@mycadet/assistant 0.12.7 → 0.12.9

package/src/runtime/routes/conversation-query-routes.ts

@@ -35,19 +35,16 @@ import {
   scrubNulledChatSettings,
   validateChatSettingsWrite,
 } from "../../config/chat-settings.js";
-import { DefaultProviderSelectionSchema } from "../../config/default-provider.js";
 import {
   catalogEntryFor,
-  type InputModalities,
   modalitiesOf,
   resolveModalityOverride,
 } from "../../config/input-modalities.js";
 import {
   deepMergeOverwrite,
-  fillContextDefaultsForMissingKeys,
   getConfig,
-  getDeploymentContextDefaults,
   invalidateConfigCache,
+  loadConfig,
   loadRawConfig,
   saveRawConfig,
   setNestedValue,
@@ -58,22 +55,21 @@ import {
   completeCustomProfile,
   mergePreservingUnknownKeys,
 } from "../../config/profile-materialization.js";
-import { AssistantConfigSchema } from "../../config/schema.js";
+import {
+  type AssistantConfig,
+  AssistantConfigSchema,
+} from "../../config/schema.js";
 import { getSchemaAtPath } from "../../config/schema-utils.js";
-import { AutoArchiveConfigSchema } from "../../config/schemas/conversations.js";
 import {
   collectFallbackProfileIssues,
-  isDefaultProviderChoice,
   LLMConfigBase,
   LLMConfigFragment,
-  LLMDefaultConfigSchema,
   LLMSchema,
   ProfileEntry,
   routingIdentityModelIssue,
   unknownLlmProviderIssue,
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
-import { NotificationsConfigSchema } from "../../config/schemas/notifications.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
 import { isSidebarDoneEnabled } from "../../config/sidebar-done-gate.js";
 import {
@@ -123,12 +119,12 @@ import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
 import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
-import { MANAGED_ROUTABLE_PROVIDERS } from "../../providers/cadet-model-routing.js";
+import { CLOUD_ROUTABLE_PROVIDERS } from "../../providers/cadet-model-routing.js";
 import { writableProfileProviderIssue } from "../../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
-  CADET_MANAGED_CONNECTION_NAME,
+  CADET_CLOUD_CONNECTION_NAME,
   createConnection,
   getConnection,
   LEGACY_MANAGED_CONNECTION_NAMES,
@@ -527,217 +523,22 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
 }
 
 /**
- * Apply deployment-context defaults to a raw config payload before it goes
- * out over the wire from `GET /v1/config`. The in-memory `loadConfig()`
- * already layers these defaults for daemon-internal consumers; the GET
- * response needs the same treatment so external clients (macOS, web, CLI)
- * see the effective value rather than `undefined` when the daemon hasn't
- * persisted an explicit choice yet. For example, on a freshly-hatched
- * platform-managed assistant, `services.image-generation.provider` may be
- * absent from disk (only `llm.profiles` was written by
- * `seedInferenceProfiles`); the fill pass ensures clients receive `"cadet"`
- * rather than falling back to their own defaults.
- *
- * Guards against `loadRawConfig()` handing us a value that is technically
- * valid JSON but not a plain object (e.g. literal `null`, a number, or an
- * array). `loadRawConfig` is typed `Record<string, unknown>` but `JSON.parse`
- * itself doesn't enforce that — a malformed-but-parseable `config.json`
- * would blow up `fillContextDefaultsForMissingKeys` on its `target[key]` /
- * `fileConfig[key]` accesses, turning `GET /v1/config` into a 500 where it
- * used to succeed (returning the malformed payload as-is). When `raw` is
- * not a plain object, we return it unchanged.
- *
- * Exported for direct unit testing.
+ * Tolerant shape parses for raw config-write fragments — zod replaces the
+ * hand-rolled plain-object narrowing (`readPlainObject`) at every guard.
+ * They model exactly the fields each guard reads and pass everything else
+ * through, so a write guard sees intent even when the surrounding payload
+ * is sparse or malformed. A parse copies, so mutating guards write the
+ * normalized slice back onto the caller's object instead of relying on
+ * shared references.
  */
-export function applyContextDefaultsToRawConfig(raw: unknown): unknown {
-  const contextDefaults = getDeploymentContextDefaults();
-  if (
-    Object.keys(contextDefaults).length === 0 ||
-    raw === null ||
-    typeof raw !== "object" ||
-    Array.isArray(raw)
-  ) {
-    return raw;
-  }
-  fillContextDefaultsForMissingKeys(
-    raw as Record<string, unknown>,
-    raw as Record<string, unknown>,
-    contextDefaults,
-  );
-  synthesizeLegacyInferenceModeForPlatform(raw as Record<string, unknown>);
-  return raw;
-}
-
-/**
- * Backwards-compat wire field for `GET /v1/config`. PR removed
- * `services.inference.mode` from the typed schema (routing is governed by
- * `provider_connections` rows + per-profile `provider_connection`), but
- * the macOS settings client (`SettingsStore.swift:loadServiceModes`) still
- * reads this field and falls back to its `@Published` default of "your-own"
- * when absent. On a platform-managed assistant served by a newer daemon and
- * an older macOS client, that fallback would show the wrong mode in the UI
- * until the user explicitly saved. Synthesize the value here so the wire
- * shape stays compatible during the rollout window. Remove once the macOS
- * Providers UI (the follow-up PR that retires this field on the client) has
- * shipped to the majority of installs.
- *
- * The synthesis is wire-only: it never persists to disk and never reaches
- * the typed `AssistantConfig` consumed by daemon-internal code. The on-disk
- * config is stripped of `mode` by workspace migration 076.
- *
- * Only runs when this function is reached, which is guarded by
- * `getDeploymentContextDefaults()` returning non-empty (IS_PLATFORM=true).
- */
-function synthesizeLegacyInferenceModeForPlatform(
-  root: Record<string, unknown>,
-): void {
-  const services = readPlainObject(root.services);
-  if (!services) {
-    return;
-  }
-  let inference = readPlainObject(services.inference);
-  if (!inference) {
-    inference = {};
-    services.inference = inference;
-  }
-  if (inference.mode === undefined) {
-    inference.mode = "managed";
-  }
-}
-
-function readPlainObject(value: unknown): Record<string, unknown> | undefined {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return undefined;
-  }
-  return value as Record<string, unknown>;
-}
-
-function stripTransportHeadersRecursively(value: unknown): void {
-  if (Array.isArray(value)) {
-    for (const item of value) {
-      stripTransportHeadersRecursively(item);
-    }
-    return;
-  }
-
-  const object = readPlainObject(value);
-  if (!object) {
-    return;
-  }
-  const transport = readPlainObject(object.transport);
-  if (transport) {
-    delete transport.headers;
-  }
-  for (const child of Object.values(object)) {
-    stripTransportHeadersRecursively(child);
-  }
-}
-
-function containsTransportHeadersRecursively(value: unknown): boolean {
-  if (Array.isArray(value)) {
-    return value.some((item) => containsTransportHeadersRecursively(item));
-  }
-
-  const object = readPlainObject(value);
-  if (!object) {
-    return false;
-  }
-  const transport = readPlainObject(object.transport);
-  if (transport && Object.hasOwn(transport, "headers")) {
-    return true;
-  }
-  return Object.values(object).some((child) =>
-    containsTransportHeadersRecursively(child),
-  );
-}
-
-function sanitizeMcpTransportHeadersForSettingsRead(config: unknown): void {
-  const root = readPlainObject(config);
-  if (!root) {
-    return;
-  }
-  const mcp = readPlainObject(root.mcp);
-  if (!mcp || !Object.hasOwn(mcp, "servers")) {
-    return;
-  }
-  if (Array.isArray(mcp.servers)) {
-    stripTransportHeadersRecursively(mcp.servers);
-    return;
-  }
-  const servers = readPlainObject(mcp.servers);
-  if (!servers) {
-    return;
-  }
-  for (const server of Object.values(servers)) {
-    stripTransportHeadersRecursively(server);
-  }
-}
-
-function patchContainsMcpTransportHeaders(patch: unknown): boolean {
-  const root = readPlainObject(patch);
-  const mcp = readPlainObject(root?.mcp);
-  if (!mcp || !Object.hasOwn(mcp, "servers")) {
-    return false;
-  }
-  if (Array.isArray(mcp.servers)) {
-    return containsTransportHeadersRecursively(mcp.servers);
-  }
-  const servers = readPlainObject(mcp.servers);
-  if (!servers) {
-    return false;
-  }
-  return Object.values(servers).some((server) =>
-    containsTransportHeadersRecursively(server),
-  );
-}
-
-function rejectMcpTransportHeaderWrite(patch: unknown): void {
-  if (!patchContainsMcpTransportHeaders(patch)) {
-    return;
-  }
-  throw new BadRequestError(
-    "MCP authentication headers must be managed through MCP server add/update APIs, not generic config writes.",
-  );
-}
-
-const MCP_CONFIG_WRITE_MESSAGE =
-  "MCP servers are stored in mcp.json. Use assistant mcp add or assistant mcp remove.";
-
-function stripMcpFromConfigWrite(patch: Record<string, unknown>): void {
-  if (Object.hasOwn(patch, "mcp")) {
-    delete patch.mcp;
-  }
-}
-
-function rejectMcpConfigSetPath(path: string, value: unknown): void {
-  if (path !== "mcp" && !path.startsWith("mcp.")) {
-    return;
-  }
-  const relative =
-    path === "mcp" ? value : nestPath(path.slice("mcp.".length), value);
-  if (patchContainsMcpTransportHeaders({ mcp: relative })) {
-    throw new BadRequestError(
-      "MCP authentication headers must be managed through MCP server add/update APIs, not generic config writes.",
-    );
-  }
-  throw new BadRequestError(MCP_CONFIG_WRITE_MESSAGE);
-}
-
-function nestPath(path: string, value: unknown): unknown {
-  const segments = path.split(".");
-  let current: unknown = value;
-  for (let i = segments.length - 1; i >= 0; i--) {
-    current = { [segments[i]!]: current };
-  }
-  return current;
-}
-
-const WireProfileEntry = ProfileEntry.extend({
-  supportsVision: z.boolean().optional(),
-  invariant: z.boolean().optional(),
-})
-  .passthrough()
-  .meta({ id: "ProfileEntry" });
+const JsonRecordSchema = z.record(z.string(), z.unknown());
+const RawProfileEntrySchema = z.record(z.string(), z.unknown());
+const RawLlmWriteSliceSchema = z
+  .object({
+    default: z.unknown().optional(),
+    profiles: z.record(z.string(), z.unknown()).nullable().optional(),
+  })
+  .passthrough();
 
 /**
  * Wire shape of the `memory` section in config responses. Passthrough
@@ -752,97 +553,6 @@ const MemoryWireConfigSchema = z
   .passthrough()
   .meta({ id: "MemoryConfig" });
 
-/**
- * Response schema for `GET /v1/config`.
- *
- * Describes the wire shape of the raw `settings.json` response after
- * context-default filling and vision-flag enrichment. Chat settings include
- * effective defaults. Fields remain optional for older assistants and sparse
- * on-disk config. Additional top-level sections are preserved via
- * passthrough. This schema types the fields that web/macOS clients consume
- * without restricting the full config surface.
- */
-const ConfigGetResponseSchema = z
-  .object({
-    // A malformed or absent stored chat-settings subtree falls back to its
-    // schema defaults so one bad leaf can't fail the whole wire parse (which
-    // would strip every derived field from the response); the chat-settings
-    // read overlay refills both from the effective config.
-    conversations: z
-      .object({
-        autoArchive: AutoArchiveConfigSchema.passthrough().catch(
-          AutoArchiveConfigSchema.parse({}),
-        ),
-      })
-      .passthrough()
-      .optional(),
-    notifications: NotificationsConfigSchema.passthrough()
-      .optional()
-      .catch(undefined),
-    llm: z
-      .object({
-        default: LLMDefaultConfigSchema.optional(),
-        // Wire-compat view of the default provider, derived from `default`
-        // by the read overlay (the key is never stored anymore).
-        defaultProvider: DefaultProviderSelectionSchema.optional(),
-        profiles: z.record(z.string(), WireProfileEntry).optional(),
-        profileOrder: z.array(z.string()).optional(),
-        activeProfile: z.string().optional(),
-        // The profile the advisor consults; excluded from chat-profile pickers.
-        advisorProfile: z.string().optional(),
-        callSites: z
-          .record(
-            z.string(),
-            LLMConfigFragment.extend({
-              profile: z.string().optional(),
-            }).nullable(),
-          )
-          .optional(),
-        profileSession: z
-          .object({
-            defaultTtlSeconds: z.number().optional(),
-            maxTtlSeconds: z.number().optional(),
-          })
-          .optional(),
-        pricingOverrides: z.array(z.unknown()).optional(),
-      })
-      .passthrough()
-      .optional(),
-    memory: MemoryWireConfigSchema.optional(),
-    services: z
-      .object({
-        "web-search": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "web-fetch": z
-          .object({
-            provider: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        "image-generation": z
-          .object({
-            provider: z.string().optional(),
-            model: z.string().optional(),
-          })
-          .passthrough()
-          .optional(),
-        inference: z
-          .object({ mode: ServiceModeSchema.optional() })
-          .passthrough()
-          .optional(),
-      })
-      .passthrough()
-      .optional(),
-  })
-  .passthrough()
-  .meta({ id: "ConfigGetResponse" });
-
-type ConfigGetResponse = z.infer<typeof ConfigGetResponseSchema>;
-
 /**
  * Given a `z.object(...)` schema, returns a new schema where every property
  * is `.nullable().optional()`. Used to express PATCH body semantics where any
@@ -880,7 +590,7 @@ const CallSiteOverrideDraftSchema = nullablePartial(
  *
  * Mirrors the response shape but every field is `.nullable().optional()`:
  * omitted keys are left unchanged by the daemon's deep-merge, `null` values
- * delete the key. Uses the same Zod enums as `ConfigGetResponseSchema` so
+ * delete the key. Uses the same Zod enums as `AssistantConfigSchema` so
  * the generated SDK produces literal-union types — no hand-written patch
  * types needed downstream.
  */
@@ -953,54 +663,39 @@ const ConfigPatchRequestSchema = z
   .passthrough()
   .meta({ id: "ConfigPatchRequest" });
 
+/**
+ * The response contract for `GET`/`PATCH /v1/config` — the five subtrees
+ * external clients actually read, picked out of the full graph. Rendering
+ * the whole `AssistantConfigSchema` into the spec blasted openapi.yaml past
+ * 12K lines; we're not ready to trim the response schema itself yet, so the
+ * runtime still returns the full config and the spec documents these.
+ */
+const ConfigGetResponseSchema = AssistantConfigSchema.pick({
+  conversations: true,
+  notifications: true,
+  llm: true,
+  memory: true,
+  services: true,
+});
+
 function handleGetConfig() {
   try {
-    const config = applyContextDefaultsToRawConfig(loadRawConfig());
-    // One zod pass shapes the response: ConfigGetResponseSchema is this
-    // route's wire contract, so the overlays stamp their derived fields on
-    // the parsed view instead of digging handles out of raw objects. A
-    // config the schema rejects gets no overlays and is served raw.
-    const parsed = ConfigGetResponseSchema.safeParse(config);
-    if (!parsed.success) {
-      return config;
-    }
-    const wire = parsed.data;
-    overlayWorkspaceMcpForConfigRead(wire);
-    sanitizeMcpTransportHeadersForSettingsRead(wire);
-    overlayEffectiveProfilesForWire(wire);
-    enrichProfilesForWire(wire);
-    overlayDefaultProviderForWire(wire);
-    overlayChatSettingsForWire(wire);
-    return wire;
+    // The overlays stamp wire-only state (catalog bodies, effective chat
+    // settings, capability flags) onto the returned object. Clone first so
+    // the loader's cached config — and every other `getConfig()` reader,
+    // including the config-write merge base — never sees the wire view.
+    const config = structuredClone(loadConfig());
+    overlayWorkspaceMcpForConfigRead(config);
+    overlayEffectiveProfilesForWire(config);
+    enrichProfilesForWire(config);
+    overlayChatSettingsForWire(config);
+    return config;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     throw new InternalError(`Failed to read config: ${message}`);
   }
 }
-
-/**
- * Surface the default-provider selection on config reads. The selection lives
- * in the `llm.default` blob; the dedicated `defaultProvider` response field is
- * a derived wire-compat view (readers of the config GET predate the blob) and
- * is never stored on disk — it is stamped here from the blob on every read.
- */
-function overlayDefaultProviderForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    return;
-  }
-  const blob = config.llm.default;
-  const provider = blob?.provider;
-  if (provider != null && isDefaultProviderChoice(provider)) {
-    config.llm.defaultProvider = {
-      provider,
-      connectionName: blob?.provider_connection,
-    };
-  } else {
-    delete config.llm.defaultProvider;
-  }
-}
-
-function overlayChatSettingsForWire(config: ConfigGetResponse): void {
+function overlayChatSettingsForWire(config: AssistantConfig): void {
   const effective = getConfig();
   config.conversations = {
     ...config.conversations,
@@ -1023,7 +718,7 @@ function overlayChatSettingsForWire(config: ConfigGetResponse): void {
  * render labels/models — so the wire view materializes them, resolved through
  * `llm.default`'s column of the intent × provider matrix so a BYO
  * install sees the provider/model that actually dispatches. Wire-only:
- * `normalizeManagedProfileWrites` reduces echoed bodies back to the
+ * `normalizeCloudProfileWrites` reduces echoed bodies back to the
  * workspace-owned fields on the write paths, so a `config get` →
  * `config set` round-trip never persists catalog content — the two must
  * resolve through the same column or honest round-trips are rejected.
@@ -1033,47 +728,13 @@ function overlayChatSettingsForWire(config: ConfigGetResponse): void {
  * shields the matrix lookup from a persisted value the matrix cannot
  * implement, which a raw read would feed straight into resolution.
  */
-function overlayEffectiveProfilesForWire(config: ConfigGetResponse): void {
-  if (!config.llm) {
-    config.llm = {};
-  }
+function overlayEffectiveProfilesForWire(config: AssistantConfig): void {
   const parsedLlm = LLMSchema.safeParse(config.llm);
   config.llm.profiles = getUserSelectableProfilesForProvider(
     parsedLlm.success ? parsedLlm.data : undefined,
   );
 }
 
-/**
- * Per-profile keys that exist only on the wire — stamped onto config
- * responses by {@link enrichProfilesForWire}, never persisted to disk.
- * {@link stripWireOnlyProfileKeys} removes them from incoming writes so a
- * `config get` → `config set`/PATCH round-trip isn't rejected for phantom
- * fields; keep the stamp and strip lists in lock-step.
- */
-const WIRE_ONLY_PROFILE_KEYS = new Set(["invariant", "supportsVision"]);
-
-/**
- * Delete the wire-only keys ({@link WIRE_ONLY_PROFILE_KEYS}) from every
- * profile entry in a config-write fragment, in place.
- */
-function stripWireOnlyProfileKeys(patch: unknown): void {
-  const root = readPlainObject(patch);
-  const llm = readPlainObject(root?.llm);
-  const profiles = readPlainObject(llm?.profiles);
-  if (!profiles) {
-    return;
-  }
-  for (const profile of Object.values(profiles)) {
-    const entry = readPlainObject(profile);
-    if (!entry) {
-      continue;
-    }
-    for (const key of WIRE_ONLY_PROFILE_KEYS) {
-      delete entry[key];
-    }
-  }
-}
-
 /**
  * Normalize managed default-profile entries in a config-write fragment, in
  * place, so a `config get` → write round-trip of the enriched wire view is a
@@ -1093,33 +754,39 @@ function stripWireOnlyProfileKeys(patch: unknown): void {
  *   shadowed or given content. A clean echo reduces to a no-op
  *   `{source: "managed"}` stub.
  *
- * Entries are mutated (never replaced) so the normalization also reaches
- * `handleSetConfig`'s `raw` write, which shares object references with the
- * inspected patch shape.
+ * The llm slice is parsed through {@link RawLlmWriteSliceSchema} and the
+ * normalized slice written back — a zod parse copies, so the write-back (not
+ * shared references) is what carries the normalization to the caller's patch.
+ * `handleSetConfig` reads the written-back shape for entry-level SETs.
  */
-export function normalizeManagedProfileWrites(patch: unknown): void {
-  const root = readPlainObject(patch);
-  const llm = readPlainObject(root?.llm);
-  const profiles = readPlainObject(llm?.profiles);
-  if (!profiles) {
+export function normalizeCloudProfileWrites(
+  patch: Record<string, unknown>,
+): void {
+  const llm = RawLlmWriteSliceSchema.safeParse(patch.llm);
+  if (!llm.success || !llm.data.profiles) {
     return;
   }
+  const profiles = llm.data.profiles;
 
-  const currentProfiles = readPlainObject(
-    readPlainObject(loadRawConfig().llm)?.profiles,
-  ) as Record<string, ProfileEntry> | undefined;
+  const currentLlm = RawLlmWriteSliceSchema.safeParse(loadRawConfig().llm);
+  const typedCurrent = currentLlm.success
+    ? LLMSchema.shape.profiles.safeParse(currentLlm.data.profiles)
+    : undefined;
+  const currentProfiles: Record<string, unknown> | undefined =
+    typedCurrent?.success ? typedCurrent.data : undefined;
 
   for (const name of Object.keys(profiles)) {
     if (!MANAGED_PROFILE_NAMES.has(name)) {
       continue;
     }
-    const entry = readPlainObject(profiles[name]);
-    if (!entry) {
+    const entry = RawProfileEntrySchema.safeParse(profiles[name]);
+    if (!entry.success) {
       continue;
     }
 
-    const current = readPlainObject(currentProfiles?.[name]);
-    if (current && current.source !== "managed") {
+    const current = RawProfileEntrySchema.safeParse(currentProfiles?.[name]);
+
+    if (current.success && current.data.source !== "managed") {
       // Legacy user-owned shadow: fully editable, normal custom-profile rules.
       continue;
     }
@@ -1127,26 +794,27 @@ export function normalizeManagedProfileWrites(patch: unknown): void {
     // Must resolve through the same provider column as
     // `overlayEffectiveProfilesForWire`, or an echo of the wire view would
     // not match `effective` and an honest round-trip would be rejected.
-    const effective = readPlainObject(
-      resolveDefaultProfileForProvider(
-        currentProfiles,
-        name,
-        getConfig().llm.default,
-      ),
+    const resolved = resolveDefaultProfileForProvider(
+      typedCurrent?.success ? typedCurrent.data : undefined,
+      name,
+      getConfig().llm.default,
     );
-    for (const key of Object.keys(entry)) {
+    const effective: Record<string, unknown> | undefined = resolved
+      ? { ...resolved }
+      : undefined;
+    for (const key of Object.keys(entry.data)) {
       if (key === "source" || key === "status") {
         continue;
       }
       const matchesEffective =
         effective != null &&
         key in effective &&
-        isDeepStrictEqual(entry[key], effective[key]);
-      if (current == null || !(key in current)) {
+        isDeepStrictEqual(entry.data[key], effective[key]);
+      if (!current.success || !(key in current.data)) {
         // Not on disk: a value matching the wire view is a client echo of
         // catalog content — drop it. Anything else stays for the guard.
         if (matchesEffective) {
-          delete entry[key];
+          delete entry.data[key];
         }
         continue;
       }
@@ -1156,93 +824,101 @@ export function normalizeManagedProfileWrites(patch: unknown): void {
       // from disk is pinned back to the on-disk value (no change for the
       // guard to reject); everything else is left for the guard's
       // frozen-field comparison.
-      if (matchesEffective && !isDeepStrictEqual(entry[key], current[key])) {
-        entry[key] = current[key];
+      if (
+        matchesEffective &&
+        !isDeepStrictEqual(entry.data[key], current.data[key])
+      ) {
+        entry.data[key] = current.data[key];
       }
     }
 
-    if (current) {
+    if (current.success) {
       // Existing stub: the guard compares the merged result against it and
       // rejects everything but the status re-enable.
-      if (entry.source === undefined) {
-        entry.source = "managed";
+      if (entry.data.source === undefined) {
+        entry.data.source = "managed";
       }
+      profiles[name] = entry.data;
       continue;
     }
 
     // No on-disk entry: the name is catalog-owned. Nothing but a clean echo
-    // (which reduced to source/status above) may pass.
-    if ("source" in entry && entry.source !== "managed") {
+    // (which reduced to source/status above) may pass. The wire-only flags
+    // ride echoes too — the write path's schema parse strips them before
+    // anything persists.
+    if ("source" in entry.data && entry.data.source !== "managed") {
       throw new BadRequestError(
         `Cannot create profile "${name}" — the name is reserved for a code-defined default profile.`,
       );
     }
     if (
-      "status" in entry &&
-      entry.status != null &&
-      entry.status !== "active"
+      "status" in entry.data &&
+      entry.data.status != null &&
+      entry.data.status !== "active"
     ) {
-      throw new BadRequestError(`Cannot disable managed profile "${name}".`);
+      throw new BadRequestError(`Cannot disable cloud profile "${name}".`);
     }
-    const residual = Object.keys(entry).filter(
-      (key) => key !== "source" && key !== "status",
+    const residual = Object.keys(entry.data).filter(
+      (key) =>
+        key !== "source" &&
+        key !== "status" &&
+        key !== "invariant" &&
+        key !== "supportsVision",
     );
     if (residual.length > 0) {
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}" fields [${residual.join(", ")}]. ` +
-          `Managed profiles are read-only; duplicate to a custom profile to customize.`,
+        `Cannot edit cloud profile "${name}" fields [${residual.join(", ")}]. ` +
+          `Cloud profiles are read-only; duplicate to a custom profile to customize.`,
       );
     }
-    entry.source = "managed";
+    entry.data.source = "managed";
+    profiles[name] = entry.data;
   }
+
+  patch.llm = llm.data;
 }
 
 /**
- * Annotate each profile in `config.llm.profiles` with wire-only flags
- * (`WIRE_ONLY_PROFILE_KEYS`) — never persisted to disk:
+ * The enriched profile shape clients consume: {@link ProfileEntry} plus the
+ * wire-only flags `enrichProfilesForWire` stamps onto config-read responses.
+ * The flags are deliberately absent from `ProfileEntry` — the persisted
+ * schema — so a config write's schema parse strips echoed copies instead of
+ * persisting them.
+ */
+type WireProfileEntry = ProfileEntry & {
+  invariant?: boolean;
+  supportsVision?: boolean;
+};
+
+/**
+ * Annotate each profile in `config.llm.profiles` with wire-only flags —
+ * never persisted to disk:
  *
  * - `supportsVision`: resolved from the model catalog, with a profile
  *   `inputModalities.image` override winning when set. Unknown (provider,
  *   model) pairs with no override default to `true` (fail-open) so image
  *   upload remains available for custom / unlisted models.
- * - `invariant`: `true` for managed-source entries of the managed profile
+ * - `invariant`: `true` for managed-source entries of the cloud profile
  *   names (`INVARIANT_PROFILE_NAMES`); absent otherwise. Source-gated to
  *   match `assertInvariantProfilesPreserved` — a user-owned profile sharing
- *   a managed name is fully editable, so it must render as a normal custom
+ *   a cloud name is fully editable, so it must render as a normal custom
  *   profile.
  */
-function enrichProfilesForWire(config: unknown): void {
-  const root = readPlainObject(config);
-  if (!root) {
-    return;
-  }
-  const llm = readPlainObject(root.llm);
-  if (!llm) {
-    return;
-  }
-  const profiles = readPlainObject(llm.profiles);
-  if (!profiles) {
-    return;
-  }
-
-  for (const [name, profile] of Object.entries(profiles)) {
-    const entry = readPlainObject(profile);
-    if (!entry) {
-      continue;
-    }
+function enrichProfilesForWire(config: AssistantConfig): void {
+  const profiles: Record<string, WireProfileEntry> = config.llm.profiles;
+  for (const [name, entry] of Object.entries(profiles)) {
     if (INVARIANT_PROFILE_NAMES.has(name) && entry.source === "managed") {
       entry.invariant = true;
     }
-    const provider = entry.provider;
-    const model = entry.model;
-    if (typeof provider !== "string" || typeof model !== "string") {
+
+    if (entry.provider == null || entry.model == null) {
       continue;
     }
 
-    const catalogModel = catalogEntryFor(provider, model);
+    const catalogModel = catalogEntryFor(entry.provider, entry.model);
     const catalogVision = catalogModel?.supportsVision;
     const imageOverride = modalitiesOf({
-      inputModalities: entry.inputModalities as InputModalities | null,
+      inputModalities: entry.inputModalities,
     })?.image;
     entry.supportsVision =
       resolveModalityOverride(imageOverride, catalogVision) ?? true;
@@ -1281,44 +957,47 @@ function handleGetConfigSchema({ queryParams = {} }: RouteHandlerArgs) {
   };
 }
 
-export function rejectManagedProfileDeletion(
+export function rejectCloudProfileDeletion(
   body: Record<string, unknown>,
 ): void {
-  const llm = asMutablePlainObject(body.llm);
-  if (!llm) {
+  const llm = RawLlmWriteSliceSchema.safeParse(body.llm);
+  if (!llm.success) {
     return;
   }
-  if ("profiles" in llm && llm.profiles === null) {
+  if (llm.data.profiles === null) {
     throw new BadRequestError(
-      "Cannot null llm.profiles — managed profiles would be deleted.",
+      "Cannot null llm.profiles — cloud profiles would be deleted.",
     );
   }
-  const profiles = asMutablePlainObject(llm.profiles);
+  const profiles = llm.data.profiles;
   if (!profiles) {
     return;
   }
-  const existingProfiles = asMutablePlainObject(getConfig().llm.profiles) ?? {};
+  const existingLlm = RawLlmWriteSliceSchema.safeParse(getConfig().llm);
+  const existingProfiles = existingLlm.success
+    ? (existingLlm.data.profiles ?? {})
+    : {};
   for (const name of Object.keys(profiles)) {
     if (profiles[name] !== null || !MANAGED_PROFILE_NAMES.has(name)) {
       continue;
     }
-    // Only block deletion when the on-disk entry is Cadet-managed. A
-    // user-owned profile sharing a managed name carries a non-managed `source`
+    // Only block deletion when the on-disk entry is Cadet Cloud. A
+    // user-owned profile sharing a cloud name carries a non-managed `source`
     // and is freely deletable.
-    const existing = asMutablePlainObject(existingProfiles[name]);
-    if (existing?.source === "managed") {
-      throw new BadRequestError(`Cannot delete managed profile "${name}".`);
+    const existing = RawProfileEntrySchema.safeParse(existingProfiles[name]);
+    if (existing.success && existing.data.source === "managed") {
+      throw new BadRequestError(`Cannot delete cloud profile "${name}".`);
     }
   }
 }
 
 /**
- * Enforce the managed-profile invariants at the config-write choke point.
+ * Enforce the cloud-profile invariants at the config-write choke point.
  *
  * Protects the thin managed stubs (`INVARIANT_PROFILE_NAMES`) that live in
  * workspace config. Default profile CONTENT is code-owned and only exists on
  * the wire, so the guard's job is the stub itself: it checks entries present
- * in the OLD config, and `normalizeManagedProfileWrites` reduces incoming
+ * in the OLD config, and `normalizeCloudProfileWrites` reduces incoming
  * managed entries to the workspace-owned fields before this comparison runs.
  *
  * Invariance is gated on managed ownership: a name is enforced only when the
@@ -1327,7 +1006,7 @@ export function rejectManagedProfileDeletion(
  * is real and supported, because the flag-gated reconcile refuses to
  * overwrite a same-named user profile.
  *
- * For each invariant name where the OLD raw config carries a managed-source
+ * For each invariant name where the OLD raw config carries a cloud-source
  * plain-object entry at `llm.profiles[name]`:
  *
  * - The NEW raw config must still carry a plain-object entry at the same
@@ -1338,11 +1017,11 @@ export function rejectManagedProfileDeletion(
  *   profile can never be disabled; a changed `status` must be `"active"`,
  *   `null`, or absent — re-enabling a disabled profile. Any other value is
  *   rejected.
- * - Wire-only keys (`WIRE_ONLY_PROFILE_KEYS`) are ignored on both sides:
- *   incoming writes have them stripped, but configs persisted before the
- *   strip existed may still carry them on disk, and treating that stale key
- *   as a removed field would reject every round-trip write until reboot
- *   reseeds the profile.
+ * - The wire-only flags (`invariant`, `supportsVision`) are ignored on both
+ *   sides: the write path's schema parse strips them from incoming writes,
+ *   but configs persisted before that was true may still carry them on
+ *   disk, and treating that stale key as a removed field would reject every
+ *   round-trip write until reboot reseeds the profile.
  * - Every other field is frozen: any changed, added, or removed key across
  *   the union of both entries' keys (except `status` and the wire-only keys)
  *   is rejected. A pre-existing on-disk override (e.g. `topP`) is preserved
@@ -1376,17 +1055,17 @@ function assertInvariantProfilesPreserved(
       : null;
     if (!newEntry) {
       throw new BadRequestError(
-        `Cannot delete or replace managed profile "${name}". Managed profiles are read-only.`,
+        `Cannot delete or replace cloud profile "${name}". Cloud profiles are read-only.`,
       );
     }
 
     if (!isDeepStrictEqual(oldEntry.status, newEntry.status)) {
       if (newEntry.status === "disabled") {
-        throw new BadRequestError(`Cannot disable managed profile "${name}".`);
+        throw new BadRequestError(`Cannot disable cloud profile "${name}".`);
       }
       if (newEntry.status !== "active" && newEntry.status != null) {
         throw new BadRequestError(
-          `Cannot set status ${JSON.stringify(newEntry.status)} on managed profile "${name}". ` +
+          `Cannot set status ${JSON.stringify(newEntry.status)} on cloud profile "${name}". ` +
             `Only re-enabling (status "active") is allowed.`,
         );
       }
@@ -1397,13 +1076,14 @@ function assertInvariantProfilesPreserved(
     ].filter(
       (key) =>
         key !== "status" &&
-        !WIRE_ONLY_PROFILE_KEYS.has(key) &&
+        key !== "invariant" &&
+        key !== "supportsVision" &&
         !isDeepStrictEqual(oldEntry[key], newEntry[key]),
     );
     if (changedKeys.length > 0) {
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}" fields [${changedKeys.join(", ")}]. ` +
-          `Managed profiles are read-only; duplicate to a custom profile to customize.`,
+        `Cannot edit cloud profile "${name}" fields [${changedKeys.join(", ")}]. ` +
+          `Cloud profiles are read-only; duplicate to a custom profile to customize.`,
       );
     }
   }
@@ -1422,17 +1102,17 @@ function completeChangedCustomProfiles(
   preWrite: Record<string, unknown>,
   raw: Record<string, unknown>,
 ): void {
-  const profiles = asMutablePlainObject(readPlainObject(raw.llm)?.profiles);
-  if (!profiles) {
+  const llm = RawLlmWriteSliceSchema.safeParse(raw.llm);
+  if (!llm.success || !llm.data.profiles) {
     return;
   }
-  const parsedDefault = LLMConfigBase.safeParse(
-    readPlainObject(raw.llm)?.default ?? {},
-  );
+  const profiles = llm.data.profiles;
+  const parsedDefault = LLMConfigBase.safeParse(llm.data.default ?? {});
   if (!parsedDefault.success) {
     return;
   }
-  const prior = readPlainObject(readPlainObject(preWrite.llm)?.profiles) ?? {};
+  const priorLlm = RawLlmWriteSliceSchema.safeParse(preWrite.llm);
+  const prior = priorLlm.success ? (priorLlm.data.profiles ?? {}) : {};
   for (const [name, entry] of Object.entries(profiles)) {
     if (isDeepStrictEqual(entry, prior[name])) {
       continue;
@@ -1452,14 +1132,20 @@ function completeChangedCustomProfiles(
     // depth: `safeParse` strips keys the schema doesn't know (top-level and
     // inside nested objects like `contextWindow`), and dropping them here
     // would delete forward-compatible fields whenever the entry is edited.
+    const entryRecord = RawProfileEntrySchema.safeParse(entry);
+    if (!entryRecord.success) {
+      continue;
+    }
     profiles[name] = mergePreservingUnknownKeys(
-      readPlainObject(entry) ?? {},
+      entryRecord.data,
       completeCustomProfile(parsedDefault.data, entryData) as Record<
         string,
         unknown
       >,
     );
   }
+  // A zod parse copies — write the completed slice back so `raw` carries it.
+  raw.llm = llm.data;
 }
 
 /**
@@ -1559,19 +1245,58 @@ function assertRoutableIdentityEntries(
  * `null`.
  */
 function assertCodeOwnedFallbackProfiles(raw: Record<string, unknown>): void {
-  const llm = readPlainObject(raw.llm);
-  const profiles = readPlainObject(llm?.profiles);
-  // The sibling `llm.default` decides whether the managed backups are valid
-  // fallback targets: they resolve on the managed column alone.
+  const llm = RawLlmWriteSliceSchema.safeParse(raw.llm);
+  if (!llm.success) {
+    return;
+  }
+  // The sibling `llm.default` decides whether the cloud backups are valid
+  // fallback targets: they resolve on the cloud column alone.
   const issues = collectFallbackProfileIssues(
-    profiles ?? undefined,
-    llm?.default,
+    llm.data.profiles ?? undefined,
+    llm.data.default,
   );
   if (issues.length > 0) {
     throw new BadRequestError(issues.map((issue) => issue.message).join(" "));
   }
 }
 
+/**
+ * Stamp the managed marker onto `llm.profiles` entries of catalog-owned
+ * names that a write created without a `source` — a source-less entry reads
+ * as a user shadow that blocks the catalog body. A user-owned entry sharing
+ * the name (a legacy shadow) keeps its source, so its edits stay fully
+ * user-owned.
+ */
+function stampManagedProfileEntries(
+  preWrite: Record<string, unknown>,
+  raw: Record<string, unknown>,
+): void {
+  const newLlm = RawLlmWriteSliceSchema.safeParse(raw.llm);
+  if (!newLlm.success || !newLlm.data.profiles) {
+    return;
+  }
+  const oldLlm = RawLlmWriteSliceSchema.safeParse(preWrite.llm);
+  let stamped = false;
+  for (const name of MANAGED_PROFILE_NAMES) {
+    const written = RawProfileEntrySchema.safeParse(newLlm.data.profiles[name]);
+    if (!written.success || written.data.source !== undefined) {
+      continue;
+    }
+    const prior = RawProfileEntrySchema.safeParse(
+      oldLlm.success ? oldLlm.data.profiles?.[name] : undefined,
+    );
+    if (prior.success && prior.data.source !== "managed") {
+      continue;
+    }
+    written.data.source = "managed";
+    newLlm.data.profiles[name] = written.data;
+    stamped = true;
+  }
+  if (stamped) {
+    raw.llm = newLlm.data;
+  }
+}
+
 export async function commitConfigWrite(
   raw: Record<string, unknown>,
   opLabel: string,
@@ -1581,10 +1306,14 @@ export async function commitConfigWrite(
   // false diffs. Runs before the watcher-suppress/save sequence so a
   // rejection needs no suppress-flag or cache cleanup.
   const preWrite = loadRawConfig();
+  // Direct callers (the profile routes) skip `handleSetConfig`'s full-schema
+  // parse — this keeps a chat-settings write's invalid values from reaching
+  // disk, while untouched legacy values ride (their issues filter out).
   const chatSettings = validateChatSettingsWrite(preWrite, raw);
   if (!chatSettings.success) {
     throw new BadRequestError(chatSettings.error.message);
   }
+  stampManagedProfileEntries(preWrite, raw);
   completeChangedCustomProfiles(preWrite, raw);
   assertInvariantProfilesPreserved(preWrite, raw);
   assertRoutableIdentityEntries(preWrite, raw);
@@ -1639,95 +1368,66 @@ export async function commitConfigWrite(
   publishConfigChanged();
 }
 
-/**
- * Web clients pair provider writes with a legacy `mode` key so their saves
- * stay valid on daemons whose schemas still carry it. The provider-only
- * services (web-search, image-generation) parse-strip that key, but the
- * deep-merge would still persist it to raw config.json on every save —
- * scrub it so the removed field cannot be resurrected on disk.
- */
-function scrubRemovedServiceModes(raw: Record<string, unknown>): void {
-  const services = raw.services as
-    | Record<string, Record<string, unknown> | undefined>
-    | undefined;
-  if (!services) {
-    return;
-  }
-  for (const key of ["web-search", "image-generation"]) {
-    const entry = services[key];
-    if (entry && typeof entry === "object" && "mode" in entry) {
-      delete entry.mode;
-    }
-  }
-}
-
-/**
- * A persisted `services.stt` block must satisfy SttServiceSchema, whose
- * `provider` is required. The services-level default fills the provider only
- * when `services.stt` is wholly absent, so a sparse patch like
- * `{ services: { stt: { language } } }` deep-merged into a config with no
- * stt block persists a provider-less block that fails validation and trips
- * the loader's salvage ladder: the patched value never applies and the whole
- * `services` section can reset to defaults on the next load (the LUM-2758
- * failure family). Seed the effective provider into any stt block that lacks
- * a non-empty string one so every config_patch writer stays self-consistent.
- * The seed applies to any stt key, not just language: the schema requires
- * the provider whenever the block exists. A block carrying a non-empty
- * string provider is left alone, even an invalid one, so an explicit
- * provider write is never silently rewritten.
- */
-function seedSttProviderForSparseBlock(raw: Record<string, unknown>): void {
-  const services = readPlainObject(raw.services);
-  const stt = readPlainObject(services?.stt);
-  if (!stt) {
-    return;
-  }
-  const provider = stt.provider;
-  if (typeof provider === "string" && provider.trim().length > 0) {
-    return;
-  }
-  stt.provider = getConfig().services.stt.provider;
-}
-
 async function handlePatchConfig({ body }: RouteHandlerArgs) {
-  if (
-    !body ||
-    typeof body !== "object" ||
-    Array.isArray(body) ||
-    Object.keys(body).length === 0
-  ) {
+  const patch = JsonRecordSchema.safeParse(body);
+  if (!patch.success || Object.keys(patch.data).length === 0) {
     throw new BadRequestError("Body must be a non-empty JSON object");
   }
-  const chatSettings = ChatSettingsPatchSchema.safeParse(body);
-  if (!chatSettings.success) {
-    throw new BadRequestError(chatSettings.error.message);
-  }
-  stripWireOnlyProfileKeys(body);
-  normalizeManagedProfileWrites(body);
-  rejectManagedProfileDeletion(body as Record<string, unknown>);
-  rejectMcpTransportHeaderWrite(body);
-  stripMcpFromConfigWrite(body as Record<string, unknown>);
-
-  const raw = loadRawConfig();
-  const patch = body as Record<string, unknown>;
-  const patchedIngressUrl = readPlainObject(patch.ingress)?.publicBaseUrl;
+  // Managed-profile normalization runs on the fragment before it merges:
+  // an honest `config get` → PATCH round-trip reduces to a no-op, and a
+  // genuine edit reaches the invariant guard's precise rejections.
+  normalizeCloudProfileWrites(patch.data);
+  rejectCloudProfileDeletion(patch.data);
+
+  // A patch is partial: merge it onto the current config so the schema
+  // parse in `handleSetConfig` always sees a complete config — untouched
+  // values ride, sparse fragments are completed by the merge base.
+  const merged: AssistantConfig = structuredClone(getConfig());
+  const ingress = z
+    .object({ publicBaseUrl: z.unknown().optional() })
+    .passthrough()
+    .safeParse(patch.data.ingress);
+  const patchedIngressUrl = ingress.success
+    ? ingress.data.publicBaseUrl
+    : undefined;
   if (patchedIngressUrl !== undefined) {
-    dropTunnelRecordsForNewUrl(readPlainObject(raw.ingress), patchedIngressUrl);
+    dropTunnelRecordsForNewUrl(merged.ingress, patchedIngressUrl);
   }
-  deepMergeOverwrite(raw, patch);
-  scrubRemovedServiceModes(raw);
-  scrubNulledAcpAgentLeaves(raw);
-  scrubNulledChatSettings(raw, patch);
-  seedSttProviderForSparseBlock(raw);
+  deepMergeOverwrite(merged, patch.data);
+  scrubNulledAcpAgentLeaves(merged);
+  scrubNulledChatSettings(merged, patch.data);
 
-  await commitConfigWrite(raw, "patch");
+  await handleSetConfig(merged);
 
   return handleGetConfig();
 }
 
 /**
- * Direct path assignment - replaces `config_patch` for the `assistant
- * config set <key> <value>` CLI path.
+ * The one config write: validate the merged config through
+ * `AssistantConfigSchema`, and either reject with `BadRequestError` or save.
+ * `handlePatchConfig` merges the patch with `getConfig()` first;
+ * `handleSetConfigByKey` replaces one path first. Everything the schema
+ * accepts is what lands on disk.
+ */
+async function handleSetConfig(merged: AssistantConfig): Promise<void> {
+  const parsed = AssistantConfigSchema.safeParse(merged);
+  if (!parsed.success) {
+    throw new BadRequestError(
+      parsed.error.issues
+        .map((issue) =>
+          issue.path.length > 0
+            ? `${issue.path.join(".")}: ${issue.message}`
+            : issue.message,
+        )
+        .join("; "),
+    );
+  }
+  await commitConfigWrite(parsed.data, "save");
+}
+
+/**
+ * Direct path assignment - the `assistant config set <key> <value>` CLI
+ * contract.
  *
  * `config_patch` uses `deepMergeOverwrite` semantics, which strips `null`
  * leaves when the target subtree doesn't exist and merges (rather than
@@ -1737,17 +1437,18 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
  *   - `set heartbeat.activeHoursStart null` to persist explicit `null`
  *   - `set llm {}` to replace `llm`, not merge into it
  *
- * `config_set` performs `setNestedValue` directly on the loaded raw config
- * (no merge), then runs the same post-write side effects as patch.
+ * `config_set` performs `setNestedValue` directly on the current config
+ * (no merge), then funnels into the same schema-validated
+ * {@link handleSetConfig} write.
  */
-async function handleSetConfig({ body }: RouteHandlerArgs) {
-  if (!body || typeof body !== "object" || Array.isArray(body)) {
+async function handleSetConfigByKey({ body }: RouteHandlerArgs) {
+  const parsedBody = JsonRecordSchema.safeParse(body);
+  if (!parsedBody.success) {
     throw new BadRequestError(
       "Body must be a JSON object with `path` and `value`",
     );
   }
-  const bodyRecord = body as Record<string, unknown>;
-  const { path, value } = bodyRecord as { path?: unknown; value?: unknown };
+  const path = parsedBody.data.path;
   if (typeof path !== "string" || path.length === 0) {
     throw new BadRequestError("`path` must be a non-empty string");
   }
@@ -1755,85 +1456,62 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
   // this check, `undefined` flows into `setNestedValue` and gets dropped by
   // `JSON.stringify` at save time, silently removing the key - which is
   // distinct from the documented "set to null" semantics.
-  if (!("value" in bodyRecord)) {
+  if (!Object.hasOwn(parsedBody.data, "value")) {
     throw new BadRequestError(
       "`value` is required (use `null` to clear a key)",
     );
   }
-  // A leaf-path SET targeting a wire-only profile key is dropped without
-  // writing — the same treatment PATCH gives wire-only keys embedded in a
-  // profile fragment.
-  const pathSegments = path.split(".");
-  if (
-    pathSegments[0] === "llm" &&
-    pathSegments[1] === "profiles" &&
-    pathSegments.length >= 4 &&
-    WIRE_ONLY_PROFILE_KEYS.has(pathSegments[3]!)
-  ) {
-    return { ok: true };
-  }
-  // Build the equivalent patch shape so the managed-profile guard can
-  // inspect the touched subtree. `setNestedValue` places `value` into
-  // `patchShape` by reference, so stripping wire-only profile keys here
-  // also strips the object written to `raw` below.
-  const patchShape: Record<string, unknown> = {};
-  setNestedValue(patchShape, path, value);
-  stripWireOnlyProfileKeys(patchShape);
-  normalizeManagedProfileWrites(patchShape);
-  rejectManagedProfileDeletion(patchShape);
-  rejectMcpConfigSetPath(path, value);
-  rejectMcpTransportHeaderWrite(patchShape);
+  const value = parsedBody.data.value;
 
-  const raw = loadRawConfig();
-  // A SET below the entry level (`llm.profiles.<name>.<leaf>`) writes the
-  // primitive leaf directly into `raw`, bypassing the by-reference
-  // normalization above — creating an entry for a managed-owned name would
-  // leave it source-less, and a source-less entry reads as a user shadow
-  // that blocks the catalog body. Stamp the managed marker onto the written
-  // entry when the name was absent or managed-owned before this write.
-  const managedEntryName =
-    pathSegments[0] === "llm" &&
-    pathSegments[1] === "profiles" &&
-    pathSegments.length >= 3 &&
-    MANAGED_PROFILE_NAMES.has(pathSegments[2]!)
-      ? pathSegments[2]!
-      : undefined;
-  const priorManagedEntry = managedEntryName
-    ? readPlainObject(
-        readPlainObject(readPlainObject(raw.llm)?.profiles)?.[managedEntryName],
-      )
-    : undefined;
+  const merged: AssistantConfig = structuredClone(getConfig());
   // `assistant config set ingress.publicBaseUrl <url>`, what the webhook
   // diagnostics tell users to run, retargets ingress like the settings route.
   if (path === "ingress.publicBaseUrl") {
-    dropTunnelRecordsForNewUrl(readPlainObject(raw.ingress), value);
-  }
-  setNestedValue(raw, path, value);
-  if (
-    managedEntryName &&
-    (priorManagedEntry == null || priorManagedEntry.source === "managed")
-  ) {
-    const written = readPlainObject(
-      readPlainObject(readPlainObject(raw.llm)?.profiles)?.[managedEntryName],
-    );
-    if (written && written.source === undefined) {
-      written.source = "managed";
+    dropTunnelRecordsForNewUrl(merged.ingress, value);
+  }
+  // Any llm-touching SET rides the same normalization the profile routes
+  // use: `normalizeCloudProfileWrites` reduces an echo of the wire view to
+  // the workspace-owned stub and rejects genuine edits to managed entries.
+  // Its normalization lives in the parsed llm slice (a zod parse copies), so
+  // the written value below is the normalized slice/entry — and a leaf write
+  // below the entry level rides raw; the ladder stamps the managed marker
+  // onto an entry the write creates.
+  const pathSegments = path.split(".");
+  let writtenValue: unknown = value;
+  if (pathSegments[0] === "llm") {
+    const patchShape: Record<string, unknown> = {};
+    setNestedValue(patchShape, path, value);
+    normalizeCloudProfileWrites(patchShape);
+    rejectCloudProfileDeletion(patchShape);
+    const patchLlm = RawLlmWriteSliceSchema.safeParse(patchShape.llm);
+    if (patchLlm.success) {
+      if (pathSegments.length === 1) {
+        writtenValue = patchLlm.data;
+      } else if (pathSegments[1] === "profiles") {
+        if (pathSegments.length === 2) {
+          if (patchLlm.data.profiles) {
+            writtenValue = patchLlm.data.profiles;
+          }
+        } else if (pathSegments.length === 3) {
+          const normalized = patchLlm.data.profiles?.[pathSegments[2]!];
+          if (normalized !== undefined) {
+            writtenValue = normalized;
+          }
+        }
+      }
     }
   }
-  scrubNulledAcpAgentLeaves(raw);
-  // A SET can create `services.stt` with a leaf like `language` and no
-  // `provider`, which SttServiceSchema requires whenever the block exists;
-  // the same seeding that guards PATCH keeps this write's persisted block
-  // schema-valid.
-  seedSttProviderForSparseBlock(raw);
+  setNestedValue(merged, path, writtenValue);
+  scrubNulledAcpAgentLeaves(merged);
+
+  await handleSetConfig(merged);
 
-  await commitConfigWrite(raw, "set");
   // A `memory.v2` substrate tunable whose `memory.substrate` twin is set does
   // not mean what an unpaired write means: the substrate namespace wins in
   // `resolveSubstrateTuning`, and for the three twins the v2 injection engine
   // reads directly the two namespaces diverge instead. Report which case this
   // is alongside the success so the caller can tell the operator.
-  const shadowing = findSubstrateShadowing(raw, path);
+  const shadowing = findSubstrateShadowing(path);
   if (shadowing) {
     const warning = describeShadowedConfigSet(shadowing, path);
     log.warn({ path, substratePath: shadowing.substratePath }, warning);
@@ -1890,12 +1568,12 @@ async function handleReplaceInferenceProfile({
     throw new BadRequestError(`Invalid profile fragment: ${detail}`);
   }
   // A managed name with no existing entry stays protected so users can't
-  // shadow a seeded managed profile. An existing entry carrying a non-managed
+  // shadow a seeded cloud profile. An existing entry carrying a non-managed
   // `source` is user-owned and remains fully editable.
   const existingProfile = asMutablePlainObject(
     getConfig().llm.profiles?.[name],
   );
-  const isManaged =
+  const isCloud =
     MANAGED_PROFILE_NAMES.has(name) &&
     (existingProfile == null || existingProfile.source === "managed");
   if (CODE_OWNED_PROFILE_NAMES.has(name)) {
@@ -1924,11 +1602,11 @@ async function handleReplaceInferenceProfile({
       `Profile "${name}" is not currently available and cannot be edited.`,
     );
   }
-  if (isManaged) {
-    // Managed profiles are daemon-seeded and read-only — the commit guard
+  if (isCloud) {
+    // Cloud profiles are daemon-seeded and read-only — the commit guard
     // (`assertInvariantProfilesPreserved`) rejects every write to them
     // except re-enabling a disabled profile. Enforce the same contract up
-    // front: the only body a managed PUT accepts is a pure status re-enable
+    // front: the only body a cloud PUT accepts is a pure status re-enable
     // (`{status: "active"}`, or `{status: null}` to clear back to
     // active-by-absence). Rejecting here keeps the error message ahead of
     // any side effects and mirrors the guard's wording.
@@ -1942,8 +1620,8 @@ async function handleReplaceInferenceProfile({
       const detail =
         disallowed.length > 0 ? ` fields [${disallowed.join(", ")}]` : "";
       throw new BadRequestError(
-        `Cannot edit managed profile "${name}"${detail}. ` +
-          `Managed profiles are read-only (a disabled profile can be re-enabled); ` +
+        `Cannot edit cloud profile "${name}"${detail}. ` +
+          `Cloud profiles are read-only (a disabled profile can be re-enabled); ` +
           `duplicate to a custom profile to customize.`,
       );
     }
@@ -2046,10 +1724,10 @@ async function handleReplaceInferenceProfile({
 
   // When the UI sends provider but no provider_connection, derive the connection
   // now so the config deep-merge doesn't inherit a stale connection from the
-  // default layer. Managed entries are excluded: the managed gate above
+  // default layer. Managed entries are excluded: the cloud gate above
   // already rejected any provider-carrying fragment, so their only surviving
   // body is a status re-enable, which derives no connection. A user-owned
-  // profile sharing a managed name is fully editable, so it takes the
+  // profile sharing a cloud name is fully editable, so it takes the
   // derivation like any other custom profile.
   const fragment = parsed.data as Record<string, unknown>;
   // Routing identities resolve their connection per-request from the
@@ -2057,7 +1735,7 @@ async function handleReplaceInferenceProfile({
   // ("cadet" is its stored provider) or create a junk "<identity>-personal"
   // connection for chatgpt.
   if (
-    !isManaged &&
+    !isCloud &&
     fragment.provider &&
     !fragment.provider_connection &&
     !ROUTING_IDENTITY_PROVIDERS.has(fragment.provider as string)
@@ -2074,12 +1752,12 @@ async function handleReplaceInferenceProfile({
     if (active) {
       fragment.provider_connection = active.name;
     } else if (
-      MANAGED_ROUTABLE_PROVIDERS.has(provider) &&
-      getConnection(db, CADET_MANAGED_CONNECTION_NAME)
+      CLOUD_ROUTABLE_PROVIDERS.has(provider) &&
+      getConnection(db, CADET_CLOUD_CONNECTION_NAME)
     ) {
-      // Managed-routable providers are served by the single Cadet-managed
+      // Managed-routable providers are served by the single Cadet Cloud
       // connection; prefer it over lazily creating a personal connection.
-      fragment.provider_connection = CADET_MANAGED_CONNECTION_NAME;
+      fragment.provider_connection = CADET_CLOUD_CONNECTION_NAME;
     } else if (!PROVIDERS_REQUIRING_BASE_URL_AND_MODELS.has(provider)) {
       const connectionName = `${provider}-personal`;
       const isKeyless = provider === "ollama";
@@ -2100,13 +1778,13 @@ async function handleReplaceInferenceProfile({
   }
 
   const raw = loadRawConfig();
-  if (isManaged) {
+  if (isCloud) {
     // Partial overlay: keep every existing key intact, only apply the status
-    // re-enable (the sole body the managed gate above admits). Using
+    // re-enable (the sole body the cloud gate above admits). Using
     // `replaceInferenceProfileConfig` here would wipe the seed-owned fields
     // (provider, model, advanced params) because that function assumes the
     // body carries the full UI surface.
-    applyManagedProfileReenable(raw, name, fragment.status as "active" | null);
+    applyCloudProfileReenable(raw, name, fragment.status as "active" | null);
   } else {
     replaceInferenceProfileConfig(raw, name, fragment);
   }
@@ -2115,7 +1793,7 @@ async function handleReplaceInferenceProfile({
   // `handleSetConfig`: file-watcher suppression so the in-process reload
   // doesn't race the explicit reinit, embedding backend cache clear,
   // in-process `getConfig` cache invalidation, and provider registry
-  // reinitialization. `status: "disabled"` on a managed profile (and any
+  // reinitialization. `status: "disabled"` on a cloud profile (and any
   // `provider` / `model` / `provider_connection` change on a custom
   // profile) must take effect immediately rather than waiting for the
   // next watcher tick.
@@ -2124,11 +1802,11 @@ async function handleReplaceInferenceProfile({
 }
 
 /**
- * Apply the disabled→active re-enable to a managed profile entry, preserving
+ * Apply the disabled→active re-enable to a cloud profile entry, preserving
  * every other field already on disk (provider, model, advanced params, etc).
  * `status: "active"` sets the key; `null` clears it (active-by-absence).
  */
-function applyManagedProfileReenable(
+function applyCloudProfileReenable(
   raw: Record<string, unknown>,
   name: string,
   status: "active" | null,
@@ -2149,7 +1827,7 @@ function applyManagedProfileReenable(
     ...(asMutablePlainObject(profiles[name]) ?? {}),
   };
   // Only reached for managed-owned names (the route's managed gate), so a
-  // freshly created stub must carry the managed marker the effective view
+  // freshly created stub must carry the cloud marker the effective view
   // and write guards key on.
   nextProfile.source = "managed";
   if (status === null) {
@@ -2548,7 +2226,7 @@ export const ROUTES: RouteDefinition[] = [
       "(preserves explicit null, replaces object subtrees instead of merging). " +
       "Used by the `assistant config set <key> <value>` CLI command.",
     tags: ["config"],
-    handler: handleSetConfig,
+    handler: handleSetConfigByKey,
   },
   {
     operationId: "config_allowlist_validate",