fix: avoid overwriting malformed global config

src/cli/__tests__/global-config.test.ts

@@ -106,6 +106,15 @@ describe('global-config', () => {
       });
     });
 
+    it('does not overwrite malformed config', async () => {
+      await writeFile(tmp.configFile, '{ invalid json');
+
+      const ok = await updateGlobalConfig({ telemetry: { enabled: true } }, tmp.configDir, tmp.configFile);
+
+      expect(ok).toBe(false);
+      expect(await readFile(tmp.configFile, 'utf-8')).toBe('{ invalid json');
+    });
+
     it('returns false on write failures', async () => {
       const ok = await updateGlobalConfig(
         { telemetry: { enabled: true } },

src/lib/schemas/io/global-config.ts

@@ -52,7 +52,7 @@ export async function updateGlobalConfig(
   configFile = GLOBAL_CONFIG_FILE
 ): Promise<boolean> {
   try {
-    const existing = await readGlobalConfig(configFile);
+    const existing = await readGlobalConfigForUpdate(configFile);
     const merged: GlobalConfig = mergeConfig(existing, partial);
 
     await mkdir(configDir, { recursive: true });
@@ -63,6 +63,18 @@ export async function updateGlobalConfig(
   }
 }
 
+async function readGlobalConfigForUpdate(configFile: string): Promise<GlobalConfig> {
+  try {
+    const data = await readFile(configFile, 'utf-8');
+    return GlobalConfigSchema.parse(JSON.parse(data));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return {};
+    }
+    throw error;
+  }
+}
+
 function mergeConfig(target: GlobalConfig, source: GlobalConfig): GlobalConfig {
   return {
     ...target,