From 7b4ddaefa04aa14aa1a7443468e0806e8a07442b Mon Sep 17 00:00:00 2001
From: fullsend-code
 <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:22:56 +0000
Subject: [PATCH] fix(#5241): add missing --file flag to ImportProfile
 openshell command

ImportProfile passed the profile path as a bare positional argument to
`openshell provider profile import`, but OpenShell requires `--file <FILE>`.
This caused all URL-referenced profile imports to fail at sandbox startup.
The sibling ImportProfiles already correctly uses `--from dir`.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 internal/sandbox/sandbox.go      |  2 +-
 internal/sandbox/sandbox_test.go | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/internal/sandbox/sandbox.go b/internal/sandbox/sandbox.go
index b436d353d0..8b40a55048 100644
--- a/internal/sandbox/sandbox.go
+++ b/internal/sandbox/sandbox.go
@@ -120,7 +120,7 @@ func ImportProfile(ctx context.Context, id, profilePath string) error {
 
 	importCtx, importCancel := context.WithTimeout(ctx, providerTimeout)
 	defer importCancel()
-	cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", profilePath)
+	cmd := exec.CommandContext(importCtx, "openshell", "provider", "profile", "import", "--file", profilePath)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		outStr := strings.ToLower(string(out))
diff --git a/internal/sandbox/sandbox_test.go b/internal/sandbox/sandbox_test.go
index 358fc8a6ff..2c80fa1a8c 100644
--- a/internal/sandbox/sandbox_test.go
+++ b/internal/sandbox/sandbox_test.go
@@ -675,6 +675,30 @@ exit 0
 	assert.NoError(t, err)
 }
 
+func TestImportProfile_UsesFileFlag(t *testing.T) {
+	dir := t.TempDir()
+	argsFile := filepath.Join(dir, "args.log")
+
+	// Fake openshell that logs args on "import" invocations and exits 0.
+	script := `#!/bin/sh
+if [ "$3" = "import" ]; then
+  echo "$@" >> ` + argsFile + `
+fi
+exit 0
+`
+	fakePath := filepath.Join(dir, "openshell")
+	require.NoError(t, os.WriteFile(fakePath, []byte(script), 0o755))
+	t.Setenv("PATH", dir)
+
+	err := ImportProfile(context.Background(), "my-profile", "/some/my-profile.yaml")
+	require.NoError(t, err)
+
+	logged, err := os.ReadFile(argsFile)
+	require.NoError(t, err)
+	assert.Contains(t, string(logged), "--file /some/my-profile.yaml",
+		"ImportProfile must pass --file flag to openshell provider profile import")
+}
+
 func TestImportProfile_AlreadyExists(t *testing.T) {
 	dir := t.TempDir()