fix: harden pi maintenance lifecycle

backend/src/settings/settings-cli.ts

@@ -0,0 +1,30 @@
+/* Core-side, non-interactive installation-default writer used only through compose exec.
+ * It accepts no credentials and writes the same SETTINGS_FILE consumed by session creation. */
+import { loadConfig } from "../config.js";
+import { loadSettings, saveSettings, type Settings } from "./settings-store.js";
+
+const choice = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/;
+
+function value(args: string[], flag: string): string {
+  const at = args.indexOf(flag);
+  if (at < 0 || at + 1 >= args.length || args.filter((part) => part === flag).length !== 1) {
+    throw new Error(`missing ${flag}`);
+  }
+  return args[at + 1];
+}
+
+try {
+  const args = process.argv.slice(2);
+  if (args.length !== 6) throw new Error("only provider, model, and thinking may be configured");
+  const provider = value(args, "--provider");
+  const model = value(args, "--model");
+  const thinking = value(args, "--thinking");
+  if (!choice.test(provider) || !choice.test(model)) throw new Error("invalid provider or model");
+  if (!["low", "medium", "high"].includes(thinking)) throw new Error("invalid thinking level");
+  const cfg = loadConfig(process.env);
+  const next: Settings = { ...loadSettings(cfg), provider, model, thinking };
+  saveSettings(cfg, next);
+} catch (error) {
+  process.stderr.write(`settings-cli: ${error instanceof Error ? error.message : "invalid configuration"}\n`);
+  process.exitCode = 2;
+}