[WRONG BRANCH] fix: back up non-object config values instead of repairing

[luvs01]

Motivation

• The config repair path could spread non-object JSON (primitives, arrays, or null) into defaults and thereby manufacture a seemingly-valid config that bypasses the invalid-file backup path and risks overwriting the original malformed file on startup. This change prevents silent data-loss by ensuring only plain objects are repairable.

Description

• Add a guard in loadConfig() to require a non-null, non-array object before attempting the merge-repair path and, if not an object, call warnAndBackupInvalidConfig() and return getDefaultConfig() instead of repairing.
• Preserve provider merging behavior for bona fide object repairs so existing intended repairs (e.g. missing fields) still work by merging defaults and retrying schema validation.
• Add regression tests to tests/config.test.ts that write top-level number, boolean, string, array, and null JSON values and assert the file is backed up and defaults are returned.
• Modified files: src/config.ts and tests/config.test.ts.

Testing

• Ran bun test tests/config.test.ts and the updated config tests passed successfully.
• Ran bun run typecheck which completed without errors and bun run privacy:scan which passed.
• Ran the full suite with bun run test; the run progressed but the GUI build step attempted external package downloads and failed in this environment (HTTP 403 to the registry), so the full suite could not complete here though the focused config tests passed.

---

Codex Task

[coderabbitai]

Warning

Review limit reached

@luvs01, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 002fcafc-a71d-48f6-ad00-2de35d6db73b

📥 Commits

Reviewing files that changed from the base of the PR and between 121f1ad and ddcaf7c.

📒 Files selected for processing (2)

• src/config.ts
• tests/config.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddcaf7c7ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject arrays in the shared diagnostics path

When config.json contains a top-level array and a diagnostics-based operation runs before loadConfig()—for example, ocx config set or mutatePersistedConfig()—configDiagnosticsFromRaw() still passes the array to mergeConfigDefaults(), which spreads it over defaults and returns source: "file" with no error. The operation can then overwrite the malformed original with defaults without creating the backup this guard promises, and config admission can incorrectly authorize writes from it. Apply the same non-null, non-array object check in the shared diagnostics/merge path and add coverage through readConfigDiagnostics().

Useful? React with 👍 / 👎.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.