@vellumai/assistant 0.10.7-dev.202607100313.fffdfea → 0.10.7-dev.202607100720.fba456e

package/src/config/loader.ts

@@ -27,6 +27,23 @@ let cachedFileSignature: ConfigFileSignature | null = null;
 let loading = false;
 let suppressConfigDiskWritesDepth = 0;
 
+/**
+ * The most recent effective config in this process. Captured inside
+ * {@link validateWithSchema} on every validation-success path, then overwritten
+ * by {@link loadConfig} with the deployment-context-filled config whenever
+ * context defaults apply — so it reflects the config as consumers actually see
+ * it (managed service modes and all), not just the pre-fill schema-defaulted
+ * view. It is a safety net for the recovery ladder — when config.json later
+ * fails validation even after per-key cleanup, the last-known-good config is
+ * preferred over discarding the user's entire configuration and falling back to
+ * schema defaults.
+ *
+ * Deliberately NOT cleared by {@link invalidateConfigCache}: cache
+ * invalidation forces a re-read from disk, but the safety net must survive a
+ * re-read so it can rescue a subsequently-corrupted config.
+ */
+let lastKnownGoodConfig: AssistantConfig | null = null;
+
 type ConfigFileSignature =
   | {
       path: string;
@@ -289,31 +306,46 @@ function writeQuarantineNotice(
   }
 }
 
+/** Minimal structural view of the Zod issues the recovery ladder consumes. */
+type ValidationIssue = { path: PropertyKey[]; message: string };
+
+/** Join a Zod issue's path/message into a single human-readable clause. */
+function describeIssues(issues: ValidationIssue[]): string {
+  return issues
+    .map((issue) => {
+      const path = issue.path.join(".");
+      return path ? `"${path}": ${issue.message}` : issue.message;
+    })
+    .join("; ");
+}
+
 /**
- * Record a "config was reset to full defaults by schema validation" event so
- * the per-turn `config-validation-reset-notice` injector can surface it to the
- * agent. Unlike {@link writeQuarantineNotice} (JSON-corrupt file, quarantined),
- * this fires when `config.json` parses as valid JSON but fails schema validation
- * hard enough that {@link validateWithSchema} falls back to {@link
- * cloneDefaultConfig} — e.g. an unknown key that masks a `superRefine`
- * violation until the strip unmasks it, forcing a whole-config reset that
- * silently reverts unrelated settings (managed service modes, model choices,
- * API keys). The on-disk file is left intact, so the user's values are still
- * present but inactive until the invalid entries are fixed.
+ * Record a "config.json did not take effect as written" event so the per-turn
+ * `config-validation-reset-notice` injector can surface it to the agent. Unlike
+ * {@link writeQuarantineNotice} (JSON-corrupt file, quarantined), this fires
+ * when `config.json` parses as valid JSON but fails schema validation hard
+ * enough that per-key cleanup cannot repair it and {@link validateWithSchema}
+ * hands off to {@link recoverFromInvalidConfig} — e.g. an unknown key that masks
+ * a `superRefine` violation until the strip unmasks it. Every rung of that
+ * ladder leaves at least part of the user's saved configuration inactive, and
+ * the rungs that reset a section (or the whole config) to schema defaults
+ * silently revert settings the user never touched: managed service modes, model
+ * choices, API keys. The on-disk file is left intact, so the user's values are
+ * still present but inactive until the invalid entries are fixed.
  *
  * Deliberately NOT gated on `suppressConfigDiskWritesDepth`. The only suppressed
  * `getConfig()` is the re-parse inside `commitConfigWrite`, which runs *after*
  * `saveRawConfig` — so it reflects the persisted config, not a transient one. A
- * bad conversational `config set` must surface the reset it just caused;
- * skipping the write here would leave that live-session reset silent, because
- * the full-default fallback is then cached against the invalid file signature
- * and later loads short-circuit before re-validating. The sentinel is a
- * separate file, so writing it does not conflict with the suppression's purpose
+ * bad conversational `config set` must surface the degradation it just caused;
+ * skipping the write here would leave that live-session event silent, because
+ * the recovered config is then cached against the invalid file signature and
+ * later loads short-circuit before re-validating. The sentinel is a separate
+ * file, so writing it does not conflict with the suppression's purpose
  * (blocking the first-launch-seed / deprecated-strip rewrites of config.json).
  *
- * Best-effort — any failure is logged and swallowed; the `log.warn` reset lines
- * remain the authoritative record. `invalidPaths` is capped so a pathological
- * config cannot bloat the sentinel.
+ * Best-effort — any failure is logged and swallowed; the `log.error` recovery
+ * lines remain the authoritative record. `invalidPaths` is capped so a
+ * pathological config cannot bloat the sentinel.
  */
 function recordConfigValidationReset(invalidPaths: string[]): void {
   try {
@@ -333,14 +365,14 @@ function recordConfigValidationReset(invalidPaths: string[]): void {
     writeFileSync(noticePath, JSON.stringify(notice, null, 2) + "\n", "utf-8");
     log.warn(
       `Wrote config-validation-reset notice to ${noticePath}; config.json ` +
-        `failed schema validation and was reset to defaults (${
+        `failed schema validation and did not fully take effect (${
           dedupedPaths.length
         } invalid path(s): ${dedupedPaths.join(", ") || "top-level"}).`,
     );
   } catch (noticeErr) {
     log.warn(
       { noticeErr },
-      `Failed to write config-validation-reset notice; the reset is still ` +
+      `Failed to write config-validation-reset notice; the event is still ` +
         `recorded in the assistant logs.`,
     );
   }
@@ -348,13 +380,13 @@ function recordConfigValidationReset(invalidPaths: string[]): void {
 
 /**
  * Clear any stale config-validation-reset sentinel once the config validates
- * cleanly again — a validation reset is recoverable (fix the invalid entry and
- * the values come back), so the notice must stop as soon as the config parses,
- * not linger until age-out like a quarantine. Not gated on suppression (see
- * {@link recordConfigValidationReset}): the suppressed re-parse inside
+ * cleanly again — the event is recoverable (fix the invalid entry and the values
+ * come back), so the notice must stop as soon as the config parses, not linger
+ * until age-out like a quarantine. Not gated on suppression (see {@link
+ * recordConfigValidationReset}): the suppressed re-parse inside
  * `commitConfigWrite` is exactly when a user fixes their config via `config
- * set`, and the fallback config it produced is about to be cached against the
- * new signature — so if we skipped clearing here, later short-circuiting loads
+ * set`, and the config it produced is about to be cached against the new
+ * signature — so if we skipped clearing here, later short-circuiting loads
  * would keep injecting the stale notice until age-out. Best-effort.
  */
 function clearConfigValidationResetNotice(): void {
@@ -367,14 +399,29 @@ function clearConfigValidationResetNotice(): void {
 }
 
 /**
- * Validate a raw config object with Zod. Invalid fields are logged as warnings
- * and replaced with defaults (matching prior behavior of per-field fallback).
+ * Validate a raw config object with Zod, applying schema defaults for absent
+ * keys. Invalid fields are logged and stripped so their schema defaults apply,
+ * then the config is re-parsed.
+ *
+ * When cleanup fails to produce a valid config, recovery follows a ladder
+ * (see {@link recoverFromInvalidConfig}) that prefers preserving as much of the
+ * user's configuration as possible over discarding it wholesale:
+ *   1. the last-known-good config validated earlier in this process,
+ *   2. a per-section salvage that keeps every top-level section that validates
+ *      on its own and defaults only the ones that do not, and
+ *   3. full schema defaults as the true last resort.
+ *
+ * Every success path records a `structuredClone` of the returned config as the
+ * last-known-good safety net. Cloning is required because `loadConfig` mutates
+ * the returned object in place via `fillContextDefaultsForMissingKeys`.
  */
 function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   const result = AssistantConfigSchema.safeParse(raw);
   if (result.success) {
     clearConfigValidationResetNotice();
-    return applyNestedDefaults(result.data);
+    const config = applyNestedDefaults(result.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
   }
 
   // Log each validation issue as a warning
@@ -398,36 +445,190 @@ function validateWithSchema(raw: Record<string, unknown>): AssistantConfig {
   const cleaned = structuredClone(raw);
   for (const issue of result.error.issues) {
     if (issue.path.length === 0) {
-      // Top-level error — return full defaults. Surface the reset so the agent
-      // can explain settings that silently reverted (see recordConfigValidationReset).
-      recordConfigValidationReset(
-        result.error.issues.map((i) => i.path.join(".")),
+      // Top-level error — individual keys cannot be stripped. Recover working
+      // from the clone as-is (its top-level sections are still iterable).
+      return recoverFromInvalidConfig(
+        cleaned,
+        [...result.error.issues],
+        issuePaths(result.error.issues),
       );
-      return cloneDefaultConfig();
     }
     deleteNestedKey(cleaned, issue.path as (string | number)[], true);
   }
 
+  // Deleting an invalid array element via `deleteNestedKey` uses `delete
+  // arr[i]` semantics, which leaves a sparse hole that the re-parse reads as
+  // `undefined` and rejects — one bad element in any array field would
+  // otherwise invalidate the whole cleaned config. Compact the holes away
+  // before re-parsing. An array that is emptied purely by stripping invalid
+  // elements is removed from its parent (and any ancestor object the removal
+  // empties is pruned too) so the schema default applies, matching how
+  // `deleteNestedKey` prunes emptied objects — `[]` is not equivalent to the
+  // default for fields like `backup.offsite.destinations` (default `null` =
+  // iCloud) or `skills.allowBundled` (default `null` = all bundled skills).
+  compactSparseArrays(cleaned);
+
   const retry = AssistantConfigSchema.safeParse(cleaned);
   if (retry.success) {
     clearConfigValidationResetNotice();
-    return applyNestedDefaults(retry.data);
+    const config = applyNestedDefaults(retry.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
+  }
+
+  // Record BOTH the first-parse paths (what was stripped) and the retry paths
+  // (what still failed) so the notice can name what went wrong — a first-parse
+  // `invalid_key` can abort the record parse and mask a latent `superRefine`
+  // that only the retry surfaces, and vice versa.
+  return recoverFromInvalidConfig(
+    cleaned,
+    [...retry.error.issues],
+    [...issuePaths(result.error.issues), ...issuePaths(retry.error.issues)],
+  );
+}
+
+/** Dotted paths for a set of Zod issues; a top-level issue yields `""`. */
+function issuePaths(issues: readonly ValidationIssue[]): string[] {
+  return issues.map((issue) => issue.path.join("."));
+}
+
+/**
+ * Recover a usable config when {@link validateWithSchema}'s strip-and-reparse
+ * cleanup cannot produce a valid config, minimizing how much of the user's
+ * configuration is discarded.
+ *
+ * Ladder:
+ *   1. If a last-known-good config was captured earlier in this process, keep
+ *      it — config.json on disk is untouched, so only the in-memory view is
+ *      degraded and the previous good values are the closest safe substitute.
+ *   2. Otherwise (first load after startup), salvage section-by-section: keep
+ *      every top-level section of `cleaned` that validates on its own and reset
+ *      only the sections that do not. This rung requires `cleaned` to be a plain
+ *      object; a top-level non-object config (JSON `null`, a primitive, or an
+ *      array) has no sections to iterate and is skipped straight to rung 3.
+ *   3. If even the combined kept sections fail to parse, return full schema
+ *      defaults.
+ *
+ * Every rung leaves some part of the user's saved config inactive, so all of
+ * them record the validation-reset sentinel (see {@link
+ * recordConfigValidationReset}) — the agent needs to explain a setting that
+ * reverted (rungs 2 and 3) or a `config set` that never took effect (rung 1).
+ *
+ * `issues` are the ones still unresolved after cleanup, used for the operator
+ * log; `invalidPaths` spans every parse attempt and is what the sentinel
+ * records.
+ */
+function recoverFromInvalidConfig(
+  cleaned: unknown,
+  issues: ValidationIssue[],
+  invalidPaths: string[],
+): AssistantConfig {
+  recordConfigValidationReset(invalidPaths);
+  const issueSummary = describeIssues(issues);
+
+  if (lastKnownGoodConfig) {
+    log.error(
+      `config.json failed validation even after stripping invalid fields; ` +
+        `keeping the last-known-good configuration from this process. Fix ` +
+        `config.json to apply your changes (validation issues: ${issueSummary}).`,
+    );
+    return structuredClone(lastKnownGoodConfig);
+  }
+
+  if (!isPlainObject(cleaned)) {
+    // The per-section salvage below walks `Object.entries(cleaned)`, which
+    // throws on `null` and yields no config sections for a primitive or array.
+    // A top-level non-object config carries no recoverable sections, so load
+    // full schema defaults.
+    log.error(
+      `config.json is not a JSON object at the top level; loading full ` +
+        `defaults. Fix config.json to restore your settings (validation ` +
+        `issues: ${issueSummary}).`,
+    );
+    return cloneDefaultConfig();
   }
 
-  // If still failing, fall back to full defaults. This is the case that
-  // silently reverts unrelated settings (e.g. a stripped unknown `llm.callSites`
-  // key unmasks a `superRefine` violation, wiping managed service modes back to
-  // their `your-own` schema default). Record BOTH the first-parse paths (what
-  // was stripped) and the retry paths (what still failed) so the notice can name
-  // what went wrong — the retry issues are otherwise never logged.
-  log.warn("Config validation failed after cleanup. Using full defaults.");
-  recordConfigValidationReset([
-    ...result.error.issues.map((i) => i.path.join(".")),
-    ...retry.error.issues.map((i) => i.path.join(".")),
-  ]);
+  const kept: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(cleaned)) {
+    const sectionResult = AssistantConfigSchema.safeParse({ [key]: value });
+    if (sectionResult.success) {
+      kept[key] = value;
+    } else {
+      log.error(
+        `config.json section "${key}" failed validation; resetting it to ` +
+          `defaults.`,
+      );
+    }
+  }
+
+  const salvaged = AssistantConfigSchema.safeParse(kept);
+  if (salvaged.success) {
+    const config = applyNestedDefaults(salvaged.data);
+    lastKnownGoodConfig = structuredClone(config);
+    return config;
+  }
+
+  log.error(
+    `config.json could not be salvaged section-by-section; loading full ` +
+      `defaults. Fix config.json to restore your settings (validation ` +
+      `issues: ${describeIssues([...salvaged.error.issues])}).`,
+  );
   return cloneDefaultConfig();
 }
 
+/**
+ * Recursively remove holes from every array reachable inside `value`, mutating
+ * in place, and report whether `value` should be removed from its parent.
+ *
+ * Config values come from `JSON.parse`, which cannot encode holes (or
+ * `undefined`), so any hole is the residue of a `deleteNestedKey` strip of an
+ * invalid array element and is safe to drop. Surviving elements are recursed
+ * into so nested arrays are compacted too.
+ *
+ * `removeFromParent` is set for a value the parent must drop so the schema
+ * default applies:
+ *
+ * - An **array** that had at least one element removed by compaction (a hole
+ *   from a stripped invalid element, or a nested child array that itself
+ *   collapsed) and is now empty. An array that was already `[]` on disk keeps
+ *   `removeFromParent` false — no element was stripped, so `[]` is the user's
+ *   explicit choice and is preserved.
+ * - A **plain object** that a compaction removal emptied. This mirrors
+ *   `deleteNestedKey(…, true)` pruning emptied ancestor objects: an emptied
+ *   wrapper left behind can still read as a present, non-default override. An
+ *   object that was already empty on disk removed no child, so it is left alone.
+ */
+function compactSparseArrays(value: unknown): { removeFromParent: boolean } {
+  if (Array.isArray(value)) {
+    let removedElement = false;
+    for (let i = value.length - 1; i >= 0; i--) {
+      if (i in value) {
+        if (compactSparseArrays(value[i]).removeFromParent) {
+          value.splice(i, 1);
+          removedElement = true;
+        }
+      } else {
+        value.splice(i, 1);
+        removedElement = true;
+      }
+    }
+    return { removeFromParent: removedElement && value.length === 0 };
+  }
+  if (isPlainObject(value)) {
+    let removedChild = false;
+    for (const key of Object.keys(value)) {
+      if (compactSparseArrays(value[key]).removeFromParent) {
+        delete value[key];
+        removedChild = true;
+      }
+    }
+    return {
+      removeFromParent: removedChild && Object.keys(value).length === 0,
+    };
+  }
+  return { removeFromParent: false };
+}
+
 /**
  * Delete the key at `path` from `obj`. When `pruneEmptyAncestors` is set, also
  * remove any ancestor object the deletion leaves empty, walking up until the
@@ -852,6 +1053,13 @@ export function loadConfig(): AssistantConfig {
         fileConfig,
         contextDefaults,
       );
+      // Refresh the last-known-good safety net with the effective config.
+      // `validateWithSchema` captured a snapshot before these deployment-context
+      // fills (e.g. IS_PLATFORM=true → managed OAuth service modes) were layered
+      // on, so its snapshot reflects pre-fill schema defaults. The fills are part
+      // of this run's effective configuration, so a later recovery must restore
+      // them rather than flip a managed service mode back to its schema default.
+      lastKnownGoodConfig = structuredClone(config);
     }
 
     // First-launch seed only: when config.json does not exist, write the
@@ -1092,3 +1300,25 @@ export function setNestedValue(
  * production use.
  */
 export const _writeQuarantineNotice = writeQuarantineNotice;
+
+/**
+ * Test-only alias for `recoverFromInvalidConfig`. The strip-and-reparse
+ * cleanup (including sparse-array compaction) repairs every known real-world
+ * config shape, so no config.json fixture reliably reaches the recovery
+ * ladder through `loadConfig` — the ladder is defense-in-depth for schema
+ * shapes the cleanup does not anticipate. Tests exercise its rungs (last
+ * known good, per-section salvage, full defaults) by calling it directly.
+ * Not for production use.
+ */
+export const _recoverFromInvalidConfigForTests = recoverFromInvalidConfig;
+
+/**
+ * Test-only reset for the module-level last-known-good config safety net.
+ * Exists so tests can exercise the first-load-after-startup salvage path (where
+ * no last-known-good config exists yet) deterministically. Not for production
+ * use: {@link invalidateConfigCache} deliberately preserves the safety net, so
+ * production code never clears it.
+ */
+export function _resetLastKnownGoodConfigForTests(): void {
+  lastKnownGoodConfig = null;
+}

package/src/daemon/config-watcher.ts

@@ -27,11 +27,13 @@ import {
   publishConfigChanged,
   publishIdentityChanged,
   publishSoundsConfigUpdated,
+  publishWorkspaceThemeChanged,
 } from "../runtime/sync/resource-sync-events.js";
 import { handleCancelSignal } from "../signals/cancel.js";
 import { handleConversationUndoSignal } from "../signals/conversation-undo.js";
 import { handleEmitEventSignal } from "../signals/emit-event.js";
 import { handleUserMessageSignal } from "../signals/user-message.js";
+import { WORKSPACE_THEME_RELATIVE_PATH } from "../theme/workspace-theme.js";
 import { DebouncerMap } from "../util/debounce.js";
 import { getLogger } from "../util/logger.js";
 import {
@@ -63,7 +65,9 @@ const SKILL_WATCH_SKIPPED_DIRS = new Set([
 ]);
 
 function isSkippedSkillWatchPath(relativePath: string): boolean {
-  if (relativePath === "(unknown)") return false;
+  if (relativePath === "(unknown)") {
+    return false;
+  }
 
   const segments = relativePath.split(/[\\/]+/).filter(Boolean);
   return segments.some((segment) => SKILL_WATCH_SKIPPED_DIRS.has(segment));
@@ -204,7 +208,9 @@ export class ConfigWatcher {
 
     const workspaceHandlers: Record<string, () => void> = {
       "config.json": async () => {
-        if (this.suppressReload) return;
+        if (this.suppressReload) {
+          return;
+        }
         try {
           const prevMcpFingerprint = JSON.stringify(this.lastConfig?.mcp ?? {});
           const changed = await this.refreshConfigFromSources();
@@ -233,6 +239,9 @@ export class ConfigWatcher {
         evictConversationsForReload();
         broadcastIdentityChange();
       },
+      [WORKSPACE_THEME_RELATIVE_PATH]: () => {
+        publishWorkspaceThemeChanged();
+      },
     };
 
     // Per-file watches; don't watch the workspace directory itself because
@@ -272,8 +281,12 @@ export class ConfigWatcher {
     // edge case must not propagate up to DaemonServer.start().
     try {
       watchFile(filePath, { interval: this.pollIntervalMs }, (curr, prev) => {
-        if (this.stopped) return;
-        if (curr.ino === prev.ino && curr.mtimeMs === prev.mtimeMs) return;
+        if (this.stopped) {
+          return;
+        }
+        if (curr.ino === prev.ino && curr.mtimeMs === prev.mtimeMs) {
+          return;
+        }
         this.debounceTimers.schedule(`file:${filePath}`, () => {
           log.info({ file: filePath }, "File changed, reloading");
           handler();
@@ -301,7 +314,9 @@ export class ConfigWatcher {
 
     try {
       const watcher = watch(soundsDir, (_eventType, filename) => {
-        if (!filename) return;
+        if (!filename) {
+          return;
+        }
         this.debounceTimers.schedule("file:sounds", () => {
           log.info(
             { file: String(filename) },
@@ -333,9 +348,13 @@ export class ConfigWatcher {
 
     try {
       const watcher = watch(usersDir, (_eventType, filename) => {
-        if (!filename) return;
+        if (!filename) {
+          return;
+        }
         const file = String(filename);
-        if (!file.endsWith(".md")) return;
+        if (!file.endsWith(".md")) {
+          return;
+        }
         this.debounceTimers.schedule(`file:users/${file}`, () => {
           log.info({ file }, "Users persona file changed, reloading");
           evictConversationsForReload();
@@ -367,8 +386,12 @@ export class ConfigWatcher {
 
     try {
       const watcher = watch(avatarDir, (_eventType, filename) => {
-        if (!filename) return;
-        if (String(filename) !== AVATAR_IMAGE_FILENAME) return;
+        if (!filename) {
+          return;
+        }
+        if (String(filename) !== AVATAR_IMAGE_FILENAME) {
+          return;
+        }
         this.debounceTimers.schedule("file:avatar", () => {
           log.info(
             { file: String(filename) },
@@ -413,7 +436,9 @@ export class ConfigWatcher {
 
     try {
       const watcher = watch(signalsDir, (_eventType, filename) => {
-        if (!filename) return;
+        if (!filename) {
+          return;
+        }
         const file = String(filename);
 
         if (exactSignalHandlers[file]) {
@@ -447,10 +472,14 @@ export class ConfigWatcher {
 
   private startSkillsWatchers(): void {
     const skillsDir = getWorkspaceSkillsDir();
-    if (!existsSync(skillsDir)) return;
+    if (!existsSync(skillsDir)) {
+      return;
+    }
 
     const scheduleSkillsReload = (file: string): void => {
-      if (isSkippedSkillWatchPath(file)) return;
+      if (isSkippedSkillWatchPath(file)) {
+        return;
+      }
 
       this.debounceTimers.schedule("skills:catalog", () => {
         log.info({ file }, "Skill file changed, reloading");
@@ -529,8 +558,12 @@ export class ConfigWatcher {
       }
 
       for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        if (SKILL_WATCH_SKIPPED_DIRS.has(entry.name)) continue;
+        if (!entry.isDirectory()) {
+          continue;
+        }
+        if (SKILL_WATCH_SKIPPED_DIRS.has(entry.name)) {
+          continue;
+        }
         const childDir = join(dirPath, entry.name);
         acc.add(childDir);
         enumerateSkillSubdirectories(childDir, acc);
@@ -554,16 +587,22 @@ export class ConfigWatcher {
       }
 
       for (const [childDir, watcher] of childWatchers.entries()) {
-        if (nextChildDirs.has(childDir)) continue;
+        if (nextChildDirs.has(childDir)) {
+          continue;
+        }
         closeChildWatcher(childDir, watcher);
       }
 
       for (const childDir of nextChildDirs) {
-        if (childWatchers.has(childDir)) continue;
+        if (childWatchers.has(childDir)) {
+          continue;
+        }
 
         const watcher = watchDir(childDir, (filename) => {
           const file = formatSkillChangeLabel(childDir, filename);
-          if (isSkippedSkillWatchPath(file)) return;
+          if (isSkippedSkillWatchPath(file)) {
+            return;
+          }
 
           scheduleSkillsReload(file);
           refreshChildWatchers();
@@ -575,13 +614,17 @@ export class ConfigWatcher {
     };
 
     const rootWatcher = watchDir(skillsDir, (filename) => {
-      if (isSkippedSkillWatchPath(filename)) return;
+      if (isSkippedSkillWatchPath(filename)) {
+        return;
+      }
 
       scheduleSkillsReload(filename);
       refreshChildWatchers();
     });
 
-    if (!rootWatcher) return;
+    if (!rootWatcher) {
+      return;
+    }
 
     refreshChildWatchers();
     log.info(
@@ -645,7 +688,9 @@ export function cleanupSettingsChanged(
   prev: MemoryCleanupConfig | undefined,
   next: MemoryCleanupConfig | undefined,
 ): boolean {
-  if (!prev || !next) return false;
+  if (!prev || !next) {
+    return false;
+  }
   return (
     prev.llmRequestLogRetentionMs !== next.llmRequestLogRetentionMs ||
     prev.conversationRetentionDays !== next.conversationRetentionDays ||

package/src/daemon/message-types/sync.ts

@@ -13,6 +13,7 @@ export const SYNC_TAGS = {
   assistantConfig: "assistant:self:config",
   assistantSounds: "assistant:self:sounds",
   assistantSchedules: "assistant:self:schedules",
+  assistantTheme: "assistant:self:theme",
   appsList: "apps:list",
   pluginsList: "plugins:list",
   conversationsList: "conversations:list",

package/src/oauth/byo-connection.test.ts

@@ -592,7 +592,7 @@ describe("resolveOAuthConnection", () => {
 
   test("throws when no credential metadata exists", async () => {
     await expect(resolveOAuthConnection("unknown")).rejects.toThrow(
-      /No active OAuth connection found for "unknown"/,
+      /No active OAuth connection found for provider "unknown"/,
     );
   });