[colonelpanic8]

A narrow first step toward pingdotgg#19594.

Problem

settings.json is both the configuration and where every UI change is written. If it lives in a dotfiles repo (symlinked, which pingdotgg#15009 preserves), every UI change becomes a dotfiles diff, including values that only make sense on one machine. If it doesn't, the dotfiles copy and the live copy drift apart.

Change

--server-shared-settings-file or T3CODE_SERVER_SHARED_SETTINGS_FILE names a read-only settings file, with the same schema as settings.json, that sits beneath it:

effective = built-in defaults < shared file < settings.json

• settings.json stays the only file T3 writes. UI changes, migrations, t3 theme, the device service, and project commands all write only there.
• Writes save the difference from defaults plus the shared file. Values a machine never changed keep following the shared file. A value set back to the built-in default is still saved when the shared file differs.
• Values the schema needs whole are saved whole: provider instance entries, usage limit sources, price overrides, model selections, worktree cleanup rules. Editing a shared provider instance saves the full edited entry.
• When the shared file is configured but missing or malformed, saves keep every key already in settings.json, so local overrides aren't lost. A malformed shared file is ignored with a warning, like a malformed settings.json.
• The shared file is watched like settings.json, symlinks included.
• With the option unset, behavior is unchanged.

Documented in docs/user/install.md, including the limits:

• A key saved with exactly the shared value is dropped and follows the shared file again.
• Entries that come from the shared file can't be removed on one machine.
• t3 project needs the same flag or env var when no server is running.

Not in this PR: showing where each value comes from in the UI, a "reset to shared" action, imports, and layering for keybindings or client settings.

Verification

• Behavioral tests run the real ServerSettingsService on temp files. They cover shared values appearing, settings.json overriding them, and a UI patch writing only the patched key while the shared file stays byte-identical. They also cover editing, disabling, clearing a field on, and switching the driver of a shared provider instance, changing a model on shared top-level and per-project selections, missing and malformed shared files, the legacy providers migration, the OTLP fallback, and inherited secrets not leaking into settings.json.
• vp test run on the settings, config, theme, project, and project-deletion tests passes, 137 tests. tsc-rs --noEmit, vp lint, and vp fmt --check pass for apps/server.
• Not run against a live server.

🤖 Generated with Claude Code