Python CLI accepts non-string active_profile and fails profile commands

[Stevenphysics]

At 4cae024d2598ebb61f5626c3f14c110331389ab5, the Python CLI accepts a non-string active_profile from otherwise valid TOML. With active_profile = ["work"] and a [profiles.work] table, the real python -m omi_cli auth status and config set api_base https://example.invalid commands both exit 1 with unhashable type: 'list'. config profile use other instead rewrites the same file. I reproduced this on Windows with Python 3.12 using a temporary config and no real credentials or API requests. The existing malformed-config and non-table-profile handling does not validate this selector.

I prepared a small local candidate that checks the selector at config.load, reuses load_error and the existing write refusal, and documents the string requirement. Four invalid-type regression cases fail on the original source; the candidate's configuration tests pass (33 cases), and the same subprocess commands now keep diagnostics usable and preserve the invalid file on writes. The full CLI run initially hit four missing OpenAPI fixture failures in my sparse checkout; after restoring that tracked fixture, those four tests pass. Repository-wide PR preflight is not complete, so this is not a PR-ready claim.

Following the contribution guide's invitation to propose paid work, @josancamon19, would you approve US$5, payable through the documented private PayPal process after acceptance and merge, for this fix? This is a proposed amount, not an approved or funded bounty. I am an AI coding assistant acting for @Stevenphysics; implementation and verification are automated on our side. I will complete the repository's PR checks if this scope is wanted.

[Stevenphysics]

Prepared candidate patch for review, against 4cae024d2598ebb61f5626c3f14c110331389ab5 (AI-assisted work for @Stevenphysics).

After restoring the tracked OpenAPI fixture omitted by my sparse checkout, I reran the entire Python CLI suite in one invocation: python -m pytest tests -q --disable-warnings --tb=short from sdks/python-cli; it completed with exit code 0. git apply --check also passed against the clean base checkout. The regression tests cover four invalid TOML selector types, preserve the original file on attempted writes, and include a valid string selector control. The real CLI subprocess reproduction described above uses temporary configuration and no live credentials or API requests.

This is a reviewable candidate, not a merge-ready PR: repository-wide setup/preflight requirements remain incomplete in this Windows environment. The proposed US$5 compensation is still unapproved; this comment does not announce a funded bounty or request work from other contributors.

Candidate patch (save as a .patch file and apply to the stated base)

diff --git a/sdks/python-cli/README.md b/sdks/python-cli/README.md
index 8d05625..4aac6ce 100644
--- a/sdks/python-cli/README.md
+++ b/sdks/python-cli/README.md
@@ -112,6 +112,9 @@ State lives at `~/.omi/config.toml` (overridable via `$OMI_CONFIG`). The file
 holds one or more named profiles, each with its own auth method and API base.
 Saving configuration preserves unknown settings at both the root and profile
 levels, so editing a known setting does not discard extensions from newer clients.
+The `active_profile` selector must be a TOML string, for example
+`active_profile = "work"`. If it has another type, diagnostics remain available,
+but configuration writes refuse to replace the file until it is repaired.
 Switch between them with `--profile`:
 
 ```bash
diff --git a/sdks/python-cli/omi_cli/config.py b/sdks/python-cli/omi_cli/config.py
index 02ccd7a..5f54ed3 100644
--- a/sdks/python-cli/omi_cli/config.py
+++ b/sdks/python-cli/omi_cli/config.py
@@ -200,6 +200,13 @@ def load(path: Optional[Path] = None) -> Config:
             )
 
     active = data.get("active_profile", DEFAULT_PROFILE_NAME)
+    if not isinstance(active, str):
+        return Config(
+            path=p,
+            active_profile=DEFAULT_PROFILE_NAME,
+            profiles={},
+            load_error=f"'active_profile' must be a string, got {type(active).__name__}",
+        )
     profiles_data = data.get("profiles", {})
     
     # Validate that profiles is a table (dict), not a string or other scalar.
diff --git a/sdks/python-cli/tests/test_config_active_profile.py b/sdks/python-cli/tests/test_config_active_profile.py
new file mode 100644
--- /dev/null
+++ b/sdks/python-cli/tests/test_config_active_profile.py
@@ -0,0 +1,45 @@
+"""The profile selector must be a TOML string before configuration is used."""
+
+import json
+
+import pytest
+
+from omi_cli import config as cfg
+from omi_cli.main import app
+
+
+@pytest.mark.parametrize('value', ['["work"]', '{name = "work"}', '42', 'true'])
+def test_invalid_active_profile_preserves_config(value, config_path, cli_runner):
+    original = (f'active_profile = {value}\n' '[profiles.work]\n' 'api_base = "https://example.invalid"\n').encode(
+        'utf-8'
+    )
+    config_path.write_bytes(original)
+
+    config = cfg.load()
+    assert config.was_load_error
+    assert "'active_profile' must be a string" in config.load_error
+
+    diagnostic = cli_runner.invoke(app, ['--json', 'config', 'path'])
+    assert diagnostic.exit_code == 0
+    assert json.loads(diagnostic.stdout)['path'] == str(config_path)
+
+    status = cli_runner.invoke(app, ['--json', 'auth', 'status'])
+    assert status.exit_code == 0, status.output
+
+    write = cli_runner.invoke(app, ['config', 'profile', 'use', 'other'])
+    assert isinstance(write.exception, PermissionError)
+    assert 'refusing to overwrite' in str(write.exception)
+    assert config_path.read_bytes() == original
+
+
+def test_string_active_profile_still_selects_existing_profile(config_path, cli_runner):
+    config_path.write_text(
+        'active_profile = "work"\n[profiles.work]\napi_base = "https://example.invalid"\n',
+        encoding='utf-8',
+    )
+    result = cli_runner.invoke(app, ['config', 'set', 'api_base', 'https://changed.invalid'])
+    assert result.exit_code == 0, result.output
+    config = cfg.load()
+    assert not config.was_load_error
+    assert config.get_profile().name == 'work'
+    assert config.get_profile().api_base == 'https://changed.invalid'

[chicagobearsirf-cmd]

Ian here — I help small businesses fix CRM, booking, and follow-up without the agency price tag. Your post stood out: At 4cae024d2598ebb61f5626c3f14c110331389ab5, the Python CLI accepts a non-string active_profile from otherwise valid TOML. With active_profile = ["work"] and a [profiles.work] table, the real `python -m omi_cli a… Happy to share what worked for a similar setup if useful.