fix(cli-core): invalidate token cache on auth change, remove redundant mkdirSync

setCliUserConfig now calls clearCliTokenCache() so that subsequent
getCliToken() calls in the same process pick up the new value.

Also removes the redundant mkdirSync from ConfigStore.delete() - if
readConfig() succeeded, the directory already exists.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rexxars

packages/@sanity/cli-core/src/config/__tests__/cliToken.test.ts

@@ -72,4 +72,20 @@ describe('getCliToken', () => {
     const token = await getCliToken()
     expect(token).toBe('trimmed-token')
   })
+
+  it('should re-read after clearCliTokenCache', async () => {
+    vi.mocked(getCliUserConfig).mockReturnValueOnce('first-token')
+    const module = await import('../../services/getCliToken')
+
+    const firstCall = await module.getCliToken()
+    expect(firstCall).toBe('first-token')
+
+    // Clear cache and set up a new return value
+    module.clearCliTokenCache()
+    vi.mocked(getCliUserConfig).mockReturnValueOnce('second-token')
+
+    const secondCall = await module.getCliToken()
+    expect(secondCall).toBe('second-token')
+    expect(getCliUserConfig).toHaveBeenCalledTimes(2)
+  })
 })

packages/@sanity/cli-core/src/config/__tests__/cliUserConfig.test.ts

@@ -4,13 +4,15 @@ import {homedir} from 'node:os'
 import {afterEach, beforeEach, describe, expect, test, vi} from 'vitest'
 
 import {getCliUserConfig, getUserConfig, setCliUserConfig} from '../../services/cliUserConfig'
+import {clearCliTokenCache} from '../../services/getCliToken'
 import {readJsonFileSync} from '../../util/readJsonFileSync'
 import {writeJsonFileSync} from '../../util/writeJsonFileSync'
 
 vi.mock('node:fs')
 vi.mock('node:os')
 vi.mock('../../util/readJsonFileSync')
 vi.mock('../../util/writeJsonFileSync')
+vi.mock('../../services/getCliToken')
 
 const mockHomedir = '/mock/home/dir'
 
@@ -131,6 +133,16 @@ describe('cliUserConfig', () => {
         expect.any(Object),
       )
     })
+
+    test('invalidates token cache after setting authToken', () => {
+      setCliUserConfig('authToken', 'new-token')
+      expect(clearCliTokenCache).toHaveBeenCalled()
+    })
+
+    test('invalidates token cache after clearing authToken', () => {
+      setCliUserConfig('authToken', undefined)
+      expect(clearCliTokenCache).toHaveBeenCalled()
+    })
   })
 
   describe('getUserConfig', () => {
@@ -217,7 +229,7 @@ describe('cliUserConfig', () => {
       const store = getUserConfig()
       store.delete('removeMe')
 
-      expect(mkdirSync).toHaveBeenCalledWith(expect.any(String), {recursive: true})
+      expect(mkdirSync).not.toHaveBeenCalled()
       expect(writeJsonFileSync).toHaveBeenCalledWith(
         expect.any(String),
         {keepMe: 'yes'},

packages/@sanity/cli-core/src/services/cliUserConfig.ts

@@ -7,6 +7,7 @@ import {z} from 'zod'
 import {debug} from '../debug.js'
 import {readJsonFileSync} from '../util/readJsonFileSync.js'
 import {writeJsonFileSync} from '../util/writeJsonFileSync.js'
+import {clearCliTokenCache} from './getCliToken.js'
 
 const cliUserConfigSchema = {
   authToken: z.string().optional(),
@@ -42,6 +43,10 @@ export function setCliUserConfig(prop: 'authToken', value: string | undefined):
   } else {
     writeJsonFileSync(configPath, {...config, [prop]: value}, {pretty: true})
   }
+
+  // Invalidate the in-process token cache so subsequent getCliToken() calls
+  // pick up the new value from disk.
+  clearCliTokenCache()
 }
 
 /**
@@ -112,9 +117,7 @@ export function getUserConfig(): ConfigStore {
       const config = readConfig()
       if (!(key in config)) return
       const {[key]: _, ...rest} = config
-      const configPath = getCliUserConfigPath()
-      mkdirSync(dirname(configPath), {recursive: true})
-      writeJsonFileSync(configPath, rest, {pretty: true})
+      writeJsonFileSync(getCliUserConfigPath(), rest, {pretty: true})
     },
   }
 }

packages/@sanity/cli-core/src/services/getCliToken.ts

@@ -22,3 +22,15 @@ export async function getCliToken(): Promise<string | undefined> {
   cachedToken = getCliUserConfig('authToken')
   return cachedToken
 }
+
+/**
+ * Clear the in-process token cache so the next `getCliToken()` call
+ * re-reads from disk or the environment.
+ *
+ * Called automatically by `setCliUserConfig('authToken', ...)`.
+ *
+ * @internal
+ */
+export function clearCliTokenCache(): void {
+  cachedToken = undefined
+}