fix: harden store writes, strict schemas, null cfg

test/unit/config/sources.test.ts

@@ -69,4 +69,18 @@ describe('readConfigFile', () => {
         expect(readConfigFile(path)).toEqual([])
         expect(console.error).toHaveBeenCalled()
     })
+
+    it('warns on null config', () => {
+        const path = join(dir, 'config.json')
+        writeFileSync(path, 'null')
+        expect(readConfigFile(path)).toEqual([])
+        expect(console.error).toHaveBeenCalled()
+    })
+
+    it('warns on primitive config', () => {
+        const path = join(dir, 'config.json')
+        writeFileSync(path, '"just a string"')
+        expect(readConfigFile(path)).toEqual([])
+        expect(console.error).toHaveBeenCalled()
+    })
 })

test/unit/config/store.test.ts

@@ -78,6 +78,13 @@ describe('store', () => {
         writeStore(path, [connection])
         expect(readFileSync(path, 'utf8')).toContain('\n    "name": "lab"')
     })
+
+    it('cleans up the tmp file when rename fails', () => {
+        mkdirSync(path, { recursive: true })
+        expect(() => writeStore(path, [connection])).toThrow()
+        const leftovers = readdirSync(join(dir, 'nested')).filter((f) => f.includes('.tmp'))
+        expect(leftovers).toEqual([])
+    })
 })
 
 describe('defaultStorePath', () => {

test/unit/config/types.test.ts

@@ -40,6 +40,19 @@ describe('connectionConfigSchema', () => {
     it('rejects empty host', () => {
         expect(() => connectionConfigSchema.parse({ ...minimal, host: '' })).toThrow()
     })
+
+    it('rejects unknown top-level keys', () => {
+        expect(() => connectionConfigSchema.parse({ ...minimal, readOnly: true })).toThrow()
+    })
+
+    it('rejects unknown ssh keys', () => {
+        expect(() =>
+            connectionConfigSchema.parse({
+                ...minimal,
+                ssh: { host: 'b', user: 'u', password: 'p', prot: 22 }
+            })
+        ).toThrow()
+    })
 })
 
 describe('defaultPort', () => {