@open-mercato/cezar 0.9.1 → 0.9.2

package/dist/workspace/config.d.ts

@@ -23,234 +23,87 @@ export declare const PROJECT_ID_RE: RegExp;
  * degrade per-key so one bad value never evicts the project.
  */
 declare const workspaceProjectSchema: z.ZodObject<{
-    /** Unique slug — URL segment, sidebar key, worktree namespace. */
     id: z.ZodString;
-    /** Absolute, realpath-normalized repo root (normalization is the writer's
-     *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-    root: z.ZodEffects<z.ZodString, string, string>;
-    /** Display name (basename by default). `''` = caller derives a fallback. */
+    root: z.ZodString;
     name: z.ZodCatch<z.ZodString>;
     addedAt: z.ZodCatch<z.ZodString>;
     lastOpenedAt: z.ZodCatch<z.ZodString>;
-    source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-    /** Per-project cap on concurrently running tasks. Absent = inherit the
-     *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-     *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-     *  default, and `.passthrough()` preserves the key across cezar round-trips. */
+    source: z.ZodCatch<z.ZodEnum<{
+        checkout: "checkout";
+        local: "local";
+    }>>;
     maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    /** Unique slug — URL segment, sidebar key, worktree namespace. */
-    id: z.ZodString;
-    /** Absolute, realpath-normalized repo root (normalization is the writer's
-     *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-    root: z.ZodEffects<z.ZodString, string, string>;
-    /** Display name (basename by default). `''` = caller derives a fallback. */
-    name: z.ZodCatch<z.ZodString>;
-    addedAt: z.ZodCatch<z.ZodString>;
-    lastOpenedAt: z.ZodCatch<z.ZodString>;
-    source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-    /** Per-project cap on concurrently running tasks. Absent = inherit the
-     *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-     *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-     *  default, and `.passthrough()` preserves the key across cezar round-trips. */
-    maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    /** Unique slug — URL segment, sidebar key, worktree namespace. */
-    id: z.ZodString;
-    /** Absolute, realpath-normalized repo root (normalization is the writer's
-     *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-    root: z.ZodEffects<z.ZodString, string, string>;
-    /** Display name (basename by default). `''` = caller derives a fallback. */
-    name: z.ZodCatch<z.ZodString>;
-    addedAt: z.ZodCatch<z.ZodString>;
-    lastOpenedAt: z.ZodCatch<z.ZodString>;
-    source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-    /** Per-project cap on concurrently running tasks. Absent = inherit the
-     *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-     *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-     *  default, and `.passthrough()` preserves the key across cezar round-trips. */
-    maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type WorkspaceProject = z.infer<typeof workspaceProjectSchema>;
 declare const workspaceConfigSchema: z.ZodObject<{
-    /** Migration cursor (src/workspace/migrations.ts). Absent/bad → 0, which
-     *  means "run every migration" — each one is idempotent, so that is safe. */
-    schemaVersion: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    /** Root exposed by the Add project folder browser. Environment supplies
-     *  the zero-config default; an explicit workspace value wins thereafter. */
-    browseRoot: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    /** Checkout root for GUI-cloned projects. Stored as written (a literal
-     *  `~` is expanded by the checkout flow, not here); validated writable
-     *  when *changed*, never at load. */
-    projectsDir: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    resources: z.ZodCatch<z.ZodDefault<z.ZodObject<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    /** Per-entry salvage: a corrupt entry is dropped, the rest of the registry
-     *  survives (a whole-array `.catch([])` would evict every project over one
-     *  bad row). */
-    projects: z.ZodEffects<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown, "many">>>, z.objectOutputType<{
-        /** Unique slug — URL segment, sidebar key, worktree namespace. */
-        id: z.ZodString;
-        /** Absolute, realpath-normalized repo root (normalization is the writer's
-         *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-        root: z.ZodEffects<z.ZodString, string, string>;
-        /** Display name (basename by default). `''` = caller derives a fallback. */
-        name: z.ZodCatch<z.ZodString>;
-        addedAt: z.ZodCatch<z.ZodString>;
-        lastOpenedAt: z.ZodCatch<z.ZodString>;
-        source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-        /** Per-project cap on concurrently running tasks. Absent = inherit the
-         *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-         *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-         *  default, and `.passthrough()` preserves the key across cezar round-trips. */
-        maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">[], unknown>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    /** Migration cursor (src/workspace/migrations.ts). Absent/bad → 0, which
-     *  means "run every migration" — each one is idempotent, so that is safe. */
     schemaVersion: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    /** Root exposed by the Add project folder browser. Environment supplies
-     *  the zero-config default; an explicit workspace value wins thereafter. */
     browseRoot: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    /** Checkout root for GUI-cloned projects. Stored as written (a literal
-     *  `~` is expanded by the checkout flow, not here); validated writable
-     *  when *changed*, never at load. */
     projectsDir: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    resources: z.ZodCatch<z.ZodDefault<z.ZodObject<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
+    skillsAutoUpdate: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    resources: z.ZodCatch<z.ZodPrefault<z.ZodObject<{
         maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
+        maxMonitoringSessions: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
+        monitoringWakeIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
         memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
         worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    /** Per-entry salvage: a corrupt entry is dropped, the rest of the registry
-     *  survives (a whole-array `.catch([])` would evict every project over one
-     *  bad row). */
-    projects: z.ZodEffects<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown, "many">>>, z.objectOutputType<{
-        /** Unique slug — URL segment, sidebar key, worktree namespace. */
-        id: z.ZodString;
-        /** Absolute, realpath-normalized repo root (normalization is the writer's
-         *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-        root: z.ZodEffects<z.ZodString, string, string>;
-        /** Display name (basename by default). `''` = caller derives a fallback. */
-        name: z.ZodCatch<z.ZodString>;
-        addedAt: z.ZodCatch<z.ZodString>;
-        lastOpenedAt: z.ZodCatch<z.ZodString>;
-        source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-        /** Per-project cap on concurrently running tasks. Absent = inherit the
-         *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-         *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-         *  default, and `.passthrough()` preserves the key across cezar round-trips. */
-        maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">[], unknown>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    /** Migration cursor (src/workspace/migrations.ts). Absent/bad → 0, which
-     *  means "run every migration" — each one is idempotent, so that is safe. */
-    schemaVersion: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    /** Root exposed by the Add project folder browser. Environment supplies
-     *  the zero-config default; an explicit workspace value wins thereafter. */
-    browseRoot: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    /** Checkout root for GUI-cloned projects. Stored as written (a literal
-     *  `~` is expanded by the checkout flow, not here); validated writable
-     *  when *changed*, never at load. */
-    projectsDir: z.ZodCatch<z.ZodDefault<z.ZodString>>;
-    resources: z.ZodCatch<z.ZodDefault<z.ZodObject<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
-        maxParallel: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-        /** Per-task memory ceiling in MiB; null = no limit (matches the file's
-         *  literal `"memoryLimitMb": null` in the spec's Data Model). */
-        memoryLimitMb: z.ZodCatch<z.ZodDefault<z.ZodNullable<z.ZodNumber>>>;
-        /** Default worktree retention for projects that don't override it. */
-        worktreeRetentionDefault: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">>>>;
-    /** Per-entry salvage: a corrupt entry is dropped, the rest of the registry
-     *  survives (a whole-array `.catch([])` would evict every project over one
-     *  bad row). */
-    projects: z.ZodEffects<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown, "many">>>, z.objectOutputType<{
-        /** Unique slug — URL segment, sidebar key, worktree namespace. */
-        id: z.ZodString;
-        /** Absolute, realpath-normalized repo root (normalization is the writer's
-         *  job — `registerProject` in step 1.3; the schema only demands absolute). */
-        root: z.ZodEffects<z.ZodString, string, string>;
-        /** Display name (basename by default). `''` = caller derives a fallback. */
-        name: z.ZodCatch<z.ZodString>;
-        addedAt: z.ZodCatch<z.ZodString>;
-        lastOpenedAt: z.ZodCatch<z.ZodString>;
-        source: z.ZodCatch<z.ZodEnum<["local", "checkout"]>>;
-        /** Per-project cap on concurrently running tasks. Absent = inherit the
-         *  workspace `resources.maxParallel`. Bounded like the workspace cap; a bad
-         *  value degrades to "inherit" (`.catch(undefined)`) rather than a hard
-         *  default, and `.passthrough()` preserves the key across cezar round-trips. */
-        maxParallel: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
-    }, z.ZodTypeAny, "passthrough">[], unknown>;
-}, z.ZodTypeAny, "passthrough">>;
+    }, z.core.$loose>>>;
+    composerDefaults: z.ZodCatch<z.ZodDefault<z.ZodObject<{
+        autonomous: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+        worktree: z.ZodCatch<z.ZodOptional<z.ZodBoolean>>;
+    }, z.core.$loose>>>;
+    disabledProviders: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown>>>, z.ZodTransform<("claude" | "codex" | "opencode")[], unknown[]>>;
+    projects: z.ZodPipe<z.ZodCatch<z.ZodDefault<z.ZodArray<z.ZodUnknown>>>, z.ZodTransform<{
+        [x: string]: unknown;
+        id: string;
+        root: string;
+        name: string;
+        addedAt: string;
+        lastOpenedAt: string;
+        source: "checkout" | "local";
+        maxParallel?: number | undefined;
+    }[], unknown[]>>;
+}, z.core.$loose>;
 export type WorkspaceConfig = z.infer<typeof workspaceConfigSchema>;
+/** Resolve the auto-update preference without mutating or materializing it. */
+export declare function effectiveSkillsAutoUpdate(config: Pick<WorkspaceConfig, 'skillsAutoUpdate'>, env?: NodeJS.ProcessEnv): boolean;
+export declare function effectiveComposerDefault(stored: boolean | undefined, envValue: string | undefined, fallback: boolean): boolean;
 /** The in-memory default — what a missing/corrupt file behaves like. */
 export declare function defaultWorkspaceConfig(): WorkspaceConfig;
+/**
+ * The last-known-good copy of a NON-EMPTY registry, written beside the config
+ * by every successful merge-write. The registry is cheap to rebuild in theory
+ * ("open the project again"), but in practice it is a hand-curated list, and a
+ * single bad write — a crash between `writeFileSync` and `rename`, a full
+ * disk, a stray process — costs the user every entry. One extra file, no
+ * configuration, and `loadWorkspaceConfig` falls back to it.
+ *
+ * Removing `~/.cezar` still resets cezar completely; removing only
+ * `config.json` no longer does, because this snapshot restores it.
+ *
+ * A cezar older than this change does not refresh the snapshot, so on a machine
+ * that alternates between versions it can lag behind the registry — which only
+ * shows if the config file is also lost, and the worst case is a project the
+ * user unregistered reappearing. Cheap next to losing the whole list.
+ */
+export declare function workspaceConfigBackupPath(path?: string): string;
 /**
  * Read `~/.cezar/config.json` on demand — never cached, never throws. A
  * missing file is the zero-config default (silent); an unreadable or
  * malformed one degrades to the same default with a one-line warning and is
  * left on disk untouched (the next successful merge-write replaces it).
+ *
+ * Before degrading, a missing, empty, or corrupt file is restored from the
+ * `config.json.bak` snapshot when that still holds projects. The restore is
+ * read-only: the recovered registry is handed back in memory and lands on disk
+ * again through the next merge-write, so a read never writes. A file that
+ * parses and simply has no projects is NOT restored — that is a user who
+ * removed their last project, not a lost registry.
+ *
+ * `path` defaults to the current `workspaceConfigPath()`, but a caller that
+ * will also WRITE passes the path it resolved itself — see
+ * `mergeWriteWorkspaceConfig` for why resolving it twice is a data-loss bug.
  */
-export declare function loadWorkspaceConfig(): Promise<WorkspaceConfig>;
+export declare function loadWorkspaceConfig(path?: string): Promise<WorkspaceConfig>;
 /**
  * The tmp path an atomic write stages through — UNIQUE PER WRITE, never a
  * fixed `${path}.tmp`. `~/.cezar/` is shared by every cezar process on the
@@ -276,6 +129,15 @@ export declare function atomicWriteJsonSync(path: string, value: unknown): void;
  * boot). The mutator may mutate its argument in place or return a replacement.
  * Returns the config that was written. Throws on write failure (e.g. a
  * read-only home) — degrading is the caller's policy, per house rules.
+ *
+ * The path is resolved ONCE, before the `await`, and the same value feeds the
+ * read and the write. Resolving it twice used to lose the whole registry:
+ * `workspaceConfigPath()` re-reads `CEZ_HOME` on every call, so if the variable
+ * changed while the read was in flight — a test's `afterEach` dropping its pin
+ * after a timeout is the way this happens in practice — the read came from one
+ * home and the write landed in another, replacing that file's registry with a
+ * config it never held. One resolution keeps a merge-write inside exactly one
+ * file, whatever the environment does mid-flight.
  */
 export declare function mergeWriteWorkspaceConfig(mutator: (config: WorkspaceConfig) => WorkspaceConfig | void): Promise<WorkspaceConfig>;
 export {};

package/dist/workspace/config.js

@@ -3,7 +3,8 @@ import { chmodSync, mkdirSync, renameSync, writeFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { z } from 'zod';
-import { workspaceConfigPath } from '../paths.js';
+import { PROVIDER_IDS } from '../core/provider-auth.js';
+import { assertCezarHomeWriteIsSandboxed, workspaceConfigPath } from '../paths.js';
 /**
  * `~/.cezar/config.json` — the per-user workspace config + project registry
  * (spec 2026-07-20-multi-project-workspace). House rules from the spec's Data
@@ -50,6 +51,10 @@ const resourcesSchema = z
     .object({
     /** Workspace-wide parallel-task cap (moved from per-repo config.json). */
     maxParallel: z.number().int().min(1).max(16).default(2).catch(2),
+    /** Extra durable `CEZ:MONITORING` sessions exempt from the active-task cap. */
+    maxMonitoringSessions: z.number().int().min(0).max(16).default(2).catch(2),
+    /** Optional cadence for re-checking monitored work; null parks at zero model cost. */
+    monitoringWakeIntervalMinutes: z.number().int().min(1).max(60).nullable().default(null).catch(null),
     /** Per-task memory ceiling in MiB; null = no limit (matches the file's
      *  literal `"memoryLimitMb": null` in the spec's Data Model). */
     memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().default(null).catch(null),
@@ -57,10 +62,30 @@ const resourcesSchema = z
     worktreeRetentionDefault: z.number().int().min(0).max(1000).default(10).catch(10),
 })
     .passthrough();
+const composerDefaultsSchema = z
+    .object({
+    autonomous: z.boolean().optional().catch(undefined),
+    worktree: z.boolean().optional().catch(undefined),
+})
+    .passthrough();
 const workspacePathSchema = (envName, fallback) => {
     const defaultValue = () => process.env[envName]?.trim() || fallback;
     return z.string().min(1).max(4096).default(defaultValue).catch(defaultValue);
 };
+const providerIdSet = new Set(PROVIDER_IDS);
+const disabledProvidersSchema = z
+    .array(z.unknown())
+    .default(() => [])
+    .catch(() => [])
+    .transform((values) => {
+    const seen = new Set();
+    for (const value of values) {
+        if (typeof value !== 'string' || !providerIdSet.has(value))
+            continue;
+        seen.add(value);
+    }
+    return PROVIDER_IDS.filter((provider) => seen.has(provider));
+});
 const workspaceConfigSchema = z
     .object({
     /** Migration cursor (src/workspace/migrations.ts). Absent/bad → 0, which
@@ -73,9 +98,16 @@ const workspaceConfigSchema = z
      *  `~` is expanded by the checkout flow, not here); validated writable
      *  when *changed*, never at load. */
     projectsDir: workspacePathSchema('CEZ_PROJECTS_DIR', '~/cezar/projects'),
+    /** Optional auto-update override. Absence inherits the environment/default
+     *  and must stay absent on unrelated merge-writes. */
+    skillsAutoUpdate: z.boolean().optional().catch(undefined),
     // Function-form default/catch: mutators (step 1.3's registerProject) edit
     // these objects in place, so parses must never share one reference.
-    resources: resourcesSchema.default(() => ({})).catch(() => resourcesSchema.parse({})),
+    resources: resourcesSchema.prefault(() => ({})).catch(() => resourcesSchema.parse({})),
+    /** Optional New Task policy. Missing keys inherit exact 0/1 environment seeds. */
+    composerDefaults: composerDefaultsSchema.default(() => ({})).catch(() => ({})),
+    /** Host-wide provider preferences; absent means every provider is enabled. */
+    disabledProviders: disabledProvidersSchema,
     /** Per-entry salvage: a corrupt entry is dropped, the rest of the registry
      *  survives (a whole-array `.catch([])` would evict every project over one
      *  bad row). */
@@ -89,33 +121,108 @@ const workspaceConfigSchema = z
     })),
 })
     .passthrough();
+/** Resolve the auto-update preference without mutating or materializing it. */
+export function effectiveSkillsAutoUpdate(config, env = process.env) {
+    if (config.skillsAutoUpdate !== undefined)
+        return config.skillsAutoUpdate;
+    if (env.CEZ_SKILLS_AUTO_UPDATE === '0')
+        return false;
+    if (env.CEZ_SKILLS_AUTO_UPDATE === '1')
+        return true;
+    return true;
+}
+export function effectiveComposerDefault(stored, envValue, fallback) {
+    if (stored !== undefined)
+        return stored;
+    if (envValue === '0')
+        return false;
+    if (envValue === '1')
+        return true;
+    return fallback;
+}
 /** The in-memory default — what a missing/corrupt file behaves like. */
 export function defaultWorkspaceConfig() {
     return workspaceConfigSchema.parse({});
 }
+/**
+ * The last-known-good copy of a NON-EMPTY registry, written beside the config
+ * by every successful merge-write. The registry is cheap to rebuild in theory
+ * ("open the project again"), but in practice it is a hand-curated list, and a
+ * single bad write — a crash between `writeFileSync` and `rename`, a full
+ * disk, a stray process — costs the user every entry. One extra file, no
+ * configuration, and `loadWorkspaceConfig` falls back to it.
+ *
+ * Removing `~/.cezar` still resets cezar completely; removing only
+ * `config.json` no longer does, because this snapshot restores it.
+ *
+ * A cezar older than this change does not refresh the snapshot, so on a machine
+ * that alternates between versions it can lag behind the registry — which only
+ * shows if the config file is also lost, and the worst case is a project the
+ * user unregistered reappearing. Cheap next to losing the whole list.
+ */
+export function workspaceConfigBackupPath(path = workspaceConfigPath()) {
+    return `${path}.bak`;
+}
+function parseWorkspaceConfig(raw) {
+    try {
+        const parsed = workspaceConfigSchema.safeParse(JSON.parse(raw));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The snapshot is only worth restoring while it still holds projects — an
+ *  empty one carries no information the defaults do not already have. */
+async function loadWorkspaceConfigBackup(path) {
+    let raw;
+    try {
+        raw = await readFile(workspaceConfigBackupPath(path), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const parsed = parseWorkspaceConfig(raw);
+    return parsed && parsed.projects.length > 0 ? parsed : null;
+}
 /**
  * Read `~/.cezar/config.json` on demand — never cached, never throws. A
  * missing file is the zero-config default (silent); an unreadable or
  * malformed one degrades to the same default with a one-line warning and is
  * left on disk untouched (the next successful merge-write replaces it).
+ *
+ * Before degrading, a missing, empty, or corrupt file is restored from the
+ * `config.json.bak` snapshot when that still holds projects. The restore is
+ * read-only: the recovered registry is handed back in memory and lands on disk
+ * again through the next merge-write, so a read never writes. A file that
+ * parses and simply has no projects is NOT restored — that is a user who
+ * removed their last project, not a lost registry.
+ *
+ * `path` defaults to the current `workspaceConfigPath()`, but a caller that
+ * will also WRITE passes the path it resolved itself — see
+ * `mergeWriteWorkspaceConfig` for why resolving it twice is a data-loss bug.
  */
-export async function loadWorkspaceConfig() {
-    const path = workspaceConfigPath();
-    let raw;
+export async function loadWorkspaceConfig(path = workspaceConfigPath()) {
+    let raw = null;
     try {
         raw = await readFile(path, 'utf8');
     }
     catch {
-        return defaultWorkspaceConfig();
+        // missing/unreadable — the backup below is the next chance
     }
-    try {
-        const parsed = workspaceConfigSchema.safeParse(JSON.parse(raw));
-        if (parsed.success)
-            return parsed.data;
+    if (raw !== null && raw.trim() !== '') {
+        const parsed = parseWorkspaceConfig(raw);
+        if (parsed)
+            return parsed;
     }
-    catch {
-        // malformed JSON — fall through to the warning + defaults
+    const restored = await loadWorkspaceConfigBackup(path);
+    if (restored) {
+        const cause = raw === null ? 'is missing' : 'is empty or corrupt';
+        console.warn(`[cez] workspace config ${path} ${cause} — restored ${restored.projects.length} project(s) from ${workspaceConfigBackupPath(path)}`);
+        return restored;
     }
+    if (raw === null)
+        return defaultWorkspaceConfig();
     console.warn(`[cez] workspace config ${path} is corrupt — using defaults (registry rebuilds)`);
     return defaultWorkspaceConfig();
 }
@@ -137,6 +244,7 @@ export function atomicTmpPath(path) {
  *  shared by the workspace config and ui-state writers. Throws on write
  *  failure (e.g. a read-only home) — degrading is the caller's policy. */
 export function atomicWriteJsonSync(path, value) {
+    assertCezarHomeWriteIsSandboxed(path);
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const tmp = atomicTmpPath(path);
     writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
@@ -157,11 +265,34 @@ export function atomicWriteJsonSync(path, value) {
  * boot). The mutator may mutate its argument in place or return a replacement.
  * Returns the config that was written. Throws on write failure (e.g. a
  * read-only home) — degrading is the caller's policy, per house rules.
+ *
+ * The path is resolved ONCE, before the `await`, and the same value feeds the
+ * read and the write. Resolving it twice used to lose the whole registry:
+ * `workspaceConfigPath()` re-reads `CEZ_HOME` on every call, so if the variable
+ * changed while the read was in flight — a test's `afterEach` dropping its pin
+ * after a timeout is the way this happens in practice — the read came from one
+ * home and the write landed in another, replacing that file's registry with a
+ * config it never held. One resolution keeps a merge-write inside exactly one
+ * file, whatever the environment does mid-flight.
  */
 export async function mergeWriteWorkspaceConfig(mutator) {
-    const current = await loadWorkspaceConfig();
+    const path = workspaceConfigPath();
+    const current = await loadWorkspaceConfig(path);
     const next = mutator(current) ?? current;
-    atomicWriteJsonSync(workspaceConfigPath(), next);
+    atomicWriteJsonSync(path, next);
+    // Refresh the snapshot after EVERY successful write, including an emptied
+    // registry (#731). Skipping the empty case left a stale non-empty backup:
+    // removing the last project, then losing config.json, resurrected the project
+    // the user had deliberately unregistered. An empty snapshot is not restored on
+    // load (see loadWorkspaceConfigBackup), so recovery now settles on the empty
+    // registry the user intended rather than the old projects.
+    try {
+        atomicWriteJsonSync(workspaceConfigBackupPath(path), next);
+    }
+    catch {
+        // Best-effort: the registry itself is already safely on disk, and a
+        // failed snapshot must never turn a successful write into an error.
+    }
     return next;
 }
 //# sourceMappingURL=config.js.map

package/dist/workspace/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/workspace/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,kEAAkE;IAClE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;kFAC8E;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACpD;;;oFAGgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACzE,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE;qEACiE;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1F,sEAAsE;IACtE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;CAClF,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,mBAAmB,GAAG,CAAC,OAA+C,EAAE,QAAgB,EAAE,EAAE;IAChG,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IACpE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN;iFAC6E;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D;gFAC4E;IAC5E,UAAU,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC;IACxD;;yCAEqC;IACrC,WAAW,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACxE,0EAA0E;IAC1E,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF;;oBAEgB;IAChB,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACf,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CACH;CACJ,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,wEAAwE;AACxE,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,kDAAkD,CAAC,CAAC;IAC/F,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAc;IAC9D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,4CAA4C;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA4D;IAE5D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACzC,mBAAmB,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/workspace/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAmB,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,kEAAkE;IAClE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IACnC;kFAC8E;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAC3F,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACpD;;;oFAGgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACzE,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,+EAA+E;IAC/E,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,sFAAsF;IACtF,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACnG;qEACiE;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1F,sEAAsE;IACtE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;CAClF,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,mBAAmB,GAAG,CAAC,OAA+C,EAAE,QAAgB,EAAE,EAAE;IAChG,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IACpE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;AAEpD,MAAM,uBAAuB,GAAG,CAAC;KAC9B,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;KACf,SAAS,CAAC,CAAC,MAAM,EAAgB,EAAE;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN;iFAC6E;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D;gFAC4E;IAC5E,UAAU,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC;IACxD;;yCAEqC;IACrC,WAAW,EAAE,mBAAmB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACxE;0DACsD;IACtD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACzD,0EAA0E;IAC1E,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,kFAAkF;IAClF,gBAAgB,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,iBAAiB,EAAE,uBAAuB;IAC1C;;oBAEgB;IAChB,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SAClB,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SACf,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CACH;CACJ,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CACvC,MAAiD,EACjD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC;IAC1E,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA2B,EAC3B,QAA4B,EAC5B,QAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAI,GAAW,mBAAmB,EAAE;IAC5E,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,yBAAyB,CAAC,IAAY;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAW,mBAAmB,EAAE;IAC5E,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,0BAA0B,IAAI,IAAI,KAAK,eAAe,QAAQ,CAAC,QAAQ,CAAC,MAAM,oBAAoB,yBAAyB,CAAC,IAAI,CAAC,EAAE,CACpI,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,sBAAsB,EAAE,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,kDAAkD,CAAC,CAAC;IAC/F,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAc;IAC9D,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,4CAA4C;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA4D;IAE5D,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACzC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC;QACH,mBAAmB,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,oEAAoE;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/workspace/migrations.d.ts

@@ -1,4 +1,4 @@
-export { mergeWriteWorkspaceUiState } from './ui-state.js';
+export { mergeWriteWorkspaceUiState } from './ui-state.ts';
 /**
  * Workspace config migrations (spec 2026-07-20-multi-project-workspace,
  * "Migrations"). Deliberately tiny and **config-files-only** — run state

package/dist/workspace/migrations.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { workspaceUiStateSchema } from '../contract/index.js';
 import { cezarHomeDir, workspaceConfigPath } from '../paths.js';
 import { readUiState } from '../ui-state.js';
 import { loadWorkspaceConfig, mergeWriteWorkspaceConfig } from './config.js';
@@ -82,13 +83,27 @@ const migration001 = {
         if (!bootRepoRoot)
             return;
         const repoUiState = await readUiState(bootRepoRoot);
-        const uiKeys = ['appearance', 'notifications'].filter((key) => repoUiState[key] !== undefined);
-        if (uiKeys.length === 0)
+        // The two prefs that went GLOBAL at step 3.5, read out of the per-repo bag and validated with
+        // the DESTINATION's own field schemas. `notifications` is not named by the per-repo contract
+        // at all (it left at 3.5), so it arrives through the open catchall as `unknown` — parsing it
+        // here is what makes it assignable, and it is also the honest thing: `GET /workspace/ui-state`
+        // promises these two keys' shapes, so a hand-edited value must not be promoted into the global
+        // file unchecked. A value that does not parse is simply not imported — never a failed boot.
+        const shape = workspaceUiStateSchema.shape;
+        const importable = {};
+        const appearance = shape.appearance.safeParse(repoUiState.appearance);
+        if (appearance.success && appearance.data !== undefined)
+            importable.appearance = appearance.data;
+        const notifications = shape.notifications.safeParse(repoUiState.notifications);
+        if (notifications.success && notifications.data !== undefined) {
+            importable.notifications = notifications.data;
+        }
+        if (Object.keys(importable).length === 0)
             return; // nothing to import — don't create the file
         await mergeWriteWorkspaceUiState((state) => {
-            for (const key of uiKeys) {
+            for (const [key, value] of Object.entries(importable)) {
                 if (state[key] === undefined)
-                    state[key] = repoUiState[key];
+                    state[key] = value;
             }
         });
     },