fix(config): restore default system prompt on upgrade for uncustomized configs (#158)

Signed-off-by: Logan Nguyen <lg.131.dev@gmail.com>

Author: quiet-node

CLAUDE.md

@@ -121,7 +121,7 @@ The loader is forgiving and never crashes the app on user config:
 
 - Missing file → defaults seeded and written. (Only fatal failure path is the seed write itself.)
 - Missing fields/sections → `#[serde(default)]` fills from compiled defaults.
-- Empty/whitespace strings → replaced with compiled defaults. Exception: `prompt.system` is a deliberate user override; an empty value is preserved and means "send no persona" (only the slash-command appendix is composed into `resolved_system`).
+- Empty/whitespace strings → replaced with compiled defaults. Exception: `prompt.system` with `prompt.system_customized = true` is a deliberate user override; an empty value is preserved and means "send no persona" (only the slash-command appendix is composed into `resolved_system`). When `system_customized` is `false` (old configs predating the Settings UI), an empty `system` is treated as a migration artifact and restored to `DEFAULT_SYSTEM_PROMPT_BASE`.
 - Out-of-bounds numerics → reset to default with a stderr warning.
 - Unparseable TOML → file renamed `config.toml.corrupt-<unix_ts>` and a fresh defaults file written.
 

docs/configurations.md

@@ -132,7 +132,8 @@ Controls the personality and instructions Thuki gives to the AI at the start of
 
 | Constant                        | Default                                | Tunable? | Why not tunable                                                                                                                                       | Bounds     | Description                                                                                                                                                                                                                                            |
 | :------------------------------ | :------------------------------------- | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- | :--------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `system`                        | full built-in body (~17 KB)            | Yes      | —                                                                                                                                                     | any string | The full secretary personality prompt. Seeded into your `config.toml` on first run so the file is the single source of truth: edit, tweak, or replace it. Clearing the field sends no persona at all. The slash-command appendix is always added on top, so `/search` etc. work either way. |
+| `system`                        | full built-in body (~17 KB)            | Yes      | —                                                                                                                                                     | any string | The full secretary personality prompt. Seeded into your `config.toml` on first run so the file is the single source of truth: edit, tweak, or replace it. Clearing the field via Settings sends no persona at all. Clearing it by hand in the TOML (without ever saving via Settings) is treated as an old-config migration artifact and the default is restored on the next boot. The slash-command appendix is always added on top, so `/search` etc. work either way. |
+| `DEFAULT_SYSTEM_CUSTOMIZED`    | `false`                                | No       | Internal migration flag. Set to `true` the first time the user saves the system prompt via Settings. Guards the upgrade path that distinguishes configs where `system = ""` was the old compiled default from a deliberate clear made in the Settings UI. Not user-tunable because exposing it would let users suppress the safety net that restores the built-in persona on upgrade. | — | Tracks whether the user has ever explicitly saved a system prompt through the Settings UI. |
 | `DEFAULT_SYSTEM_PROMPT_BASE`    | `prompts/system_prompt.txt`            | No       | The shipped seed for `system` on first run. Once your `config.toml` exists, only the file matters; this constant is no longer consulted at runtime. | —          | Source-of-truth file used to seed `system` on first run.                                                                                                                                                                                                                                  |
 | `SLASH_COMMAND_PROMPT_APPENDIX` | `prompts/generated/slash_commands.txt` | No       | Auto-generated from the slash-command registry at build time. Editing by hand would desync the AI's understanding of the commands from the real ones. | —          | The list of slash commands (`/search`, `/screen`, etc.) Thuki tells the AI about so it knows what each one does. Always added on top of your `system` prompt.                                                                                          |
 

src-tauri/src/config/defaults.rs

@@ -44,6 +44,12 @@ pub const DEFAULT_SYSTEM_PROMPT_BASE: &str = include_str!("../../prompts/system_
 pub const SLASH_COMMAND_PROMPT_APPENDIX: &str =
     include_str!("../../prompts/generated/slash_commands.txt");
 
+/// Whether the user has explicitly saved a system prompt via Settings. Starts
+/// `false` so the upgrade-migration path in the loader can distinguish old
+/// configs (where `system = ""` was the compiled default) from a deliberate
+/// clear made through the Settings UI.
+pub const DEFAULT_SYSTEM_CUSTOMIZED: bool = false;
+
 /// Window defaults (logical pixels and counts). Only the user-tunable knobs
 /// live here; the collapsed-bar height and the close-animation deadline are
 /// baked into `App.tsx` because their effective range is invisible to users

src-tauri/src/config/loader.rs

@@ -33,8 +33,9 @@ use super::defaults::{
     DEFAULT_QUOTE_MAX_DISPLAY_CHARS, DEFAULT_QUOTE_MAX_DISPLAY_LINES,
     DEFAULT_READER_BATCH_TIMEOUT_S, DEFAULT_READER_PER_URL_TIMEOUT_S, DEFAULT_READER_URL,
     DEFAULT_ROUTER_TIMEOUT_S, DEFAULT_SEARCH_TIMEOUT_S, DEFAULT_SEARXNG_MAX_RESULTS,
-    DEFAULT_SEARXNG_URL, DEFAULT_TOP_K_URLS, DEFAULT_UPDATER_CHECK_INTERVAL_HOURS,
-    DEFAULT_UPDATER_MANIFEST_URL, SLASH_COMMAND_PROMPT_APPENDIX,
+    DEFAULT_SEARXNG_URL, DEFAULT_SYSTEM_PROMPT_BASE, DEFAULT_TOP_K_URLS,
+    DEFAULT_UPDATER_CHECK_INTERVAL_HOURS, DEFAULT_UPDATER_MANIFEST_URL,
+    SLASH_COMMAND_PROMPT_APPENDIX,
 };
 use super::error::ConfigError;
 use super::schema::AppConfig;
@@ -152,10 +153,15 @@ pub(crate) fn resolve(config: &mut AppConfig) {
         "inference.num_ctx",
     );
 
-    // Prompt section: compose the user's persona with the slash-command
-    // appendix into the runtime-only `resolved_system`. The on-disk `system`
-    // string is the single source of truth; if the user has cleared it, no
-    // persona is sent (only the appendix).
+    // Prompt section: if the user has never explicitly saved a system prompt
+    // (system_customized is false) and the on-disk value is empty, restore
+    // the built-in default. This heals configs from before the Settings UI
+    // existed, where system="" was the old compiled default rather than an
+    // intentional clear. Once the user saves via Settings, system_customized
+    // is set to true and an explicit empty is respected.
+    if !config.prompt.system_customized && config.prompt.system.trim().is_empty() {
+        config.prompt.system = DEFAULT_SYSTEM_PROMPT_BASE.to_string();
+    }
     config.prompt.resolved_system =
         compose_system_prompt(&config.prompt.system, SLASH_COMMAND_PROMPT_APPENDIX);
 

src-tauri/src/config/schema.rs

@@ -21,8 +21,8 @@ use super::defaults::{
     DEFAULT_QUOTE_MAX_DISPLAY_LINES, DEFAULT_READER_BATCH_TIMEOUT_S,
     DEFAULT_READER_PER_URL_TIMEOUT_S, DEFAULT_READER_URL, DEFAULT_ROUTER_TIMEOUT_S,
     DEFAULT_SEARCH_TIMEOUT_S, DEFAULT_SEARXNG_MAX_RESULTS, DEFAULT_SEARXNG_URL,
-    DEFAULT_SYSTEM_PROMPT_BASE, DEFAULT_TOP_K_URLS, DEFAULT_UPDATER_AUTO_CHECK,
-    DEFAULT_UPDATER_CHECK_INTERVAL_HOURS, DEFAULT_UPDATER_MANIFEST_URL,
+    DEFAULT_SYSTEM_CUSTOMIZED, DEFAULT_SYSTEM_PROMPT_BASE, DEFAULT_TOP_K_URLS,
+    DEFAULT_UPDATER_AUTO_CHECK, DEFAULT_UPDATER_CHECK_INTERVAL_HOURS, DEFAULT_UPDATER_MANIFEST_URL,
 };
 
 /// Static, user-tunable inference daemon configuration.
@@ -70,9 +70,18 @@ impl Default for InferenceSection {
 #[serde(default)]
 pub struct PromptSection {
     /// User-editable persona prompt. Seeded with the built-in body and
-    /// freely editable thereafter. If the user clears it, no persona is
-    /// sent (only the slash-command appendix).
+    /// freely editable thereafter. If the user clears it (with
+    /// `system_customized` set), no persona is sent (only the
+    /// slash-command appendix).
     pub system: String,
+    /// Set to `true` the first time the user explicitly saves the system
+    /// prompt via Settings. Guards upgrade migration: configs from before
+    /// the Settings UI was added have `system = ""` because that was the
+    /// old compiled default, not an intentional clear. The loader resets
+    /// an empty `system` to the built-in default when this flag is
+    /// `false`, preserving the intentional-clear semantic for users who
+    /// actively cleared the field in the new UI.
+    pub system_customized: bool,
     /// Composed runtime value (base prompt plus slash-command appendix).
     /// Not serialized; computed by the loader.
     #[serde(skip)]
@@ -83,6 +92,7 @@ impl Default for PromptSection {
     fn default() -> Self {
         Self {
             system: DEFAULT_SYSTEM_PROMPT_BASE.to_string(),
+            system_customized: DEFAULT_SYSTEM_CUSTOMIZED,
             resolved_system: String::new(),
         }
     }

src-tauri/src/config/tests.rs

@@ -509,10 +509,11 @@ fn resolve_empty_ollama_url_falls_back() {
 }
 
 #[test]
-fn resolve_empty_system_prompt_keeps_only_appendix() {
-    // The user has explicitly cleared their persona; resolved_system contains
-    // the slash-command appendix only. Built-in persona is no longer auto
-    // re-injected, so the on-disk file remains the single source of truth.
+fn resolve_empty_system_prompt_without_customized_flag_uses_built_in_default() {
+    // Upgrade migration path: old configs have system="" because that was the
+    // compiled default before the Settings UI existed. Without system_customized,
+    // the loader restores the built-in persona so upgraded users are not silently
+    // left with no system prompt.
     let dir = fresh_temp_dir();
     let path = config_path_in(&dir);
     std::fs::write(
@@ -524,6 +525,35 @@ fn resolve_empty_system_prompt_keeps_only_appendix() {
     )
     .unwrap();
     let config = load_from_path(&path).unwrap();
+    assert_eq!(config.prompt.system, DEFAULT_SYSTEM_PROMPT_BASE);
+    assert!(config
+        .prompt
+        .resolved_system
+        .contains(DEFAULT_SYSTEM_PROMPT_BASE.trim()));
+    assert!(config
+        .prompt
+        .resolved_system
+        .contains(SLASH_COMMAND_PROMPT_APPENDIX.trim()));
+}
+
+#[test]
+fn resolve_empty_system_prompt_with_customized_flag_keeps_only_appendix() {
+    // Intentional clear: user opened Settings, cleared the prompt, and saved.
+    // set_config_field co-writes system_customized=true so the loader respects
+    // the deliberate empty and does not restore the built-in default.
+    let dir = fresh_temp_dir();
+    let path = config_path_in(&dir);
+    std::fs::write(
+        &path,
+        r#"
+            [prompt]
+            system = ""
+            system_customized = true
+        "#,
+    )
+    .unwrap();
+    let config = load_from_path(&path).unwrap();
+    assert_eq!(config.prompt.system, "");
     assert_eq!(
         config.prompt.resolved_system,
         SLASH_COMMAND_PROMPT_APPENDIX.trim()

src-tauri/src/settings_commands.rs

@@ -177,6 +177,14 @@ pub(crate) fn write_field_to_disk(
 
     let mut doc = read_document(path)?;
     patch_document(&mut doc, section, key, value)?;
+    // When the user saves the system prompt, mark it as explicitly customized
+    // so the upgrade-migration path in the loader (empty + !customized →
+    // restore default) does not overwrite a deliberate clear on next boot.
+    if section == "prompt" && key == "system" {
+        if let Some(table) = doc.get_mut("prompt").and_then(Item::as_table_mut) {
+            table.insert("system_customized", toml_value(true));
+        }
+    }
 
     config::atomic_write_bytes(path, doc.to_string().as_bytes()).map_err(|source| {
         ConfigError::IoError {

src-tauri/src/settings_commands/tests.rs

@@ -65,9 +65,11 @@ fn allowed_fields_count_matches_schema_field_count() {
     // lives in the SQLite app_config table via ActiveModelState, not in TOML. The
     // collapsed bar height and hide-commit delay are baked into the frontend (see
     // `WindowSection` doc) because they have no perceptible effect across
-    // their usable range. If this assertion fails, the schema has drifted
-    // from the allowlist and someone added a field without extending
-    // ALLOWED_FIELDS.
+    // their usable range. `prompt.system_customized` is an internal migration flag
+    // co-written by set_config_field when prompt.system is saved; it is not
+    // directly user-tunable and is intentionally absent from ALLOWED_FIELDS.
+    // If this assertion fails, the schema has drifted from the allowlist and
+    // someone added a field without extending ALLOWED_FIELDS.
     assert_eq!(ALLOWED_FIELDS.len(), 25);
 }
 
@@ -541,6 +543,35 @@ fn write_field_to_disk_accepts_search_pipeline_wall_clock_budget() {
     assert!(on_disk.contains("pipeline_wall_clock_budget_s = 90"));
 }
 
+#[test]
+fn write_field_to_disk_writing_prompt_system_co_writes_customized_flag() {
+    // Saving prompt.system must atomically set system_customized=true so a
+    // subsequent boot does not mistake an intentional clear for the legacy
+    // empty-default and restore the built-in persona.
+    let dir = tempdir();
+    let path = dir.join("config.toml");
+    std::fs::write(&path, SAMPLE_CONFIG).unwrap();
+
+    let resolved = write_field_to_disk(&path, "prompt", "system", json!("")).unwrap();
+    assert!(resolved.prompt.system_customized);
+
+    let on_disk = std::fs::read_to_string(&path).unwrap();
+    assert!(on_disk.contains("system_customized = true"));
+}
+
+#[test]
+fn write_field_to_disk_writing_prompt_system_preserves_customized_flag_for_non_empty() {
+    // Saving a non-empty system prompt also sets system_customized=true.
+    let dir = tempdir();
+    let path = dir.join("config.toml");
+    std::fs::write(&path, SAMPLE_CONFIG).unwrap();
+
+    let resolved =
+        write_field_to_disk(&path, "prompt", "system", json!("You are a custom AI.")).unwrap();
+    assert!(resolved.prompt.system_customized);
+    assert_eq!(resolved.prompt.system, "You are a custom AI.");
+}
+
 #[test]
 fn write_field_to_disk_rejects_unknown_section() {
     let dir = tempdir();