Validate settings imports before writing secrets; disclose base URLs

A rejected import (bad env var name, disallowed host path) used to leave
keychain secrets already overwritten while the settings themselves stayed
unchanged. apply_settings_import now runs update_settings's validation
(extracted into validate_settings_update) before any secret write.

Also from this review round: sharpened two format-version tests that
previously passed against the pre-fix code too, added a direct test for
split_settings_and_secrets, warned on a dormant web terminal token even
when the terminal import leaves it off, matched the password-length check
to the frontend's unit of measure, zeroized the export plaintext buffer,
and surfaced non-blank Ollama/llama.cpp/OpenAI-compatible/gateway base
URLs in the import preview so a traffic redirect isn't silent.

app/src-tauri/src/commands/settings_commands.rs

@@ -10,19 +10,24 @@ pub async fn get_settings(state: State<'_, AppState>) -> Result<AppSettings, Str
     Ok(state.settings_store.get())
 }
 
-#[tauri::command]
-pub async fn update_settings(
-    settings: AppSettings,
-    state: State<'_, AppState>,
-) -> Result<AppSettings, String> {
-    let before = state.settings_store.get();
-
+/// Everything `update_settings` refuses a save over, run against the store's
+/// *current* value and the incoming one.
+///
+/// Pulled out so a caller that does other, harder-to-undo work alongside a
+/// settings save — `settings_export_commands::apply_settings_import`
+/// restores three keychain secrets in the same command — can run this
+/// *first* and bail before touching anything, rather than discovering the
+/// rejection only when `update_settings` itself runs partway through.
+pub fn validate_settings_update(
+    before: &AppSettings,
+    incoming: &AppSettings,
+) -> Result<(), String> {
     // The global half of the same rule the project half gets in
     // `update_project`: a global custom env var is merged into every project's
     // container environment, so an unchecked name here reaches all of them.
     crate::models::validate_env_vars_update(
         &before.global_custom_env_vars,
-        &settings.global_custom_env_vars,
+        &incoming.global_custom_env_vars,
     )?;
 
     // The same for the two host paths this struct owns. `update_project`
@@ -40,14 +45,26 @@ pub async fn update_settings(
     crate::commands::project_commands::validate_mounted_host_path(
         "SSH key path",
         before.default_ssh_key_path.as_deref(),
-        settings.default_ssh_key_path.as_deref(),
+        incoming.default_ssh_key_path.as_deref(),
     )?;
     crate::commands::project_commands::validate_mounted_host_path(
         "CA certificate path",
         before.ca_cert_path.as_deref(),
-        settings.ca_cert_path.as_deref(),
+        incoming.ca_cert_path.as_deref(),
     )?;
 
+    Ok(())
+}
+
+#[tauri::command]
+pub async fn update_settings(
+    settings: AppSettings,
+    state: State<'_, AppState>,
+) -> Result<AppSettings, String> {
+    let before = state.settings_store.get();
+
+    validate_settings_update(&before, &settings)?;
+
     let saved = state.settings_store.update(settings)?;
 
     // Persisting a setting is not the same as applying it. The gateway is the
@@ -122,7 +139,10 @@ async fn reconcile_gateway(before: &GatewaySettings, after: &GatewaySettings) {
         GatewayAction::StopIfRunning => {
             log::info!("Model gateway disabled in settings — stopping the container");
             if let Err(e) = docker::gateway::stop_gateway_container().await {
-                log::error!("Failed to stop the model gateway after it was disabled: {}", e);
+                log::error!(
+                    "Failed to stop the model gateway after it was disabled: {}",
+                    e
+                );
             }
         }
         GatewayAction::RestartIfRunning => {
@@ -138,10 +158,7 @@ async fn reconcile_gateway(before: &GatewaySettings, after: &GatewaySettings) {
 }
 
 #[tauri::command]
-pub async fn pull_image(
-    image_name: String,
-    app_handle: tauri::AppHandle,
-) -> Result<(), String> {
+pub async fn pull_image(image_name: String, app_handle: tauri::AppHandle) -> Result<(), String> {
     use tauri::Emitter;
     docker::pull_image(&image_name, move |msg| {
         let _ = app_handle.emit("image-pull-progress", msg);
@@ -334,7 +351,10 @@ mod tests {
         let before = enabled_gateway();
         let mut after = before.clone();
         after.enabled = false;
-        assert_eq!(gateway_action(&before, &after), GatewayAction::StopIfRunning);
+        assert_eq!(
+            gateway_action(&before, &after),
+            GatewayAction::StopIfRunning
+        );
         // Still true when it was already off — a stray running container is
         // still a container that shouldn't be up.
         assert_eq!(gateway_action(&after, &after), GatewayAction::StopIfRunning);

app/src-tauri/src/commands/settings_export_commands.rs

@@ -33,6 +33,7 @@ use std::path::{Path, PathBuf};
 
 use tauri::State;
 use tauri_plugin_dialog::DialogExt;
+use zeroize::Zeroizing;
 
 use crate::models::{
     AppSettings, ExportedSecrets, SettingsExportPayload, SettingsImportPreview,
@@ -122,7 +123,11 @@ pub async fn export_settings(
     window: tauri::Window,
     state: State<'_, AppState>,
 ) -> Result<bool, String> {
-    if password.len() < MIN_PASSWORD_LEN {
+    // `.chars().count()` — Unicode scalar values, not bytes — to stay as
+    // close as this pair of languages allows to the frontend's `.length`
+    // check (UTF-16 code units); the two only diverge on astral-plane
+    // characters, which no reasonable password touches.
+    if password.chars().count() < MIN_PASSWORD_LEN {
         return Err(format!(
             "Use a password of at least {} characters.",
             MIN_PASSWORD_LEN
@@ -146,8 +151,10 @@ pub async fn export_settings(
         secrets,
     };
 
-    let plaintext = serde_json::to_vec(&payload)
-        .map_err(|e| format!("Failed to prepare settings for export: {}", e))?;
+    let plaintext = Zeroizing::new(
+        serde_json::to_vec(&payload)
+            .map_err(|e| format!("Failed to prepare settings for export: {}", e))?,
+    );
     let encrypted = settings_crypto::encrypt(&plaintext, &password)?;
 
     std::fs::write(&dest, &encrypted).map_err(|e| format!("Failed to write export file: {}", e))?;
@@ -200,18 +207,33 @@ pub async fn preview_settings_import(
 /// on import." A user who wants to clear a secret already has dedicated UI
 /// for that (signing out of shared auth, clearing the gateway key).
 ///
-/// Order matters here: secrets are restored **before** the settings replace
-/// runs (which is what triggers `reconcile_gateway`), so a gateway
-/// recreation that replace provokes sees the final key material rather than
-/// racing it — restoring the other way round left a real window where the
-/// running gateway and the keychain briefly disagreed.
+/// Order matters here, twice over.
 ///
-/// The pending path is only cleared on success. A failure here (a rejected
-/// host path, a keychain write failure surfaced some other way) leaves the
-/// import pending so the frontend can let the user retry `apply` without
-/// making them pick the file and re-enter the password again — the
-/// preview's job was confirming *what* to import, not spending the one
-/// attempt at applying it.
+/// First: the imported settings are **validated before any secret is
+/// written**, using the same checks `update_settings` itself runs
+/// (`settings_commands::validate_settings_update`). Restoring a secret is
+/// hard to undo unnoticed — a stale env-var-name rejection or a disallowed
+/// host path used to be caught only when `update_settings` ran, by which
+/// point the three keychain secrets below were already overwritten with the
+/// file's, each with a fresh rotation id, silently flagging every project
+/// container for recreation — while the error the user saw talked only
+/// about the rejected setting and said nothing about the credentials that
+/// had already moved. Failing this check first makes a rejected import
+/// leave nothing touched, matching what "the import failed" is supposed to
+/// mean.
+///
+/// Second, among the things that *do* get written: secrets are restored
+/// **before** the settings replace runs (which is what triggers
+/// `reconcile_gateway`), so a gateway recreation that replace provokes sees
+/// the final key material rather than racing it — restoring the other way
+/// round left a real window where the running gateway and the keychain
+/// briefly disagreed.
+///
+/// The pending path is only cleared on success. A failure here (rejected by
+/// the validation above, or some other error) leaves the import pending so
+/// the frontend can let the user retry `apply` without making them pick the
+/// file and re-enter the password again — the preview's job was confirming
+/// *what* to import, not spending the one attempt at applying it.
 #[tauri::command]
 pub async fn apply_settings_import(
     password: String,
@@ -230,21 +252,7 @@ pub async fn apply_settings_import(
 
     let payload = read_and_decrypt(&path, &password)?;
 
-    if let Some(token) = non_blank(payload.secrets.claude_oauth_token) {
-        if let Err(e) = secure::store_claude_oauth_token(&token) {
-            log::warn!("Settings import: could not restore the shared Claude login: {}", e);
-        }
-    }
-    if let Some(key) = non_blank(payload.secrets.gateway_api_key) {
-        if let Err(e) = secure::store_gateway_api_key(&key) {
-            log::warn!("Settings import: could not restore the gateway provider API key: {}", e);
-        }
-    }
-    if let Some(key) = non_blank(payload.secrets.gateway_master_key) {
-        if let Err(e) = secure::store_gateway_master_key(&key) {
-            log::warn!("Settings import: could not restore the gateway master key: {}", e);
-        }
-    }
+    let current = state.settings_store.get();
 
     // The web-terminal token lives inside `AppSettings` itself rather than
     // the keychain, so "leave an absent secret alone" has to be done by
@@ -254,9 +262,37 @@ pub async fn apply_settings_import(
     // `split_settings_and_secrets`).
     let mut settings = payload.settings;
     settings.web_terminal.access_token = non_blank(payload.secrets.web_terminal_access_token)
-        .or_else(|| state.settings_store.get().web_terminal.access_token);
+        .or_else(|| current.web_terminal.access_token.clone());
 
-    let saved = crate::commands::settings_commands::update_settings(settings, state.clone()).await?;
+    crate::commands::settings_commands::validate_settings_update(&current, &settings)?;
+
+    if let Some(token) = non_blank(payload.secrets.claude_oauth_token) {
+        if let Err(e) = secure::store_claude_oauth_token(&token) {
+            log::warn!(
+                "Settings import: could not restore the shared Claude login: {}",
+                e
+            );
+        }
+    }
+    if let Some(key) = non_blank(payload.secrets.gateway_api_key) {
+        if let Err(e) = secure::store_gateway_api_key(&key) {
+            log::warn!(
+                "Settings import: could not restore the gateway provider API key: {}",
+                e
+            );
+        }
+    }
+    if let Some(key) = non_blank(payload.secrets.gateway_master_key) {
+        if let Err(e) = secure::store_gateway_master_key(&key) {
+            log::warn!(
+                "Settings import: could not restore the gateway master key: {}",
+                e
+            );
+        }
+    }
+
+    let saved =
+        crate::commands::settings_commands::update_settings(settings, state.clone()).await?;
 
     state.pending_settings_import.lock().await.take();
 
@@ -289,7 +325,8 @@ struct FormatVersionProbe {
 /// so neither error path below ever interpolates what `serde_json`
 /// actually says — only a fixed, generic message.
 fn read_and_decrypt(path: &Path, password: &str) -> Result<SettingsExportPayload, String> {
-    let encrypted = std::fs::read(path).map_err(|e| format!("Failed to read export file: {}", e))?;
+    let encrypted =
+        std::fs::read(path).map_err(|e| format!("Failed to read export file: {}", e))?;
     let plaintext = settings_crypto::decrypt(&encrypted, password)?;
 
     let probe: FormatVersionProbe = serde_json::from_slice(&plaintext)
@@ -302,8 +339,9 @@ fn read_and_decrypt(path: &Path, password: &str) -> Result<SettingsExportPayload
         ));
     }
 
-    serde_json::from_slice(&plaintext)
-        .map_err(|_| "This file doesn't look like a valid settings export (unexpected shape).".to_string())
+    serde_json::from_slice(&plaintext).map_err(|_| {
+        "This file doesn't look like a valid settings export (unexpected shape).".to_string()
+    })
 }
 
 #[cfg(test)]
@@ -318,14 +356,54 @@ mod tests {
         assert_eq!(non_blank(Some(" a ".to_string())), Some(" a ".to_string()));
     }
 
-    fn write_export(dir: &std::path::Path, name: &str, payload: &SettingsExportPayload, password: &str) -> PathBuf {
-        let plaintext = serde_json::to_vec(payload).unwrap();
+    fn write_export(
+        dir: &std::path::Path,
+        name: &str,
+        payload: &SettingsExportPayload,
+        password: &str,
+    ) -> PathBuf {
+        write_raw_export(dir, name, &serde_json::to_value(payload).unwrap(), password)
+    }
+
+    /// Like `write_export`, but takes an arbitrary `serde_json::Value` rather
+    /// than a real `SettingsExportPayload` — for fixtures that are
+    /// deliberately not shape-compatible, which the typed helper above can't
+    /// produce at all.
+    fn write_raw_export(
+        dir: &std::path::Path,
+        name: &str,
+        value: &serde_json::Value,
+        password: &str,
+    ) -> PathBuf {
+        let plaintext = serde_json::to_vec(value).unwrap();
         let encrypted = settings_crypto::encrypt(&plaintext, password).unwrap();
         let path = dir.join(name);
         std::fs::write(&path, &encrypted).unwrap();
         path
     }
 
+    #[test]
+    fn splitting_settings_moves_the_web_terminal_token_out_rather_than_copying_it() {
+        let mut settings = AppSettings::default();
+        settings.web_terminal.access_token = Some("super-secret-token".to_string());
+
+        let (settings, secrets) = split_settings_and_secrets(settings);
+
+        assert_eq!(settings.web_terminal.access_token, None);
+        assert_eq!(
+            secrets.web_terminal_access_token,
+            Some("super-secret-token".to_string())
+        );
+    }
+
+    #[test]
+    fn splitting_settings_with_no_token_leaves_it_absent_on_both_sides() {
+        let (settings, secrets) = split_settings_and_secrets(AppSettings::default());
+
+        assert_eq!(settings.web_terminal.access_token, None);
+        assert_eq!(secrets.web_terminal_access_token, None);
+    }
+
     fn sample_payload(format_version: u32) -> SettingsExportPayload {
         SettingsExportPayload {
             format_version,
@@ -348,11 +426,24 @@ mod tests {
 
     #[test]
     fn a_file_from_a_newer_format_is_refused_before_the_full_shape_is_parsed() {
+        // Shape-incompatible with the *current* `SettingsExportPayload` (a
+        // future version could easily have changed `settings` from an object
+        // to something else) as well as newer — so this only passes under
+        // the probe-first ordering. Parsing the full struct first (the old
+        // behavior) would fail on the shape mismatch and never reach the
+        // version check, producing the "unexpected shape" message instead of
+        // "newer version" / "Update Triple-C".
         let dir = temp_dir("newer-format");
-        let path = write_export(
+        let path = write_raw_export(
             &dir,
             "export.triplec",
-            &sample_payload(SETTINGS_EXPORT_FORMAT_VERSION + 1),
+            &serde_json::json!({
+                "format_version": SETTINGS_EXPORT_FORMAT_VERSION + 1,
+                "exported_at": "2026-08-27T00:00:00Z",
+                "app_version": "9.9.9",
+                "settings": "this-app-version-stores-settings-differently",
+                "secrets": {},
+            }),
             "correct password",
         );
 
@@ -381,18 +472,35 @@ mod tests {
 
     #[test]
     fn a_malformed_payload_produces_a_generic_error_not_a_raw_serde_message() {
-        // Encrypt something that decrypts fine but isn't a valid payload
-        // shape at all — this must not happen in practice (only this app
-        // ever writes these files), but the error path must still never
-        // echo back plaintext content, generic malformed-shape or not.
+        // A `format_version` the probe accepts, but a `settings` field of
+        // the wrong *type* rather than just a missing field — this is what
+        // makes `serde_json` produce an "invalid type: string `...`, expected
+        // struct AppSettings" error that quotes the offending value
+        // verbatim. That value here stands in for plaintext that, in a real
+        // export, could be a live credential — the assertion below is only
+        // meaningful against a fixture that actually exercises serde's
+        // value-quoting behavior, which a merely-missing-field fixture does
+        // not.
         let dir = temp_dir("malformed");
-        let plaintext = b"{\"not\": \"a real export\"}".to_vec();
-        let encrypted = settings_crypto::encrypt(&plaintext, "correct password").unwrap();
-        let path = dir.join("export.triplec");
-        std::fs::write(&path, &encrypted).unwrap();
+        let path = write_raw_export(
+            &dir,
+            "export.triplec",
+            &serde_json::json!({
+                "format_version": SETTINGS_EXPORT_FORMAT_VERSION,
+                "exported_at": "2026-08-27T00:00:00Z",
+                "app_version": "0.4.14",
+                "settings": "NOT-A-REAL-CREDENTIAL-abc123",
+                "secrets": {},
+            }),
+            "correct password",
+        );
 
         let err = read_and_decrypt(&path, "correct password").unwrap_err();
-        assert!(!err.contains("not a real export"), "leaked plaintext into the error: {}", err);
+        assert!(
+            !err.contains("NOT-A-REAL-CREDENTIAL-abc123"),
+            "leaked plaintext into the error: {}",
+            err
+        );
         assert!(err.contains("doesn't look like a valid settings export"));
 
         std::fs::remove_dir_all(&dir).ok();
@@ -409,7 +517,11 @@ mod tests {
         );
 
         let err = read_and_decrypt(&path, "wrong password").unwrap_err();
-        assert!(err.contains("Wrong password"), "unexpected message: {}", err);
+        assert!(
+            err.contains("Wrong password"),
+            "unexpected message: {}",
+            err
+        );
 
         std::fs::remove_dir_all(&dir).ok();
     }

app/src-tauri/src/models/settings_export.rs

@@ -110,11 +110,24 @@ pub struct SettingsImportPreview {
     /// bury in a generic "settings replaced" line — see the module doc
     /// comment on why this field exists at all.
     pub enables_web_terminal: bool,
+    /// Non-blank custom base URLs the import would set, so a redirect of
+    /// model traffic to somewhere other than the usual provider is visible
+    /// at import time rather than discovered later. These are endpoints, not
+    /// secrets — safe to show verbatim, unlike everything above.
+    #[serde(default)]
+    pub ollama_base_url: Option<String>,
+    #[serde(default)]
+    pub llamacpp_base_url: Option<String>,
+    #[serde(default)]
+    pub openai_compatible_base_url: Option<String>,
+    #[serde(default)]
+    pub gateway_api_base: Option<String>,
 }
 
 impl SettingsImportPreview {
     pub fn from_payload(payload: &SettingsExportPayload) -> Self {
         let non_blank = |s: &Option<String>| s.as_deref().is_some_and(|v| !v.trim().is_empty());
+        let non_blank_value = |s: &Option<String>| s.clone().filter(|v| !v.trim().is_empty());
         Self {
             exported_at: payload.exported_at.clone(),
             app_version: payload.app_version.clone(),
@@ -126,6 +139,12 @@ impl SettingsImportPreview {
             has_gateway_master_key: non_blank(&payload.secrets.gateway_master_key),
             has_web_terminal_access_token: non_blank(&payload.secrets.web_terminal_access_token),
             enables_web_terminal: payload.settings.web_terminal.enabled,
+            ollama_base_url: non_blank_value(&payload.settings.global_ollama.base_url),
+            llamacpp_base_url: non_blank_value(&payload.settings.global_llamacpp.base_url),
+            openai_compatible_base_url: non_blank_value(
+                &payload.settings.global_openai_compatible.base_url,
+            ),
+            gateway_api_base: non_blank_value(&payload.settings.gateway.api_base),
         }
     }
 }
@@ -138,8 +157,14 @@ mod tests {
     fn payload_with(secrets: ExportedSecrets) -> SettingsExportPayload {
         let mut settings = AppSettings::default();
         settings.global_custom_env_vars = vec![
-            crate::models::EnvVar { key: "A".to_string(), value: "1".to_string() },
-            crate::models::EnvVar { key: "B".to_string(), value: "2".to_string() },
+            crate::models::EnvVar {
+                key: "A".to_string(),
+                value: "1".to_string(),
+            },
+            crate::models::EnvVar {
+                key: "B".to_string(),
+                value: "2".to_string(),
+            },
         ];
         SettingsExportPayload {
             format_version: SETTINGS_EXPORT_FORMAT_VERSION,
@@ -203,6 +228,26 @@ mod tests {
         assert!(!preview.has_web_terminal_access_token);
     }
 
+    #[test]
+    fn custom_base_urls_are_surfaced_but_blank_ones_read_as_absent() {
+        let mut payload = payload_with(ExportedSecrets::default());
+        payload.settings.global_ollama.base_url = Some("http://attacker.example:11434".to_string());
+        payload.settings.global_llamacpp.base_url = Some("   ".to_string());
+        payload.settings.gateway.api_base = Some("https://gateway.example/v1".to_string());
+
+        let preview = SettingsImportPreview::from_payload(&payload);
+        assert_eq!(
+            preview.ollama_base_url.as_deref(),
+            Some("http://attacker.example:11434")
+        );
+        assert_eq!(preview.llamacpp_base_url, None);
+        assert_eq!(preview.openai_compatible_base_url, None);
+        assert_eq!(
+            preview.gateway_api_base.as_deref(),
+            Some("https://gateway.example/v1")
+        );
+    }
+
     #[test]
     fn counts_reflect_the_real_settings() {
         let payload = payload_with(ExportedSecrets::default());