fix(link): refresh masked-password URLs on re-link

src/auth-providers/apply.test.ts

@@ -100,6 +100,23 @@ describe('refreshStaleEnvDefaults', () => {
     expect(updated).toBe(existing);
   });
 
+  it('refreshes a masked-password URL even if it differs from the manifest default', () => {
+    // Pre-0.1.72 cloud links wrote `postgresql://postgres:********@...`
+    // (placeholder password) to .env.local. Re-linking under 0.1.72+ should
+    // replace that with the real spliced password from /database-password.
+    const existing = 'DATABASE_URL=postgresql://postgres:********@m8s5kmam.us-east.database.insforge.app:5432/insforge?sslmode=require\n';
+    const defaults = new Map([
+      ['DATABASE_URL', 'postgresql://postgres:postgres@127.0.0.1:5432/insforge'],
+    ]);
+    const platform = new Map([
+      ['DATABASE_URL', 'postgresql://postgres:realsecret@m8s5kmam.us-east.database.insforge.app:5432/insforge?sslmode=require'],
+    ]);
+    const { updated, refreshed } = refreshStaleEnvDefaults(existing, defaults, platform);
+    expect(refreshed).toEqual(['DATABASE_URL']);
+    expect(updated).toContain('postgres:realsecret@');
+    expect(updated).not.toContain('********');
+  });
+
   it('handles multiple keys, refreshing only the stale ones', () => {
     const existing = [
       'DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:5432/insforge',

src/auth-providers/apply.ts

@@ -113,7 +113,16 @@ export function extractEnvPairs(content: string): Map<string, string> {
 // value matches the manifest's literal default AND the platform now has a
 // real value (e.g., cloud DATABASE_URL), overwrite the line. User-customized
 // values (anything that differs from the manifest default) are preserved.
+//
+// One extra case beyond "matches the default": the cloud's
+// `database-connection-string` endpoint used to return a placeholder URL
+// like `postgresql://postgres:********@host/db?sslmode=require` before
+// 0.1.72 spliced the real password in. Users linked under that older CLI
+// still have the masked URL in their .env.local. The masked value can
+// never authenticate to Postgres, so it's clearly stale — detect any
+// `:****@` (one or more `*`) password and refresh from the platform.
 // Exported for unit testing.
+const MASKED_PASSWORD_PATTERN = /:\*+@/;
 export function refreshStaleEnvDefaults(
   existing: string,
   manifestDefaults: Map<string, string>,
@@ -127,7 +136,10 @@ export function refreshStaleEnvDefaults(
     const userValue = m[2];
     const def = manifestDefaults.get(key);
     const real = platformValues.get(key);
-    if (def !== undefined && real !== undefined && userValue === def && real !== def) {
+    if (def === undefined || real === undefined || real === def) return line;
+    const matchesDefault = userValue === def;
+    const isMaskedPassword = MASKED_PASSWORD_PATTERN.test(userValue);
+    if (matchesDefault || isMaskedPassword) {
       refreshed.push(key);
       return `${key}=${real}`;
     }