fix(config): back up non-object configs instead of repairing them

src/config.ts

@@ -247,6 +247,13 @@ export function loadConfig(): OcxConfig {
       warnDegradedCredentialGroups(parsed);
       return withRefreshedCostOverlays(normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, parsed), parsed));
     }
+    // Only object-shaped configs are repairable. Spreading another JSON value
+    // into defaults can manufacture a valid config and bypass the invalid-file
+    // backup.
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      warnAndBackupInvalidConfig(configPath, result.error);
+      return getDefaultConfig();
+    }
     // Schema validation failed — merge defaults into the raw object instead of
     // discarding it entirely, so pool accounts and providers survive a missing
     // field like defaultProvider.

tests/server/config.test.ts

@@ -1918,6 +1918,27 @@ describe("opencodex config defaults", () => {
     }
   });
 
+  test.each([
+    ["number", "123"],
+    ["boolean", "true"],
+    ["string", JSON.stringify("not-an-object")],
+    ["array", "[]"],
+    ["null", "null"],
+  ])("backs up a top-level %s instead of repairing it", (_kind, raw) => {
+    writeConfig(raw);
+    const errorSpy = spyOn(console, "error").mockImplementation(() => {});
+
+    try {
+      expect(loadConfig()).toEqual(getDefaultConfig());
+      const backups = backupNames();
+      expect(backups).toHaveLength(1);
+      expect(readFileSync(join(testDir, backups[0]), "utf-8")).toBe(raw);
+      expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining("Could not load opencodex config"));
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
   test("repairs structurally incomplete config by merging defaults instead of rejecting", () => {
     writeConfig({ port: 10100 });
     const errorSpy = spyOn(console, "error").mockImplementation(() => {});