@remnic/core 9.69.39 → 9.69.40

package/src/activity/vault-publisher.ts

@@ -19,7 +19,12 @@ import { chmodSync, chownSync, lstatSync, mkdirSync, readFileSync, realpathSync,
 import path from "node:path";
 
 import { expandTildePath } from "../utils/path.js";
-import { applyManagedRegion, fileLines } from "./vault-publish.js";
+import { applyManagedRegion, fileLines, headingSurvivesRoundTrip } from "./vault-publish.js";
+import {
+  renderVaultPropertyValue,
+  validateVaultProperties,
+  type VaultPropertyValue,
+} from "./vault-frontmatter.js";
 import { insertMarkersUnderHeading } from "./vault-insert.js";
 import { validateRegionName } from "./vault-region.js";
 import { assertBeginEndPair } from "./vault-region-pair.js";
@@ -37,8 +42,8 @@ export interface VaultSectionPublish {
   name: string;
   /** Rendered artifact body the region owns. */
   content: string;
-  /** Unprefixed stats, e.g. `{ focus_minutes: "220" }`; keys get the configured prefix. */
-  properties?: Readonly<Record<string, string>>;
+  /** Unprefixed stats, e.g. `{ focus_minutes: "220" }`; keys get the configured prefix. Values are plain single-line scalars or lists of them (vault-frontmatter.ts). */
+  properties?: Readonly<Record<string, VaultPropertyValue>>;
   /** When present, a provenance footer line is appended inside the region. */
   provenance?: VaultSectionProvenance;
 }
@@ -97,6 +102,48 @@ export function publishVaultNote(input: PublishVaultNoteInput): VaultPublishStat
     }
   }
 
+
+  // Issue #2917: input boundaries are total and run BEFORE any note byte
+  // is read or written, so a rejection can never leave a half-merged
+  // note behind.
+
+  // The heading strategy matches a section by scanning note headings with
+  // the shared ATX parser (`applyHeadingRegion`/`insertMarkersUnderHeading`).
+  // A name whose rendered heading parses back to something else — a
+  // trailing `#` run is stripped as a closing sequence (`## Timeline #`
+  // reads as `Timeline`) — can never be matched, so every publish would
+  // no-op or mis-scope. Reject it here rather than at match time.
+  const headingsToProbe =
+    strategy === "heading" ? input.sections.map((section) => section.name) : [];
+  if (typeof input.insertUnderHeading === "string" && input.insertUnderHeading.length > 0) {
+    headingsToProbe.push(input.insertUnderHeading);
+  }
+  for (const headingName of headingsToProbe) {
+    if (!headingSurvivesRoundTrip(headingName)) {
+      throw new RangeError(
+        `Section name ${JSON.stringify(headingName)} is not matchable by the heading parser; it must survive a render-and-parse round trip.`,
+      );
+    }
+  }
+
+  // Property values land in note frontmatter or inline fields; validate
+  // their shape and bounds (vault-frontmatter.ts) against the final
+  // prefixed keys, in every mode, before any file access.
+  const propertyEntries: Array<{ key: string; value: VaultPropertyValue }> = [];
+  for (const section of input.sections) {
+    if (!section.properties) continue;
+    for (const key of Object.keys(section.properties)) {
+      const value = section.properties[key];
+      if (value === undefined) continue;
+      propertyEntries.push({ key: `${prefix}${key}`, value });
+    }
+  }
+  if (propertyEntries.length > 0) {
+    const checked = validateVaultProperties(propertyEntries);
+    if (!checked.ok) {
+      throw new RangeError(`Vault publish properties rejected: ${checked.reason}.`);
+    }
+  }
   const relative = resolveVaultNotePath(input.notePathTemplate, input.date);
   const result = publishRelative(input, relative, { strategy, propertiesMode, prefix });
   return summarizeVaultPublish(result);
@@ -262,13 +309,13 @@ function refuse(relative: string, outcome: "skipped" | "error", reason: string):
 
 function decorate(
   section: VaultSectionPublish,
-  prefixed: Record<string, string> | undefined,
+  prefixed: Record<string, VaultPropertyValue> | undefined,
   mode: string,
 ): string {
   const parts: string[] = [section.content];
   if (prefixed !== undefined && mode === "dataview-inline") {
     for (const [key, value] of Object.entries(prefixed)) {
-      parts.push(`${key}:: ${value}`);
+      parts.push(`${key}:: ${renderVaultPropertyValue(value)}`);
     }
   }
   if (section.provenance !== undefined) {
@@ -388,8 +435,8 @@ function looksLikeRemnicMarkerLine(trimmed: string): boolean {
 function frontmatterUpdates(
   sections: readonly VaultSectionPublish[],
   prefix: string,
-): Record<string, string> {
-  const updates: Record<string, string> = {};
+): Record<string, VaultPropertyValue> {
+  const updates: Record<string, VaultPropertyValue> = {};
   for (const section of sections) {
     if (!section.properties) continue;
     for (const [key, value] of Object.entries(section.properties)) {
@@ -406,14 +453,16 @@ function frontmatterUpdates(
  */
 export function mergeFrontmatterKeys(
   noteText: string,
-  updates: Readonly<Record<string, string>>,
+  updates: Readonly<Record<string, VaultPropertyValue>>,
 ): { ok: true; text: string } | { ok: false; reason: string } {
   const entries = Object.entries(updates);
   if (entries.length === 0) return { ok: true, text: noteText };
-  for (const [key] of entries) {
-    if (key.includes("\n") || key.includes("\r") || key.trim() !== key || key.length === 0) {
-      return { ok: false, reason: "invalid_property_key" };
-    }
+  // The writer re-validates the same boundary the publisher entry checked
+  // (issue #2917): this function is exported, so a direct caller must not
+  // be able to smuggle a newline-bearing or unbounded value into a note.
+  const checked = validateVaultProperties(entries.map(([key, value]) => ({ key, value })));
+  if (!checked.ok) {
+    return { ok: false, reason: "invalid_property" };
   }
 
   const eol = noteText.includes("\r\n") ? "\r\n" : "\n";
@@ -422,7 +471,12 @@ export function mergeFrontmatterKeys(
   const firstLine = firstLineEnd === -1 ? noteText : noteText.slice(0, firstLineEnd);
 
   if (!openRe.test(firstLine)) {
-    const block = ["---", ...entries.map(([key, value]) => `${key}: ${value}`), "---", ""].join(eol);
+    const block = [
+      "---",
+      ...entries.map(([key, value]) => `${key}: ${renderVaultPropertyValue(value)}`),
+      "---",
+      "",
+    ].join(eol);
     return { ok: true, text: block + eol + noteText };
   }
 
@@ -451,13 +505,13 @@ export function mergeFrontmatterKeys(
     if (rawKey !== rawKey.trimStart()) continue;
     const key = rawKey.trimEnd();
     if (!pending.has(key)) continue;
-    lines[i] = `${rawKey}: ${pending.get(key)}`;
+    lines[i] = `${rawKey}: ${renderVaultPropertyValue(pending.get(key)!)}`;
     pending.delete(key);
   }
   const insertAt = closeIdx;
   const added: string[] = [];
   for (const [key, value] of pending.entries()) {
-    added.push(`${key}: ${value}`);
+    added.push(`${key}: ${renderVaultPropertyValue(value)}`);
   }
   lines.splice(insertAt, 0, ...added);
   return { ok: true, text: lines.join(eol) };

package/src/activity/vault-region.test.ts

@@ -3,9 +3,14 @@ import test from "node:test";
 
 import { validateRegionName } from "./vault-region.js";
 
-test("validateRegionName trims a valid name", () => {
+test("validateRegionName accepts a valid name unchanged", () => {
   assert.deepEqual(validateRegionName("timeline"), { ok: true, name: "timeline" });
-  assert.deepEqual(validateRegionName("  weekly  "), { ok: true, name: "weekly" });
+});
+
+test("validateRegionName rejects whitespace-padded names instead of trimming them (#2917)", () => {
+  assert.deepEqual(validateRegionName("  weekly"), { ok: false, error: "invalid_name" });
+  assert.deepEqual(validateRegionName("weekly  "), { ok: false, error: "invalid_name" });
+  assert.deepEqual(validateRegionName("  weekly  "), { ok: false, error: "invalid_name" });
 });
 
 test("validateRegionName rejects empty and whitespace-only names", () => {

package/src/activity/vault-region.ts

@@ -8,6 +8,10 @@
  * or as name `A` with a `B:start` suffix) and a publisher that resolved
  * that ambiguity differently from the note's own markers would pair a
  * start with a later end and delete the user bytes in between.
+ *
+ * Whitespace-padded names are rejected, not trimmed (issue #2917): the
+ * old silent trim validated one name and wrote another, so markers and
+ * heading matches were computed against bytes the caller never saw.
  */
 
 export type ValidateRegionNameResult =
@@ -21,9 +25,9 @@ export function validateRegionName(name: string): ValidateRegionNameResult {
   if (name.includes("\n") || name.includes("\r") || name.includes("-->") || name.includes(":")) {
     return { ok: false, error: "invalid_name" };
   }
-  const trimmed = name.trim();
-  if (trimmed.length === 0) {
+  if (name.trim() !== name || name.trim().length === 0) {
     return { ok: false, error: "invalid_name" };
   }
-  return { ok: true, name: trimmed };
+  return { ok: true, name };
 }
+

package/src/background-generation-config.ts

@@ -1,4 +1,7 @@
+import { readFileSync } from "node:fs";
+
 import { isLoopbackHost } from "./runtime/http-transport.js";
+import { expandTildePath } from "./utils/path.js";
 
 export interface BackgroundGenerationConfig {
   /** Full chat-completions URL. Never used as the global OpenAI base URL. */
@@ -54,14 +57,13 @@ function parseBackgroundGenerationObject(
   if (typeof tokenRaw !== "string" || tokenRaw.length === 0) {
     throw new Error(`${keyName} must include a token`);
   }
-  const timeoutRaw = record.timeoutSeconds;
+  const timeoutRaw = record.timeoutSeconds ?? record.timeout_seconds;
   let timeoutSeconds = 120;
   if (timeoutRaw !== undefined) {
-    const parsed = typeof timeoutRaw === "number" ? timeoutRaw : Number(timeoutRaw);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
+    if (typeof timeoutRaw !== "number" || !Number.isFinite(timeoutRaw) || timeoutRaw <= 0) {
       throw new Error(`${keyName} timeoutSeconds must be a finite number > 0`);
     }
-    timeoutSeconds = parsed;
+    timeoutSeconds = timeoutRaw;
   }
   return {
     endpoint: parseBackgroundEndpoint(endpointRaw, `${keyName}.endpoint`),
@@ -72,8 +74,32 @@ function parseBackgroundGenerationObject(
 
 export function parseBackgroundGeneration(
   cfg: Record<string, unknown>,
+  expandEnv: (value: string) => string,
 ): BackgroundGenerationConfig | undefined {
+  const pathRaw = cfg.llmBridgeClientConfigPath;
+  let fromFile: BackgroundGenerationConfig | undefined;
+  if (pathRaw !== undefined && pathRaw !== null && pathRaw !== "") {
+    if (typeof pathRaw !== "string") {
+      throw new Error("llmBridgeClientConfigPath must be a string");
+    }
+    const expanded = expandTildePath(expandEnv(pathRaw.trim()));
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(readFileSync(expanded, "utf8"));
+    } catch {
+      throw new Error(`llmBridgeClientConfigPath could not be read: ${expanded}`);
+    }
+    fromFile = parseBackgroundGenerationObject(parsed, "llmBridgeClientConfigPath");
+  }
   const explicitRaw = cfg.backgroundGeneration;
-  if (explicitRaw === undefined || explicitRaw === null) return undefined;
-  return parseBackgroundGenerationObject(explicitRaw, "backgroundGeneration");
+  const fromExplicit =
+    explicitRaw === undefined || explicitRaw === null
+      ? undefined
+      : parseBackgroundGenerationObject(explicitRaw, "backgroundGeneration");
+  if (!fromFile && !fromExplicit) return undefined;
+  return {
+    endpoint: fromExplicit?.endpoint ?? fromFile!.endpoint,
+    token: fromExplicit?.token ?? fromFile!.token,
+    timeoutSeconds: fromExplicit?.timeoutSeconds ?? fromFile!.timeoutSeconds,
+  };
 }

package/src/background-generation.test.ts

@@ -83,11 +83,13 @@ test("HourlySummarizer uses backgroundGeneration and not openaiBaseUrl", async (
         timeoutSeconds: 12,
       },
     });
-    globalThis.fetch = (async (url) => {
+    let sentBody: string | undefined;
+    globalThis.fetch = (async (url, init) => {
       calls.push(String(url));
       if (String(url) !== "http://127.0.0.1:8765/v1/chat/completions") {
         return new Response("not the bridge", { status: 404 });
       }
+      sentBody = String(init?.body);
       return new Response(
         JSON.stringify({
           choices: [{ message: { content: '{"bullets":["bridge-only"]}' } }],
@@ -114,6 +116,13 @@ test("HourlySummarizer uses backgroundGeneration and not openaiBaseUrl", async (
     assert.deepEqual(summary?.bullets, ["bridge-only"]);
     assert.deepEqual(calls, ["http://127.0.0.1:8765/v1/chat/completions"]);
     assert.equal(config.openaiBaseUrl, "http://127.0.0.1:9999/v1");
+    // The bridge prompt must spell out the required JSON shape; without it a
+    // literal host model returns {"summary": "..."} and the schema rejects it.
+    const sent = JSON.parse(String(sentBody)) as {
+      messages: Array<{ role: string; content: string }>;
+    };
+    const system = sent.messages.find((message) => message.role === "system")?.content ?? "";
+    assert.match(system, /"bullets"/);
   } finally {
     globalThis.fetch = previousFetch;
     if (previousXdg === undefined) delete process.env.XDG_CONFIG_HOME;

package/src/cli/timeline-publish-commands.ts

@@ -23,6 +23,15 @@ export function registerTimelineCommands(cmd: CliCommand, orchestrator: Orchestr
     .option("--what <kinds>", "Comma-separated artifacts to publish (default: timeline)")
     .option("--dry-run", "Report per-file outcomes without writing")
     .action((...args: unknown[]) => {
+      // Commander passes declared positional args before the options
+      // object; `publish` declares none, so a stray positional would
+      // displace the options object and silently publish with defaults
+      // (issue #2917). Reject any string arg outright.
+      if (args.some((arg) => typeof arg === "string")) {
+        process.stderr.write("timeline publish takes no positional arguments.\n");
+        process.exitCode = 1;
+        return;
+      }
       const options = (args[0] ?? {}) as Record<string, unknown>;
       const code = runTimelinePublishCli(orchestrator.config, options, {
         stdout: process.stdout,

package/src/config.test.ts

@@ -2724,21 +2724,88 @@ test("parseConfig coerces string-typed sharedContextAllowBindingAuthority from t
     );
   }
 });
+test("parseConfig coerces string-typed sharedContextEnabled from the CLI", () => {
+  // `--config sharedContextEnabled=true` arrives as a string, so a strict
+  // `=== true` silently left the feature off for anyone who enabled it.
+  // Parity with sharedContextAllowBindingAuthority (issue #2918).
+  // The default recall-pipeline shared-context gate must use the same
+  // coerced boolean — string true with no custom pipeline enables the
+  // section; false/malformed stay off.
+  for (const enabled of ["true", "1", "yes", "on", true]) {
+    const parsed = parseConfig({ sharedContextEnabled: enabled });
+    assert.equal(
+      parsed.sharedContextEnabled,
+      true,
+      `${JSON.stringify(enabled)} must enable shared context`,
+    );
+    assert.equal(
+      parsed.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+      true,
+      `${JSON.stringify(enabled)} must enable the default shared-context section`,
+    );
+  }
+  for (const disabled of ["false", "0", "no", "off", false, undefined, "", "garbage"]) {
+    const parsed = parseConfig({ sharedContextEnabled: disabled });
+    assert.equal(
+      parsed.sharedContextEnabled,
+      false,
+      `${JSON.stringify(disabled)} must leave shared context off (malformed input never activates)`,
+    );
+    assert.equal(
+      parsed.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+      false,
+      `${JSON.stringify(disabled)} must leave the default shared-context section off`,
+    );
+  }
+});
+
+test("custom recallPipeline keeps operator shared-context enabled (#2918)", () => {
+  const customOff = parseConfig({
+    sharedContextEnabled: "true",
+    recallPipeline: [{ id: "shared-context", enabled: false, maxChars: 1000 }],
+  });
+  assert.equal(customOff.sharedContextEnabled, true);
+  assert.equal(
+    customOff.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+    false,
+    "custom pipeline must not silently activate shared-context",
+  );
+
+  const customOn = parseConfig({
+    sharedContextEnabled: "false",
+    recallPipeline: [{ id: "shared-context", enabled: true, maxChars: 1000 }],
+  });
+  assert.equal(customOn.sharedContextEnabled, false);
+  assert.equal(
+    customOn.recallPipeline.find((section) => section.id === "shared-context")?.enabled,
+    true,
+    "custom pipeline enabled stays as specified",
+  );
+});
 
-test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouched", () => {
+
+test("parseConfig consumes llmBridgeClientConfigPath into backgroundGeneration only", () => {
   withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-client-"));
     const previousKey = process.env.OPENAI_API_KEY;
     const previousBase = process.env.OPENAI_BASE_URL;
     delete process.env.OPENAI_API_KEY;
     delete process.env.OPENAI_BASE_URL;
     try {
-      const parsed = parseConfig({
-        backgroundGeneration: {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
           endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          health_endpoint: "http://127.0.0.1:8765/healthz",
+          bind: "127.0.0.1",
+          model_policy: "server-owned",
+          max_body_bytes: 524288,
+          timeout_seconds: 120,
           token: "bridge-token-fixture",
-          timeoutSeconds: 120,
-        },
-      });
+        }),
+      );
+      const parsed = parseConfig({ llmBridgeClientConfigPath: file });
       assert.equal(parsed.openaiBaseUrl, undefined);
       assert.equal(parsed.openaiApiKey, undefined);
       assert.deepEqual(parsed.backgroundGeneration, {
@@ -2748,11 +2815,7 @@ test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouch
       });
 
       const explicitOpenAi = parseConfig({
-        backgroundGeneration: {
-          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-          token: "bridge-token-fixture",
-          timeoutSeconds: 120,
-        },
+        llmBridgeClientConfigPath: file,
         openaiBaseUrl: "http://127.0.0.1:9999/v1",
         openaiApiKey: "keep-me",
       });
@@ -2762,65 +2825,78 @@ test("parseConfig consumes backgroundGeneration and leaves openaiBaseUrl untouch
         explicitOpenAi.backgroundGeneration?.endpoint,
         "http://127.0.0.1:8765/v1/chat/completions",
       );
+
+      const explicitBg = parseConfig({
+        backgroundGeneration: {
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          token: "explicit-token",
+          timeoutSeconds: 30,
+        },
+      });
+      assert.equal(explicitBg.openaiBaseUrl, undefined);
+      assert.deepEqual(explicitBg.backgroundGeneration, {
+        endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+        token: "explicit-token",
+        timeoutSeconds: 30,
+      });
     } finally {
       if (previousKey === undefined) delete process.env.OPENAI_API_KEY;
       else process.env.OPENAI_API_KEY = previousKey;
       if (previousBase === undefined) delete process.env.OPENAI_BASE_URL;
       else process.env.OPENAI_BASE_URL = previousBase;
+      rmSync(dir, { recursive: true, force: true });
     }
   });
 });
 
-test("parseConfig ignores llmBridgeClientConfigPath", () => {
-  withIsolatedConnectorsDir(false, () => {
-    const parsed = parseConfig({
-      llmBridgeClientConfigPath: "/no/such/remnic-llm-bridge-client.json",
-    });
-    assert.equal(parsed.backgroundGeneration, undefined);
-  });
-});
-
-test("parseConfig rejects backgroundGeneration without a token", () => {
+test("parseConfig rejects an unreadable llmBridgeClientConfigPath", () => {
   withIsolatedConnectorsDir(false, () => {
     assert.throws(
-      () =>
-        parseConfig({
-          backgroundGeneration: {
-            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-          },
-        }),
-      /must include a token/,
+      () => parseConfig({ llmBridgeClientConfigPath: "/no/such/remnic-llm-bridge-client.json" }),
+      /llmBridgeClientConfigPath could not be read/,
     );
   });
 });
 
-test("parseConfig ignores Hermes timeout_seconds on backgroundGeneration", () => {
+test("parseConfig rejects a bridge client file without a token", () => {
   withIsolatedConnectorsDir(false, () => {
-    const parsed = parseConfig({
-      backgroundGeneration: {
-        endpoint: "http://127.0.0.1:8765/v1/chat/completions",
-        token: "bridge-token-fixture",
-        timeout_seconds: 45,
-      },
-    });
-    assert.equal(parsed.backgroundGeneration?.timeoutSeconds, 120);
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-client-"));
+    try {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+        }),
+      );
+      assert.throws(
+        () => parseConfig({ llmBridgeClientConfigPath: file }),
+        /must include a token/,
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
   });
 });
 
-test("parseConfig keeps env openaiBaseUrl isolated from backgroundGeneration", () => {
+test("parseConfig keeps env openaiBaseUrl isolated from the Hermes bridge", () => {
   withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-env-"));
     const previousKey = process.env.OPENAI_API_KEY;
     const previousBase = process.env.OPENAI_BASE_URL;
     process.env.OPENAI_API_KEY = "env-openai-key";
     process.env.OPENAI_BASE_URL = "http://127.0.0.1:9999/v1";
     try {
-      const parsed = parseConfig({
-        backgroundGeneration: {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
           endpoint: "http://127.0.0.1:8765/v1/chat/completions",
           token: "bridge-token-fixture",
-          timeoutSeconds: 45,
-        },
-      });
+          timeout_seconds: 45,
+        }),
+      );
+      const parsed = parseConfig({ llmBridgeClientConfigPath: file });
       assert.equal(parsed.openaiBaseUrl, "http://127.0.0.1:9999/v1");
       assert.equal(parsed.openaiApiKey, "env-openai-key");
       assert.deepEqual(parsed.backgroundGeneration, {
@@ -2833,6 +2909,57 @@ test("parseConfig keeps env openaiBaseUrl isolated from backgroundGeneration", (
       else process.env.OPENAI_API_KEY = previousKey;
       if (previousBase === undefined) delete process.env.OPENAI_BASE_URL;
       else process.env.OPENAI_BASE_URL = previousBase;
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+test("parseConfig rejects nonnumeric bridge timeout values", () => {
+  withIsolatedConnectorsDir(false, () => {
+    assert.throws(
+      () =>
+        parseConfig({
+          backgroundGeneration: {
+            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+            token: "t",
+            timeoutSeconds: true,
+          },
+        }),
+      /timeoutSeconds must be a finite number/,
+    );
+    assert.throws(
+      () =>
+        parseConfig({
+          backgroundGeneration: {
+            endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+            token: "t",
+            timeout_seconds: "45",
+          },
+        }),
+      /timeoutSeconds must be a finite number/,
+    );
+  });
+});
+
+test("parseConfig rejects a bridge client file with a nonnumeric timeout", () => {
+  withIsolatedConnectorsDir(false, () => {
+    const dir = mkdtempSync(path.join(tmpdir(), "remnic-llm-bridge-badtimeout-"));
+    try {
+      const file = path.join(dir, "client.json");
+      writeFileSync(
+        file,
+        JSON.stringify({
+          endpoint: "http://127.0.0.1:8765/v1/chat/completions",
+          token: "bridge-token-fixture",
+          timeout_seconds: "45",
+        }),
+      );
+      assert.throws(
+        () => parseConfig({ llmBridgeClientConfigPath: file }),
+        /timeoutSeconds must be a finite number/,
+      );
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
     }
   });
 });

package/src/config.ts

@@ -25,6 +25,7 @@ import type {
   TriggerMode,
   TrustWeights,
 } from "./types.js";
+import { parseBackgroundGeneration } from "./background-generation-config.js";
 import { parseLocalLlmConfig } from "./local-llm-config.js";
 import { parseConvergeConfig } from "./converge-config.js";
 import { parseExternalWikiRecallGuard } from "./external-wiki-guard.js";
@@ -519,6 +520,7 @@ function normalizeOpenaiBaseUrl(value: string | undefined, source: "config" | "e
   return url;
 }
 
+
 function normalizeMemoryRelativeDir(raw: unknown, fallback: string): string {
   if (typeof raw !== "string") return fallback;
   const trimmed = raw.trim();
@@ -1482,6 +1484,7 @@ export function parseConfig(
   } else if (apiKey !== undefined) {
     baseUrl = normalizeOpenaiBaseUrl(readEnvVar("OPENAI_BASE_URL"), "env");
   }
+  const backgroundGeneration = parseBackgroundGeneration(cfg, resolveEnvVars);
 
   const sharedCrossSignalSemanticEnabled =
     cfg.sharedCrossSignalSemanticEnabled === true || cfg.crossSignalsSemanticEnabled === true;
@@ -1491,7 +1494,15 @@ export function parseConfig(
       : typeof cfg.crossSignalsSemanticTimeoutMs === "number"
         ? Math.max(1, Math.floor(cfg.crossSignalsSemanticTimeoutMs))
         : 4000;
-  const recallPipelineConfig = buildRecallPipelineConfig(cfg);
+  // Coerce once. The default recall-pipeline shared-context gate reads
+  // `cfg.sharedContextEnabled === true`, so it must see this boolean —
+  // not the raw CLI/config string. Custom `recallPipeline` is unchanged.
+  const sharedContextEnabled =
+    coerceBool(cfg.sharedContextEnabled, "sharedContextEnabled") ?? false;
+  const recallPipelineConfig = buildRecallPipelineConfig({
+    ...cfg,
+    sharedContextEnabled,
+  });
   const maintenanceNamespaceFanoutEnabled = resolveBooleanConfig(
     readFlatOrNestedConfig(
       cfg,
@@ -1560,6 +1571,7 @@ export function parseConfig(
   return {
     openaiApiKey: apiKey,
     openaiBaseUrl: baseUrl,
+    backgroundGeneration,
     model,
     reasoningEffort,
     triggerMode,
@@ -3003,10 +3015,9 @@ export function parseConfig(
         ? cfg.routingRulesStateFile.trim()
         : "state/routing-rules.json",
 
-    // v4.0 shared-context (default off)
-    sharedContextEnabled: cfg.sharedContextEnabled === true,
-    // CLI values arrive as strings (`--config sharedContextAllowBindingAuthority=true`),
-    // so a strict `=== true` silently keeps the feature off. Default stays false.
+    // Reuse the hoisted coerce above (default pipeline already saw it).
+    sharedContextEnabled,
+    // Same coercion contract for the binding-authority sibling (#2918 parity).
     sharedContextAllowBindingAuthority:
       coerceBool(cfg.sharedContextAllowBindingAuthority, "sharedContextAllowBindingAuthority") ?? false,
     sharedContextDir:
@@ -4217,6 +4228,7 @@ function buildDefaultRecallPipeline(cfg: Record<string, unknown>): RecallSection
   return [
     {
       id: "shared-context",
+      // Already coerced in parseConfig; do not coerce again.
       enabled: cfg.sharedContextEnabled === true,
       maxChars:
         typeof cfg.sharedContextMaxInjectChars === "number"