fix: persist OpenAI-compatible provider and respect embeddings disable (#177)

* fix: persist OpenAI-compatible provider and respect embeddings disable (#129)

Three interrelated bugs caused the agent to ignore user choices made
during onboarding when using an OpenAI-compatible LLM provider:

1. Session auth ran before DB config reload, so Config::from_env()
   defaulted to NearAi and attempted Clerk auth before the real
   backend was known. Moved session auth to after final config
   resolution.

2. EmbeddingsConfig::resolve() force-enabled embeddings whenever
   OPENAI_API_KEY was present, ignoring the user's explicit disable.
   Changed to respect the stored setting as source of truth.

3. LLM_BACKEND was not saved to the bootstrap .env file, so
   Config::from_env() always defaulted to NearAi before the DB
   was connected. Now saves LLM_BACKEND, LLM_BASE_URL, and
   OLLAMA_BASE_URL alongside the database bootstrap vars.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: add SAFETY comments and sanitize .env value escaping

Address PR review feedback:

- Add SAFETY comments to all unsafe env var manipulation in config
  tests (gemini-code-assist).
- Escape backslashes and double quotes in save_bootstrap_env() to
  prevent env var injection via malicious URLs (gemini-code-assist).
- Add test verifying injection attempt is neutralized.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: incorporate PR #138 changes (chat completions, model sorting, tool schemas)

Includes all changes from bigguybobby's PR #138:

- Use Chat Completions API for OpenAI-compatible providers (avoids
  Responses API assumptions like required tool call IDs)
- Fall back to settings.selected_model when LLM_MODEL env var is unset
- Update OpenAI model list (add gpt-5 family) with priority-based sorting
- Add is_openai_chat_model() filter with broader exclusion patterns
- Fix http tool: headers schema → array of {name,value}, body → string type,
  parse_headers_param() accepts both legacy object and array formats
- Fix json tool: data schema → string type, parse_json_input() normalizer,
  validate uses strict string-only check
- Add mutex-serialized config tests for env var manipulation
- Update NEAR AI config comment for accuracy

Co-Authored-By: Bobby (bigguybobby) <[email protected]>
Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Illia Polosukhin <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Bobby (bigguybobby) <[email protected]>

src/bootstrap.rs

@@ -98,7 +98,10 @@ pub fn save_bootstrap_env(vars: &[(&str, &str)]) -> std::io::Result<()> {
     }
     let mut content = String::new();
     for (key, value) in vars {
-        content.push_str(&format!("{}=\"{}\"\n", key, value));
+        // Escape backslashes and double quotes to prevent env var injection
+        // (e.g. a value containing `"\nINJECTED="x` would break out of quotes).
+        let escaped = value.replace('\\', "\\\\").replace('"', "\\\"");
+        content.push_str(&format!("{}=\"{}\"\n", key, escaped));
     }
     std::fs::write(&path, content)
 }
@@ -323,6 +326,34 @@ mod tests {
         assert!(content.contains("DATABASE_URL=postgres://test"));
     }
 
+    #[test]
+    fn test_save_bootstrap_env_escapes_quotes() {
+        let dir = tempdir().unwrap();
+        let env_path = dir.path().join(".env");
+
+        // A malicious URL attempting to inject a second env var
+        let malicious = r#"http://evil.com"
+INJECTED="pwned"#;
+        let mut content = String::new();
+        let escaped = malicious.replace('\\', "\\\\").replace('"', "\\\"");
+        content.push_str(&format!("LLM_BASE_URL=\"{}\"\n", escaped));
+        std::fs::write(&env_path, &content).unwrap();
+
+        let parsed: Vec<(String, String)> = dotenvy::from_path_iter(&env_path)
+            .unwrap()
+            .filter_map(|r| r.ok())
+            .collect();
+
+        // Must parse as exactly one variable, not two
+        assert_eq!(parsed.len(), 1, "injection must not create extra vars");
+        assert_eq!(parsed[0].0, "LLM_BASE_URL");
+        // The value should contain the original malicious content (unescaped by dotenvy)
+        assert!(
+            parsed[0].1.contains("INJECTED"),
+            "value should contain the literal injection attempt, not execute it"
+        );
+    }
+
     #[test]
     fn test_ironclaw_env_path() {
         let path = ironclaw_env_path();