Move settings recovery out of generic loader

Author: TheGreatAxios

src/config/index.ts

@@ -52,7 +52,7 @@ import {
   globalSettingsPath,
   loadLocalSettingsResult,
   type SettingsLoadDiagnostic,
-  loadSettings,
+  loadSettingsRecoveringClobberedOAuthSelection,
   resolveLocalSettingsPath,
   normalizeOpenAICompatibleBaseURL,
   resolveProvider,
@@ -689,19 +689,23 @@ export async function loadConfig(
   const [codexProfiles, xaiProfiles]: [CodexProfile[], XaiProfile[]] = useOAuthProfiles
     ? await Promise.all([listCodexProfiles(), listXaiProfiles()])
     : [[], []];
-  const codexProviderSettings = codexProvidersAsSettings(codexProfiles);
-  const xaiProviderSettings = xaiProvidersAsSettings(xaiProfiles);
-  const recoverableOAuthProviders = {
-    ...codexProviderSettings,
-    ...xaiProviderSettings,
+  let projectedOAuthProviders = {
+    ...codexProvidersAsSettings(codexProfiles),
+    ...xaiProvidersAsSettings(xaiProfiles),
   };
   const settings =
     configPath !== undefined
-      ? await loadSettings(configPath, { recoverableOAuthProviders }).then((s) => {
+      ? await loadSettingsRecoveringClobberedOAuthSelection(
+          configPath,
+          projectedOAuthProviders,
+        ).then((s) => {
           if (s === null) throw new Error(`--config file not found or empty: ${configPath}`);
           return s;
         })
-      : await loadSettings(effectiveSettingsPath, { recoverableOAuthProviders });
+      : await loadSettingsRecoveringClobberedOAuthSelection(
+          effectiveSettingsPath,
+          projectedOAuthProviders,
+        );
 
   // Track whether the effective value came from the persisted global default
   // rather than this invocation's --dangerously-skip-permissions flag, so the
@@ -710,15 +714,12 @@ export async function loadConfig(
     !dangerouslySkipPermissions && settings?.dangerouslySkipPermissions === true;
   dangerouslySkipPermissions =
     dangerouslySkipPermissions || settings?.dangerouslySkipPermissions === true;
-  const oauthProviderSettings = applyPersistedOAuthDefaults(settings, {
-    ...codexProviderSettings,
-    ...xaiProviderSettings,
-  });
+  projectedOAuthProviders = applyPersistedOAuthDefaults(settings, projectedOAuthProviders);
   const settingsForResolution: Settings | null =
-    Object.keys(oauthProviderSettings).length > 0
+    Object.keys(projectedOAuthProviders).length > 0
       ? {
           ...(settings ?? { providers: {} }),
-          providers: { ...(settings?.providers ?? {}), ...oauthProviderSettings },
+          providers: { ...(settings?.providers ?? {}), ...projectedOAuthProviders },
         }
       : settings;
 

src/config/settings.ts

@@ -745,29 +745,21 @@ export function healOpenCodeGoProviders(settings: Settings): string[] {
   return healed;
 }
 
-function isClobberedLocalSelection(value: unknown): value is { provider: string; model: string } {
-  if (!LocalSettingsSchema.allows(value) || typeof value !== "object" || value === null) {
-    return false;
-  }
-  const selection = value as Record<string, unknown>;
-  return (
-    Object.keys(selection).length === 2 &&
-    typeof selection.provider === "string" &&
-    selection.provider.length > 0 &&
-    typeof selection.model === "string" &&
-    selection.model.length > 0
-  );
-}
+const ClobberedLocalSelectionSchema = type({
+  provider: "string>0",
+  model: "string>0",
+  "+": "reject",
+});
 
-interface LoadSettingsOptions {
-  recoverableOAuthProviders?: Record<string, ProviderSettings>;
+function isClobberedLocalSelection(value: unknown): value is { provider: string; model: string } {
+  return ClobberedLocalSelectionSchema.allows(value);
 }
 
 function recoverClobberedOAuthSelection(
   selection: { provider: string; model: string },
-  projected: Record<string, ProviderSettings> | undefined,
+  projected: Record<string, ProviderSettings>,
 ): Settings | undefined {
-  const provider = projected?.[selection.provider];
+  const provider = projected[selection.provider];
   // Auth-profile presence is enough: the selected model may be outside the
   // projected fallback catalog (CODEX_DEFAULT_MODELS / xAI equivalents).
   if (provider === undefined) return undefined;
@@ -779,35 +771,30 @@ function recoverClobberedOAuthSelection(
   };
 }
 
-export async function loadSettings(
-  path: string,
-  options: LoadSettingsOptions = {},
-): Promise<Settings | null> {
+async function loadSettingsJSON(path: string): Promise<unknown | null> {
   let raw: string;
   try {
     raw = await readFile(path, "utf8");
   } catch (err) {
     if (isENOENT(err)) return null;
     throw err;
   }
-  let parsed: unknown;
   try {
-    parsed = JSON.parse(raw);
+    return JSON.parse(raw);
   } catch {
     throw new Error(`Invalid JSON in settings file: ${path}`);
   }
+}
+
+function settingsSchemaError(path: string): Error {
+  return new Error(
+    `Invalid settings schema in ${path}: expected { providers: { <name>: { baseURL, apiKey, models: [...] } } }`,
+  );
+}
+
+function normalizeParsedSettings(path: string, parsed: unknown): Settings {
   if (!isSettings(parsed)) {
-    if (isClobberedLocalSelection(parsed)) {
-      const recovered = recoverClobberedOAuthSelection(
-        parsed,
-        options.recoverableOAuthProviders,
-      ) ?? { providers: {} };
-      await saveGlobalSettings(path, recovered);
-      return recovered;
-    }
-    throw new Error(
-      `Invalid settings schema in ${path}: expected { providers: { <name>: { baseURL, apiKey, models: [...] } } }`,
-    );
+    throw settingsSchemaError(path);
   }
   const s = parsed as unknown as Record<string, unknown>;
   // These keys were removed when plugins moved to discovery; they are now
@@ -861,10 +848,14 @@ export async function loadSettings(
         ? Boolean(s.dangerouslySkipPermissions)
         : undefined,
   };
-  const settings: Settings = {
+  return {
     providers: s.providers as Settings["providers"],
     ...pickDefined(optional),
   };
+}
+
+async function loadStrictSettings(path: string, parsed: unknown): Promise<Settings> {
+  const settings = normalizeParsedSettings(path, parsed);
   // Hard cutover: pin Go flag + canonical baseURL on disk when any Go signal matches.
   // Only rewrite disk when heal actually mutates (no write-on-read for no-op reloads).
   // Fail open on save: keep the in-memory heal so startup is not bricked by a
@@ -885,6 +876,27 @@ export async function loadSettings(
   return settings;
 }
 
+export async function loadSettings(path: string): Promise<Settings | null> {
+  const parsed = await loadSettingsJSON(path);
+  return parsed === null ? null : await loadStrictSettings(path, parsed);
+}
+
+export async function loadSettingsRecoveringClobberedOAuthSelection(
+  path: string,
+  recoverableOAuthProviders: Record<string, ProviderSettings>,
+): Promise<Settings | null> {
+  const parsed = await loadSettingsJSON(path);
+  if (parsed === null) return null;
+  if (isClobberedLocalSelection(parsed)) {
+    const recovered = recoverClobberedOAuthSelection(parsed, recoverableOAuthProviders) ?? {
+      providers: {},
+    };
+    await saveGlobalSettings(path, recovered);
+    return recovered;
+  }
+  return loadStrictSettings(path, parsed);
+}
+
 /** Diagnostic produced when settings fail open instead of crashing startup. */
 export interface SettingsLoadDiagnostic {
   path: string;

src/settings.test.ts

@@ -11,6 +11,7 @@ import {
   loadLocalSettings,
   loadLocalSettingsWriteBase,
   loadSettings,
+  loadSettingsRecoveringClobberedOAuthSelection,
   normalizeOpenAICompatibleBaseURL,
   resolveProvider,
   saveGlobalSettings,
@@ -594,60 +595,72 @@ describe("loaders", () => {
     }
   });
 
-  test.each([
-    ["one profile", ["codex/work"]],
-    ["multiple profiles", ["codex/personal", "codex/work"]],
-  ])("loadSettings recovers an exact OAuth selection with %s", async (_name, providerNames) => {
+  test("loadSettings keeps local selection recovery out of the strict loader", async () => {
     const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
     try {
       const path = join(dir, "settings.json");
       await writeFile(path, JSON.stringify({ provider: "codex/work", model: "gpt-5.1-codex" }));
-      const projected = Object.fromEntries(
-        providerNames.map((name) => [
-          name,
-          {
-            baseURL: "https://chatgpt.com/backend-api",
-            apiKey: "oauth-token",
-            models: ["gpt-5.2-codex", "gpt-5.1-codex"],
-            defaultModel: "gpt-5.2-codex",
-          } satisfies ProviderSettings,
-        ]),
-      );
-
-      const recovered = await loadSettings(path, { recoverableOAuthProviders: projected });
-      expect(recovered).toEqual({
-        defaultProvider: "codex/work",
-        providers: {
-          "codex/work": {
-            baseURL: "https://chatgpt.com/backend-api",
-            models: ["gpt-5.1-codex"],
-            defaultModel: "gpt-5.1-codex",
-          },
-        },
-      });
-      expect(JSON.stringify(recovered)).not.toContain("oauth-token");
-      expect(await loadSettings(path)).toEqual(recovered);
+      await expect(loadSettings(path)).rejects.toThrow(/Invalid settings schema/);
     } finally {
       await rm(dir, { recursive: true, force: true });
     }
   });
 
-  test("loadSettings recovers a non-catalog OAuth model when the auth profile exists", async () => {
+  test.each([
+    ["one profile", ["codex/work"]],
+    ["multiple profiles", ["codex/personal", "codex/work"]],
+  ])(
+    "loadSettingsRecoveringClobberedOAuthSelection recovers an exact OAuth selection with %s",
+    async (_name, providerNames) => {
+      const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+      try {
+        const path = join(dir, "settings.json");
+        await writeFile(path, JSON.stringify({ provider: "codex/work", model: "gpt-5.1-codex" }));
+        const projected = Object.fromEntries(
+          providerNames.map((name) => [
+            name,
+            {
+              baseURL: "https://chatgpt.com/backend-api",
+              apiKey: "oauth-token",
+              models: ["gpt-5.2-codex", "gpt-5.1-codex"],
+              defaultModel: "gpt-5.2-codex",
+            } satisfies ProviderSettings,
+          ]),
+        );
+
+        const recovered = await loadSettingsRecoveringClobberedOAuthSelection(path, projected);
+        expect(recovered).toEqual({
+          defaultProvider: "codex/work",
+          providers: {
+            "codex/work": {
+              baseURL: "https://chatgpt.com/backend-api",
+              models: ["gpt-5.1-codex"],
+              defaultModel: "gpt-5.1-codex",
+            },
+          },
+        });
+        expect(JSON.stringify(recovered)).not.toContain("oauth-token");
+        expect(await loadSettings(path)).toEqual(recovered);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    },
+  );
+
+  test("loadSettingsRecoveringClobberedOAuthSelection recovers a non-catalog OAuth model when the auth profile exists", async () => {
     const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
     try {
       const path = join(dir, "settings.json");
       await writeFile(
         path,
         JSON.stringify({ provider: "codex/work", model: "gpt-special-custom" }),
       );
-      const recovered = await loadSettings(path, {
-        recoverableOAuthProviders: {
-          "codex/work": {
-            baseURL: "https://chatgpt.com/backend-api",
-            apiKey: "oauth-token",
-            models: ["gpt-5.2-codex", "gpt-5.1-codex"],
-            defaultModel: "gpt-5.2-codex",
-          },
+      const recovered = await loadSettingsRecoveringClobberedOAuthSelection(path, {
+        "codex/work": {
+          baseURL: "https://chatgpt.com/backend-api",
+          apiKey: "oauth-token",
+          models: ["gpt-5.2-codex", "gpt-5.1-codex"],
+          defaultModel: "gpt-5.2-codex",
         },
       });
       expect(recovered).toEqual({
@@ -676,13 +689,11 @@ describe("loaders", () => {
         JSON.stringify({ provider: "codex/work", model: "gpt-5.1-codex", apiKey: "nope" }),
       );
       await expect(
-        loadSettings(path, {
-          recoverableOAuthProviders: {
-            "codex/work": {
-              baseURL: "https://chatgpt.com/backend-api",
-              apiKey: "oauth-token",
-              models: ["gpt-5.1-codex"],
-            },
+        loadSettingsRecoveringClobberedOAuthSelection(path, {
+          "codex/work": {
+            baseURL: "https://chatgpt.com/backend-api",
+            apiKey: "oauth-token",
+            models: ["gpt-5.1-codex"],
           },
         }),
       ).rejects.toThrow(/Invalid settings schema/);
@@ -696,13 +707,11 @@ describe("loaders", () => {
     try {
       const path = join(dir, "settings.json");
       await writeFile(path, JSON.stringify({ provider: "codex/missing", model: "gpt-5.1-codex" }));
-      const recovered = await loadSettings(path, {
-        recoverableOAuthProviders: {
-          "codex/work": {
-            baseURL: "https://chatgpt.com/backend-api",
-            apiKey: "oauth-token",
-            models: ["gpt-5.1-codex"],
-          },
+      const recovered = await loadSettingsRecoveringClobberedOAuthSelection(path, {
+        "codex/work": {
+          baseURL: "https://chatgpt.com/backend-api",
+          apiKey: "oauth-token",
+          models: ["gpt-5.1-codex"],
         },
       });
       expect(recovered).toEqual({ providers: {} });

src/tui/runner-exit-code.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect } from "bun:test";
-import { resolveExitCode, resolveTUILocalSettingsPath } from "./runner.js";
+import { resolveLocalSettingsPath } from "../config/settings.js";
+import { resolveExitCode } from "./runner.js";
 
 describe("resolveExitCode", () => {
   test("returns 0 when run completes successfully with no errors", () => {
@@ -66,22 +67,14 @@ describe("resolveExitCode", () => {
   });
 });
 
-describe("resolveTUILocalSettingsPath", () => {
+describe("resolveLocalSettingsPath", () => {
   test("treats an aliased --config path as the global settings target", () => {
-    expect(
-      resolveTUILocalSettingsPath({
-        cwd: "/repo",
-        globalSettingsPath: "/repo/.corbits/settings.json",
-      }),
-    ).toBeNull();
+    expect(resolveLocalSettingsPath("/repo", "/repo/.corbits/settings.json")).toBeNull();
   });
 
   test("preserves the normal distinct global and project settings paths", () => {
-    expect(
-      resolveTUILocalSettingsPath({
-        cwd: "/tmp/repo",
-        globalSettingsPath: "/tmp/home/user/.corbits/settings.json",
-      }),
-    ).toBe("/tmp/repo/.corbits/settings.json");
+    expect(resolveLocalSettingsPath("/tmp/repo", "/tmp/home/user/.corbits/settings.json")).toBe(
+      "/tmp/repo/.corbits/settings.json",
+    );
   });
 });