Debug bar renders environment quick-switch links only in the configuration where switching is impossible (dead links since #2082)

[bpamiri]

Summary

The debug bar's Environment panel renders quick-switch links (Testing / Maintenance / Production) gated on NOT Len($get("reloadPassword")) (vendor/wheels/events/onrequestend/debug.cfm:304-312). But since ecf419f (fix(config): require non-empty reload password for environment switching (#2082), 2026-04-10), vendor/wheels/events/onapplicationstart.cfc only honors ?reload=<environment> when a NON-EMPTY reloadPassword is configured AND url.password secure-compare-matches; with no password it falls through to re-including config/environment.cfm. Net effect: the links render exclusively when they can never work — clicking one restarts the app and silently stays in the current environment.

Repro (develop @ f668c50, Lucee 7 docker harness, development)

# 1. set(reloadPassword="") in config/settings.cfm -> debug bar Environment panel
#    renders anchors /?reload=testing, /?reload=maintenance, /?reload=production
curl -sL -o /dev/null -w '%{http_code}\n' 'http://localhost:60007/?reload=testing'  # -> 200 after 1 redirect (app restarted)
curl -s 'http://localhost:60007/' | grep -o 'Development'                            # -> still Development (no switch)

# 2. control: with set(reloadPassword="smokepw"), the switch DOES work...
curl -sL 'http://localhost:60007/?reload=testing&password=smokepw'   # -> switches (root 404s = testing dev-only-UI gate)
#    ...but in this configuration the bar does not render the links at all.

Intent confirmed: the password requirement is deliberate security hardening (#2082 commit message + wheels_security log lines Environment switched to ... via URL).

Root cause

debug.cfm's link gate (NOT Len($get("reloadPassword"))) was never updated when #2082 inverted the precondition for environment switching. The guide ("When no reload password is set, the environment name is followed by quick-switch links...") documents the pre-#2082 behavior — being fixed in the debug-panel.mdx docs PR; this issue tracks the code side.

Proposed direction

The debug bar should never render environment quick-switch links that cannot perform a switch. Either:

• (a) remove the quick-switch links entirely (simplest, matches fix(config): require non-empty reload password for environment switching #2082's posture that env switching requires a password), or
• (b) render them only when a reload password IS configured, with hrefs that prompt for the password (embedding the password in the page defeats its purpose, so (a) or a confirm-prompt flow is preferred).

The plain one-click reload anchor (?reload=true, debug.cfm:188-192) keeps its current no-password gate — boolean reloads without a configured password still work and are unaffected by #2082.

Acceptance

• The debug bar never renders environment quick-switch links that cannot perform a switch (per chosen option above).
• The plain ?reload=true anchor behavior is unchanged.
• A spec covering the chosen behavior (links absent when reloadPassword empty, or functional when present).
• Guide text for "quick-switch links" matches the final behavior (coordinate with the debug-panel.mdx docs PR from the 2026-06-11 guide audit).

Reported by the 2026-06-11 guide behavioral audit (P1 batch 1): debug-panel verifier (claim env-quickswitch-links-work, verdict both — docs stale AND dead code affordance). Findings catalog: docs/superpowers/audits/2026-06-guide-audit-findings.md.

[wheels-bot]

Wheels Bot — Triage

Classified as bug.

The report describes an observable dead affordance: the debug bar's Environment panel renders quick-switch links (Testing / Maintenance / Production) gated on NOT Len($get("reloadPassword")), but since #2082 environment switching via ?reload=[env] only works when a non-empty reloadPassword IS configured and url.password matches. So the links render exclusively in the one configuration where clicking them can never switch the environment — they silently restart the app and stay put. This is reproducible in isolation and has a clear "what happened / what I expected".

Suspected layer

view — see .ai/wheels/views/ for canonical patterns. The defect lives in the debug-bar markup at vendor/wheels/events/onrequestend/debug.cfm (env quick-switch gate ~lines 304-312), a rendering concern rather than the switching logic itself (which lives correctly in vendor/wheels/events/onapplicationstart.cfc post-#2082).

Fix sketch

Single-file change in vendor/wheels/events/onrequestend/debug.cfm: the env quick-switch <cfif NOT Len($get("reloadPassword"))> gate is the inverse of what #2082 made functional. Per the issue's proposed direction, either (a) remove the quick-switch anchors entirely, or (b) render them only when a reload password is configured behind a confirm/prompt flow (the issue notes embedding the password in the page defeats its purpose, so (a) is the simpler, recommended option). The separate plain ?reload=true reload anchor (debug.cfm:188-192) keeps its current no-password gate and must stay unchanged.

Confidence: medium

The root cause is pinpointed to an exact file and line, but the issue itself surfaces a genuine design choice (remove the links vs. a password-gated prompt flow) and the affordance is tied to the #2082 reloadPassword security posture, so it is not a purely mechanical one-shape fix.