, "../core/src/gh-cli.ts") },
+      { find: "@fusion/core", replacement: resolve(__dirname, "../core/src/index.ts") },
+      { find: "@fusion/test-utils", replacement: resolve(__dirname, "../core/src/__test-utils__/workspace.ts") },
+    ],
   },
   test: {
     include: ["src/**/*.test.ts"],