fix(config): ignore unset sms provider (CLI-2463)

[7ttp]

TL;DR

stops config diff from reporting auth.sms.<provider>.enabled on projects that never set up sms.

whats broken?

sms_provider reads twilio on projects that never set up sms, and the diff took it as an enabled provider.
every such project reported auth.sms.twilio.enabled and no config.toml could clear it.

now fixed by:

a provider whose identity attribute (like the twilio account sid) is explicitly unset now counts as disabled
projects that never set up sms diff clean, and configured providers are reported as before, a provider declared locally shows as disabled against such a project until it is pushed..

ref:

• closes: config diff always reports auth.sms.twilio.enabled on a project with phone sign-in off, and no config.toml can clear it #6680
• broken in: feat(config): add toProjectConfig and the ProjectConfig hosted subset (CLI-2230) #6339

[github-actions]

🤖 AI Review

The core SMS-provider fix is sound for the reported named-provider/null-identity response. Three findings are confirmed: null/empty sms_provider still causes stock enabled=false declarations to remain local_only, the transform comment omits its undefined behavior, and the #6680 provenance violates the trusted comment policy. The dual-scope warning, fixture-coverage, and identity-rationale findings are refuted by the pull confirmation flow, the new explicit pull integration test, and the adjacent invariant comment plus repository comment policy.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	packages/config/src/project-config/registry-auth.ts:829	correctness	claude	An explicitly null or empty sms_provider omits all provider enabled flags, leaving the stock auth.sms.twilio.enabled=false declaration as an unclearable local_only difference.
⚪ NIT	packages/config/src/project-config/registry-auth.ts:826	documentation	claude	The transform comment does not describe the undefined anchor value newly made reachable through alsoConsumes.
⚪ NIT	packages/config/src/project-config/registry-auth.ts:808	comment-policy	codex	The new source comment uses a ticket number as provenance, contrary to repository comment policy.

Refuted findings (kept for transparency, not posted as review comments)

• packages/config/src/project-config/registry-auth.ts:833 (ux): config pull silently rewrites a locally enabled SMS provider to false without the dual-scope warning intended for settings that also affect the local stack.
  Refuted: The rewrite is not silent: pull.handler.ts:162-188 renders the changes and asks for confirmation, and lines 137-149 protect dirty files. The cited test explicitly sets yes=true to bypass that prompt. registry-row.ts:84-89 limits dualScope to hosted values that should not overwrite local settings; SMS provider selection is managed hosted state intended for pull/push synchronization, analogous to smtp.enabled, which also is not dualScope.
• apps/cli/src/commands/config/pull/pull.integration.test.ts:2179 (test-coverage): The pull suite's default v2Response fixture lacks the new SMS fields, so config pull is not exercised against the real never-configured SMS response.
  Refuted: Although the default fixtures differ, pull.integration.test.ts:2176-2205 adds an explicit response with sms_provider="twilio" and sms_twilio_account_sid=null, runs configPull, verifies enabled=false, and verifies convergence on a second pull. Thus the claimed coverage gap does not exist.
• packages/config/src/project-config/registry-auth.ts:813 (documentation): SMS_IDENTITY_ATTRIBUTES lacks a comment explaining why those fields determine configuration and that blank values disable an otherwise named provider.
  Refuted: registry-auth.ts:807-810 already records the relevant invariant and failure behavior: a provider with an explicitly unset identity attribute is unconfigured and never enabled. The descriptive constant and keys express the mapping itself, while trusted/CLAUDE.md:122-140 says comments should contain only otherwise-unexpressed rationale and avoid narration.

Stats

Claude findings: 5 · Codex findings: 1 · Confirmed: 3 · Refuted: 3 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.