chore: update register-global scripts and tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Aitomates

universal-refiner/scripts/operations/REGISTER-GLOBAL.md

@@ -25,7 +25,7 @@ Optional overrides:
   -ObsidianVaultPath 'C:\repo\global.obsidian'
 ```
 
-The script preserves unrelated JSON and TOML configuration. In `-Apply` mode it creates timestamped backups before changed files are replaced through same-directory atomic UTF-8 writes. The doctor reports mojibake and suspicious plaintext credential field paths without printing credential values.
+The script preserves unrelated JSON and TOML configuration. In `-Apply` mode it first preflights every target, then creates timestamped backups before changed files are replaced through same-directory atomic UTF-8 writes. Apply is refused when invalid JSON, mojibake, or suspicious plaintext credential fields are detected. Diagnostics print field paths, never credential values.
 
 Exit codes:
 

universal-refiner/scripts/operations/register-global.ps1

@@ -267,19 +267,26 @@ function Set-TomlSection {
     return $Content + $section
 }
 
-function Update-CodexConfig {
-    param(
-        [Parameter(Mandatory = $true)][string]$Path,
-        [Parameter(Mandatory = $true)][System.Collections.IDictionary]$Servers
-    )
+function Inspect-TomlConfig {
+    param([Parameter(Mandatory = $true)][string]$Path)
 
-    $content = if (Test-Path -LiteralPath $Path) { [System.IO.File]::ReadAllText($Path) } else { "" }
+    if (-not (Test-Path -LiteralPath $Path)) { return }
+    $content = [System.IO.File]::ReadAllText($Path)
     if (Test-Mojibake $content) {
         $script:Issues.Add("mojibake detected: $Path")
     }
     foreach ($match in [regex]::Matches($content, '(?im)^\s*([A-Za-z0-9_.-]*(?:key|token|secret|password|credential|authorization|bearer)[A-Za-z0-9_.-]*)\s*=\s*(?!"\$\{)[^#\r\n]+')) {
         $script:Issues.Add("plaintext credential field: `$.$($match.Groups[1].Value)")
     }
+}
+
+function Update-CodexConfig {
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][System.Collections.IDictionary]$Servers
+    )
+
+    $content = if (Test-Path -LiteralPath $Path) { [System.IO.File]::ReadAllText($Path) } else { "" }
 
     $desiredContent = $content
     foreach ($serverName in $Servers.Keys) {
@@ -339,11 +346,34 @@ Write-Host "Mode: $(if ($Apply) { 'Apply' } else { 'Check' })"
 Write-Host "Profile: $profile"
 Write-Host "Checkout: $repoRoot"
 
+$codexConfigPath = Join-Path $codexRoot "config.toml"
+$claudeMcpPath = Join-Path $profile ".claude.json"
+$claudeSettingsPath = Join-Path $profile ".claude\settings.json"
+$geminiSettingsPath = Join-Path $profile ".gemini\settings.json"
+
+try {
+    Inspect-TomlConfig $codexConfigPath
+    [void](Read-JsonConfig $claudeMcpPath)
+    [void](Read-JsonConfig $claudeSettingsPath)
+    [void](Read-JsonConfig $geminiSettingsPath)
+} catch {
+    Write-Warning $_.Exception.Message
+    exit 2
+}
+
+if ($Apply -and $script:Issues.Count -gt 0) {
+    foreach ($issue in $script:Issues | Select-Object -Unique) {
+        Write-Warning $issue
+    }
+    Write-Warning "Apply refused because preflight diagnostics must be resolved first."
+    exit 2
+}
+
 try {
-    Update-CodexConfig (Join-Path $codexRoot "config.toml") $servers
-    Update-JsonConfig "Claude Code MCP" (Join-Path $profile ".claude.json") $servers
-    Update-JsonConfig "Claude Code hooks" (Join-Path $profile ".claude\settings.json") ([ordered]@{}) $claudeHooks["hooks"]
-    Update-JsonConfig "Gemini" (Join-Path $profile ".gemini\settings.json") $servers $geminiHooks["hooks"]
+    Update-CodexConfig $codexConfigPath $servers
+    Update-JsonConfig "Claude Code MCP" $claudeMcpPath $servers
+    Update-JsonConfig "Claude Code hooks" $claudeSettingsPath ([ordered]@{}) $claudeHooks["hooks"]
+    Update-JsonConfig "Gemini" $geminiSettingsPath $servers $geminiHooks["hooks"]
 } catch {
     Write-Warning $_.Exception.Message
     exit 2

universal-refiner/tests/register-global.test.ts

@@ -93,4 +93,17 @@ describe("global registration doctor", () => {
     expect(result.stdout + result.stderr).not.toContain("do-not-print-this");
     expect(existsSync(join(root, ".claude.json"))).toBe(false);
   });
+
+  it("refuses to merge invalid JSON without overwriting it", () => {
+    const root = makeRoot();
+    mkdirSync(join(root, ".claude"), { recursive: true });
+    const configPath = join(root, ".claude", "settings.json");
+    writeFileSync(configPath, "{", "utf8");
+
+    const result = run(root, "-Apply");
+    expect(result.status, result.stdout + result.stderr).toBe(2);
+    expect(result.stdout + result.stderr).toContain("Cannot safely merge invalid JSON config");
+    expect(readFileSync(configPath, "utf8")).toBe("{");
+    expect(existsSync(join(root, ".codex", "config.toml"))).toBe(false);
+  });
 });