fix(config): prevent "app won't reopen" crash after deleting last provider

Installed v0.1.0 became unlaunchable if the user deleted providers down
to an empty state: the app wrote activeModel='' to config.toml,
readConfig rejected it on next boot (zod min(1)), loadConfigOnBoot
threw, and the main process died before any BrowserWindow could be
created — so clicking the dock icon did nothing.

Three-part fix:

- packages/shared/src/config.ts — drop the .min(1) invariant on
  activeProvider and activeModel. Empty strings are the LEGAL "no
  active provider" state; downstream consumers (toState,
  resolveActiveCredentials, Settings UI) already branch on
  hasKey/undefined-entry for it. Making the empty state
  unrepresentable on disk was the trap.

- apps/desktop/src/main/onboarding-ipc.ts — in runDeleteProvider's
  nextActive === null branch, reset activeProvider to '' too (previously
  it preserved cfg.activeProvider, leaving a dangling reference to the
  just-deleted provider id).

- apps/desktop/src/main/config.ts — validate with ConfigV3Schema.parse
  BEFORE writing. Write-time validation converts silent disk corruption
  into a surfaced error on the originating action, where it can be
  retried or reported.

User impact: installed-app unstick requires one-time manual edit of
~/.config/open-codesign/config.toml (set activeModel to any non-empty
string). After upgrading to the next build, the empty state survives
round-tripping cleanly.

Author: hqhq1025

apps/desktop/src/main/config.ts

@@ -4,6 +4,7 @@ import { dirname, join } from 'node:path';
 import {
   CodesignError,
   type Config,
+  ConfigV3Schema,
   parseConfigFlexible,
   toPersistedV3,
 } from '@open-codesign/shared';
@@ -69,6 +70,11 @@ function safeParseConfig(
 
 export async function writeConfig(config: Config): Promise<void> {
   const persisted = toPersistedV3(config);
+  // Fail fast on shape drift at write-time instead of letting a broken
+  // config land on disk and crash the NEXT boot. This is how the v0.1
+  // "app won't reopen after deleting all providers" bug shipped —
+  // activeModel='' was written here, then readConfig's parse rejected it.
+  ConfigV3Schema.parse(persisted);
   const dir = configDir();
   await mkdir(dir, { recursive: true });
   const path = configPath();

apps/desktop/src/main/onboarding-ipc.ts

@@ -325,9 +325,14 @@ async function runDeleteProvider(raw: unknown): Promise<ProviderRow[]> {
   const { nextActive, modelPrimary } = computeDeleteProviderResult(cfg, raw);
 
   if (nextActive === null) {
+    // All providers gone. Reset BOTH activeProvider and activeModel to ''
+    // so the config doesn't carry a dangling reference to the just-deleted
+    // provider id (which was the old bug: the app would boot next time
+    // with activeProvider='openrouter' pointing at a missing entry and
+    // activeModel='' failing zod's min(1)).
     const emptyNext: Config = hydrateConfig({
       version: 3,
-      activeProvider: cfg.activeProvider,
+      activeProvider: '',
       activeModel: '',
       secrets: {},
       providers: nextProviders,

packages/shared/src/config.ts

@@ -124,8 +124,15 @@ export const BUILTIN_PROVIDERS: Readonly<Record<SupportedOnboardingProvider, Pro
  */
 export const ConfigV3Schema = z.object({
   version: z.literal(3),
-  activeProvider: z.string().min(1),
-  activeModel: z.string().min(1),
+  // `activeProvider` / `activeModel` are ALLOWED to be empty: that's the
+  // legal "no active provider" state the app lands in once the last
+  // provider is deleted. Consumers (`toState`, `resolveActiveCredentials`,
+  // Settings UI) already branch on hasKey/undefined-entry for this case.
+  // The previous `.min(1)` invariant made the empty state unrepresentable
+  // on disk — writing it succeeded but the next boot rejected the file,
+  // hanging the main process before the window could open.
+  activeProvider: z.string(),
+  activeModel: z.string(),
   secrets: z.record(z.string(), SecretRef).default({}),
   providers: z.record(z.string(), ProviderEntrySchema).default({}),
   designSystem: StoredDesignSystem.optional(),