fix(setup): make session_start diagnostics actionable

[627150795]

Problem

On session_start, a valid pre-configVersion file with only recognized fields should stay quiet, while actual configuration diagnostics should retain their category and location. Review found that unknown keys from the on-disk JSON can produce an unbounded number of paths, arbitrarily long paths, and terminal control characters in every startup notification. Fixes #631.

Value

Startup notifications stay concise and readable for malformed or forward-compatible configuration files, while still pointing users to the affected location. The full diagnostic report remains available through /openpi-setup.

Approach

• Keep a writable legacy-only configuration silent and leave startup migration opt-in; session_start does not write the file.
• Show at most three actionable diagnostic paths. Limit each displayed path to 80 Unicode code points, including the truncation ellipsis, and replace C0/C1 control characters with U+FFFD. Preserve the severity, useful location, and existing diagnostic message.
• Leave the overlapping PR fix(setup): keep session_start silent for legacy-only configurations #632 unchanged. Its path-length and control-character concern must be reconciled with this fix before either candidate is merged.

Validation

• node --experimental-strip-types --test --test-concurrency=1 --test-name-pattern="session.?start|session start" tests/extensions/setup/index.test.ts — 8/8 passed, including the new long/control-bearing-key regression.
• bun run check — passed (contracts, web build/typecheck, formatting, lint, and root typecheck).
• bun run test — 1,835 passed, 5 failed, 10 skipped. Failures: tests/extensions/git-info/process.test.ts expected exit code 7 but received -1; one detached-render workflow timed out; three tests/web/transcript-search.test.ts assertions failed, including two Windows EPERM symlink creations. All setup tests passed.
• Direct bun test --max-concurrency=1 tests/extensions/setup/index.test.ts — 36 passed, 2 unrelated failures (post-edit timed out and an invalid-footer-style assertion failed); both passed through the repository's Node-based bun run test path.
• git diff --check origin/main...HEAD — passed.

Impact

• User-visible behavior: startup displays at most three bounded, sanitized diagnostic locations; omitted paths are indicated by an ellipsis.
• Model-visible context/tools: none.
• Runtime/lifecycle: startup continues to inspect and notify only.
• Persisted config/data: no schema or migration change; startup does not write configuration.
• Compatibility/risk: PR fix(setup): keep session_start silent for legacy-only configurations #632 remains separately open and unchanged. The five full-suite failures above remain unresolved; they do not involve the changed setup notification path.

Maintainer integration validation (2026-10-04)

Final head 933912c8. Independent comparison recommends this implementation over #632: legacy-only configurations remain silent, real diagnostics preserve category/path, and paths have count/length/control-character bounds. Fixed only obsolete/flaky test assumptions: dynamic spinner frames, asynchronous rename-dialog closure, macOS long temporary paths. Setup + child page 61/61 and sidebar UI 19/19 passed; final-head bun run check passed in 7.93 s.

Final follow-up head 4c15d3427f523e3ca8e57256dabe8c1006e236b4. Combined local bun run check passed (13.87 s); bun run test passed: 2,262 Node + 1,156 UI tests, 9 skips, 328.74 s at combined commit 53a93e6d. A mistakenly lingering validation process overlapped part of this run; this wall time is not a speed benchmark. Final test-only follow-ups have 19/19 focused page/provider tests, TypeScript/Biome, and independent cross-review. Dynamic listeners restore original model configuration through the revision-checked API and exact readback; restore failures remain failures and listener cleanup still runs.

Five Plan browser cases passed with exact configuration restoration. Broader Plan → Questions run was 10 passed / 2 failed: both failures are an existing duplicate setup-request projection tracked in #654, reproduced with fresh backends and the #643 integration baseline. Uniqueness assertions remain intact; this PR does not claim #654 is fixed or all provider acceptance is green. Final-head Linux/Windows Node 22/24/26 and Web E2E CI must pass before the maintainer-authorized admin merge.

[tt-a1i]

[P2] Bound and sanitize diagnostic paths before putting them in startup notifications (extensions/setup/index.ts)

inspectDocument() builds each diagnostic path from keys in the on-disk JSON, and this change joins every path into a UI notification with no count or length limit. A valid configuration containing many unknown keys, or one very long key, can flood every session_start notification; a key containing control characters is also passed through verbatim. Keep the useful diagnostic category and location, but cap the number and length of displayed paths and sanitize terminal text. Please add a regression using a long or control-bearing unknown key. The same concern applies to the overlapping #632 candidate, so these should be resolved together rather than merged separately.

Reviewed head e81644b against current main ad68e44. The existing CI is green; this path is not covered by the current tests.