fix(app): validate persisted client state (#3289)

* fix(app): validate persisted client state

Persisted replica data could satisfy TypeScript through an assertion while missing fields required by renderers. Treat every AsyncStorage value as untrusted input, clear values that fail strict schemas, and version the replica DTO so incompatible caches cannot hydrate.

* fix(app): preserve validated legacy state

* fix(app): preserve validated preferences

Preserve supported legacy location fields and every shipped theme while keeping unknown persisted fields rejected. Align browser test seeds with the current preference shape so strict validation exercises the intended provider.

* fix(app): migrate legacy agent preferences

Released clients stored host/location fields and per-provider thinkingOptionId together. Migrate those exact strict bytes into current preferences without admitting unknown fields.

* fix(app): preserve drafts with legacy reviews

Accept the exact strict shape released for workspace review attachments so migration can discard that obsolete attachment without clearing every persisted draft.

packages/app/e2e/support/fixtures.ts

@@ -132,7 +132,7 @@ const test = metroTest.extend<
         endpoint: `127.0.0.1:${daemonPort}`,
         nowIso,
       });
-      const createAgentPreferences = buildCreateAgentPreferences(testDaemon.serverId);
+      const createAgentPreferences = buildCreateAgentPreferences();
 
       await page.addInitScript(
         ({ daemon, preferences, seedNonce: nonce, extraHostsKey }) => {

packages/app/e2e/support/helpers/archive-tab.ts

@@ -26,7 +26,7 @@ function buildSeededStoragePayload() {
       endpoint: `127.0.0.1:${getE2EDaemonPort()}`,
       nowIso,
     }),
-    preferences: buildCreateAgentPreferences(getServerId()),
+    preferences: buildCreateAgentPreferences(),
   };
 }
 

packages/app/e2e/support/helpers/daemon-registry.ts

@@ -1,14 +1,23 @@
+import type {
+  FormPreferences,
+  ProviderPreferences,
+} from "../../../src/create-agent-preferences/preferences";
+
 export const TEST_HOST_LABEL = "localhost";
 
 export const TEST_PROVIDER_PREFERENCES = {
   claude: { model: "haiku" },
-  codex: { model: "gpt-5.4-mini", thinkingOptionId: "low" },
-} as const;
+  codex: { model: "gpt-5.4-mini", thinkingByModel: { "gpt-5.4-mini": "low" } },
+} satisfies Record<string, ProviderPreferences>;
 
-export function buildDirectTcpConnection(endpoint: string) {
+export function buildDirectTcpConnection(endpoint: string): {
+  id: string;
+  type: "directTcp";
+  endpoint: string;
+} {
   return {
     id: `direct:${endpoint}`,
-    type: "directTcp" as const,
+    type: "directTcp",
     endpoint,
   };
 }
@@ -33,12 +42,11 @@ export function buildSeededHost(input: {
 export const TEST_MOCK_PROVIDER_PREFERENCES = {
   ...TEST_PROVIDER_PREFERENCES,
   mock: { model: "ten-second-stream" },
-} as const;
+} satisfies Record<string, ProviderPreferences>;
 
-export function buildCreateAgentPreferences(serverId: string) {
+export function buildCreateAgentPreferences() {
   return {
-    serverId,
-    provider: "mock" as const,
+    provider: "mock",
     providerPreferences: TEST_MOCK_PROVIDER_PREFERENCES,
-  };
+  } satisfies FormPreferences;
 }

packages/app/e2e/support/helpers/relay-deployment.ts

@@ -60,7 +60,7 @@ export async function connectDaemonWebAppOnlyThroughRelay(
       localStorage.setItem("@paseo:daemon-registry", JSON.stringify([storedHost]));
       localStorage.setItem("@paseo:create-agent-preferences", JSON.stringify(preferences));
     },
-    { storedHost: host, preferences: buildCreateAgentPreferences(offer.serverId) },
+    { storedHost: host, preferences: buildCreateAgentPreferences() },
   );
 
   const relaySocketOpened = new Promise<void>((resolve) => {

packages/app/e2e/support/helpers/settings.ts

@@ -132,7 +132,7 @@ export async function seedSavedSettingsHosts(
   if (!firstHost) {
     throw new Error("Expected at least one settings host fixture.");
   }
-  const preferences = buildCreateAgentPreferences(firstHost.serverId);
+  const preferences = buildCreateAgentPreferences();
 
   await page.evaluate(
     ({ keys, storedRegistry, storedPreferences }) => {

packages/app/e2e/support/helpers/startup-dsl.ts

@@ -106,7 +106,7 @@ class StartupScenario {
     if (!firstHost) {
       throw new Error("Expected at least one startup test host.");
     }
-    const createAgentPreferences = buildStoredCreateAgentPreferences(firstHost.serverId);
+    const createAgentPreferences = buildStoredCreateAgentPreferences();
 
     await this.page.evaluate(
       ({ keys, registry: storedRegistry, createAgentPreferences: storedPreferences }) => {
@@ -245,6 +245,6 @@ function buildStoredHost(input: {
   return buildSeededHost(input);
 }
 
-function buildStoredCreateAgentPreferences(serverId: string) {
-  return buildCreateAgentPreferences(serverId);
+function buildStoredCreateAgentPreferences() {
+  return buildCreateAgentPreferences();
 }