fix(toolsets): reject an empty accountId instead of widening to every account

Author: willleeney

src/toolsets.test.ts

@@ -102,6 +102,12 @@ describe('configuration', () => {
 		await expect(async () => act()).rejects.toThrow(/must not contain an empty account id/);
 	});
 
+	it('refuses an empty accountId rather than widening to every account', () => {
+		expect(() => newToolSet({ accountId: '' })).toThrow(
+			new ToolSetConfigError('accountId must not be an empty string'),
+		);
+	});
+
 	it('returns itself from setAccounts for chaining', () => {
 		const toolset = newToolSet();
 		expect(toolset.setAccounts(['acc1'])).toBe(toolset);

src/toolsets.ts

@@ -325,14 +325,19 @@ export class StackOneToolSet {
 
 	/**
 	 * @throws ToolSetConfigError If no API key is given or found in `STACKONE_API_KEY`, or both
-	 *   `accountId` and `accountIds` are given.
+	 *   `accountId` and `accountIds` are given, or `accountId` is an empty string.
 	 */
 	constructor(config: StackOneToolSetConfig = {}) {
 		if (config.accountId != null && config.accountIds != null) {
 			throw new ToolSetConfigError(
 				'Cannot provide both accountId and accountIds. Use accountId for a single account or accountIds for multiple accounts.',
 			);
 		}
+		// An empty accountId is usually an unset variable, and treating it as unset would silently
+		// widen every call to all active accounts.
+		if (config.accountId === '') {
+			throw new ToolSetConfigError('accountId must not be an empty string');
+		}
 		assertAccountIdList(config.accountIds, 'accountIds');
 		assertAccountIdList(config.execute?.accountIds, 'execute.accountIds');