fix: merge default model catalog into existing configs on load

Previously LoadConfig replaced the default catalog entirely when a user's
config.json already had model_list entries. This meant catalog updates in
new releases were silently ignored for existing users.

mergeCatalogEntries() now runs after every config load: it appends any
catalog entry whose model_name isn't already in the user's list. User
entries are never overwritten, nothing is removed — the merge is purely
additive. New catalog entries become visible on next restart.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grasberg

pkg/config/config.go

@@ -108,9 +108,9 @@ type GuardrailsConfig struct {
 
 // CircuitBreakerConfig configures the circuit breaker for tool calls.
 type CircuitBreakerConfig struct {
-	Enabled            bool          `json:"enabled" env:"SOFIA_GUARDRAILS_CB_ENABLED"`
-	FailureThreshold   int           `json:"failure_threshold" env:"SOFIA_GUARDRAILS_CB_THRESHOLD"`
-	CooldownPeriod     time.Duration `json:"cooldown_period" env:"SOFIA_GUARDRAILS_CB_COOLDOWN"`
+	Enabled          bool          `json:"enabled"           env:"SOFIA_GUARDRAILS_CB_ENABLED"`
+	FailureThreshold int           `json:"failure_threshold" env:"SOFIA_GUARDRAILS_CB_THRESHOLD"`
+	CooldownPeriod   time.Duration `json:"cooldown_period"   env:"SOFIA_GUARDRAILS_CB_COOLDOWN"`
 }
 
 // ApprovalConfig defines which tool calls require human-in-the-loop approval.
@@ -120,6 +120,7 @@ type ApprovalConfig struct {
 	PatternMatch  []string `json:"pattern_match"`  // regex patterns on tool args
 	TimeoutSec    int      `json:"timeout_sec"`    // how long to wait (default 300)
 	DefaultAction string   `json:"default_action"` // "deny" or "allow" on timeout
+	GooseMode     string   `json:"goose_mode"`     // "auto", "approve", "smart_approve", "chat"
 }
 
 // PIIDetectionConfig configures automatic PII detection on inbound messages.
@@ -269,6 +270,11 @@ func LoadConfig(path string) (*Config, error) {
 		cfg.ModelList = ConvertProvidersToModelList(cfg)
 	}
 
+	// Merge catalog: add any default catalog entries not already in the user's list.
+	// This ensures new models added to the built-in catalog in software updates are
+	// immediately available after restart, without overriding user customizations.
+	mergeCatalogEntries(cfg)
+
 	// Ensure the main/default agent is always present in agents.list.
 	// This handles existing configs written before the main agent was added to
 	// DefaultConfig, so existing users get the correct behavior on upgrade.

pkg/config/default_models.go

@@ -1,5 +1,22 @@
 package config
 
+// mergeCatalogEntries appends built-in catalog entries that aren't already
+// present in cfg.ModelList (matched by ModelName). User entries always win —
+// nothing is removed or overwritten. Called from LoadConfig so that new
+// catalog entries added in software updates become available on next restart.
+func mergeCatalogEntries(cfg *Config) {
+	catalog := defaultModelList()
+	existing := make(map[string]bool, len(cfg.ModelList))
+	for _, m := range cfg.ModelList {
+		existing[m.ModelName] = true
+	}
+	for _, m := range catalog {
+		if !existing[m.ModelName] {
+			cfg.ModelList = append(cfg.ModelList, m)
+		}
+	}
+}
+
 // defaultModelList returns the curated catalog of direct API provider models,
 // sourced from NousResearch/hermes-agent provider definitions (v0.8.0).
 // API keys are intentionally empty — users fill them in via config or env vars.