Prevent local settings clobber and surface exec diagnostics

Add loadLocalSettingsWriteBase so session-mode RMW skips unusable
files instead of writing {} over broken JSON. Emit settings diagnostics
to stderr on exec so fail-open is never silent outside the TUI.

Author: TheGreatAxios

src/config/settings.ts

@@ -807,6 +807,22 @@ export async function loadLocalSettings(path: string): Promise<LocalSettings | n
   return settings;
 }
 
+// Resolve the base for a read-modify-write of the local selection file.
+// Absent file → empty base (create OK). Partial fail-open → cleaned fields.
+// Invalid JSON / unreadable / fully unusable → null so the caller skips the
+// write instead of collapsing to {} and wiping the file.
+export async function loadLocalSettingsWriteBase(path: string): Promise<LocalSettings | null> {
+  try {
+    const result = await loadLocalSettingsResult(path);
+    if (result.settings !== null) return result.settings;
+    // Absent (ENOENT) returns null settings with empty diagnostics.
+    if (result.diagnostics.length === 0) return {};
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // Resolve the base for a read-modify-write of the global settings file.
 // An absent file yields a fresh minimal base; an unreadable or invalid file
 // yields null so the caller skips the write — falling back to a minimal base

src/index.ts

@@ -20,6 +20,13 @@ export async function mainWithRunners(
   runners: Runners,
 ): Promise<number> {
   const config = await loadConfig(argv, { allowUnconfigured: true });
+  // Exec has no Ink surface for settings diagnostics — fail-open must still
+  // tell the operator what was ignored and how to fix it.
+  if (config.configured && config.command === "exec" && config.settingsDiagnostics !== undefined) {
+    for (const d of config.settingsDiagnostics) {
+      process.stderr.write(`settings: ${d.message}\n  fix: ${d.fix}\n`);
+    }
+  }
   // Always the TRUE global settings file, never config.globalSettingsPath —
   // that's the --config override file when one was given, and splitting
   // telemetry across two files means the installationId lands somewhere the

src/settings.test.ts

@@ -7,6 +7,7 @@ import {
   isLocalSettings,
   isSettings,
   loadLocalSettings,
+  loadLocalSettingsWriteBase,
   loadSettings,
   normalizeOpenAICompatibleBaseURL,
   resolveProvider,
@@ -361,6 +362,47 @@ describe("loaders", () => {
     }
   });
 
+  test("loadLocalSettings fails open on invalid JSON with diagnostics", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+    try {
+      const path = join(dir, "settings.json");
+      await writeFile(path, "{ not json");
+      expect(await loadLocalSettings(path)).toBeNull();
+      const { loadLocalSettingsResult } = await import("./config/settings.js");
+      const result = await loadLocalSettingsResult(path);
+      expect(result.settings).toBeNull();
+      expect(result.diagnostics.some((d) => /Invalid JSON/i.test(d.message))).toBe(true);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("loadLocalSettingsWriteBase distinguishes absent, cleaned, and unusable", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+    try {
+      const path = join(dir, "settings.json");
+      // Absent: empty base is safe to create.
+      expect(await loadLocalSettingsWriteBase(path)).toEqual({});
+
+      // Partial fail-open: cleaned known fields are the base.
+      await writeFile(
+        path,
+        JSON.stringify({ provider: "a", model: "m1", apiKey: "leak", weird: true }),
+      );
+      expect(await loadLocalSettingsWriteBase(path)).toEqual({ provider: "a", model: "m1" });
+
+      // Invalid JSON: skip write — do not collapse to {}.
+      await writeFile(path, "{ not json");
+      expect(await loadLocalSettingsWriteBase(path)).toBeNull();
+
+      // Non-object: skip write.
+      await writeFile(path, JSON.stringify(["not", "object"]));
+      expect(await loadLocalSettingsWriteBase(path)).toBeNull();
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("loadSettings preserves tools block through a round trip", async () => {
     const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
     try {

src/tui/runner.tsx

@@ -17,6 +17,7 @@ import { buildCodexSource, buildOpenAISource, buildXaiSource, type Config } from
 import {
   globalSettingsPath,
   loadLocalSettings,
+  loadLocalSettingsWriteBase,
   loadGlobalSettingsWriteBase,
   loadSettings,
   localSettingsPath,
@@ -1441,8 +1442,11 @@ export async function runTUI(initialConfig: Config): Promise<number> {
       onChangeSessionMode={async (mode, scope) => {
         if (scope === "local") {
           const path = localSettingsPath(config.cwd);
-          const existing = (await loadLocalSettings(path).catch(() => null)) ?? {};
-          const next: LocalSettings = { ...existing, sessionMode: mode };
+          const base = await loadLocalSettingsWriteBase(path);
+          // Skip write when the file exists but is unreadable/unusable so we
+          // never wipe a broken selection down to only sessionMode.
+          if (base === null) return;
+          const next: LocalSettings = { ...base, sessionMode: mode };
           await saveLocalSettings(path, next);
         } else {
           const current = await loadSettings(config.globalSettingsPath).catch(() => null);