refactor(config): validate persisted configuration

[Waishnav]

Treat persisted config and auth documents as untrusted boundaries and decode them once with Zod before the rest of the application consumes them. Legacy extension fields remain intact at this layer so the later migration owns the compatibility decision.

This establishes the typed seam needed by the rest of the v1.1 stack. Verified with focused malformed-document coverage and the full test suite.

Summary by CodeRabbit

• New Features

  • Added support for validating subagent settings provided as either a simple boolean or structured configuration.
  • Configuration files can retain additional, unrecognized settings while validating supported values.

• Bug Fixes

  • Improved validation for user and authentication configuration files, including nested settings and port values.
  • Malformed configuration data now produces clearer validation errors.

• Tests

  • Added coverage for valid configurations, invalid values, unknown settings, malformed JSON, and cleanup behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0d7f1bdc-ca75-437f-b08f-f8579acc4a73

📥 Commits

Reviewing files that changed from the base of the PR and between fdbff75 and 2bfa151.

📒 Files selected for processing (4)

• package.json
• src/local-agent-config.ts
• src/user-config.test.ts
• src/user-config.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds Zod schemas for user, authentication, and stored subagent configuration. JSON loading now validates data through these schemas. New tests cover valid and invalid configuration files, and the test script runs them.

Changes

Configuration validation

Layer / File(s)	Summary
Configuration schema contracts src/local-agent-config.ts, src/user-config.ts	Exports the subagent schemas and adds inferred schemas and types for user and authentication configuration.
Validated configuration loading src/local-agent-config.ts, src/user-config.ts	Parses structured subagent values and JSON configuration files through Zod validation.
Configuration loading tests src/user-config.test.ts, package.json	Tests successful loading, validation failures, malformed JSON, unknown settings, cleanup, and execution through the test script.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 2bfa1

The change adds focused validation for persisted configuration and authentication documents without any supplied evidence of a current correctness, security, availability, or deployment risk; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

A rabbit checks each config line,
With schemas neat and values fine.
Bad ports stop at the gate,
Good files load without debate.
Tests hop in the test command—
Validation now is planned.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: validating persisted configuration during loading.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/v11-config-seams

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR adds runtime decoding for persisted user and authentication configuration while retaining unknown extension fields.

• Exports reusable schemas for structured and legacy subagent configuration.
• Validates config.json and auth.json when loading them.
• Adds tests for valid documents, invalid known fields, unknown-field preservation, and malformed JSON.
• Adds the new user-configuration test to the test command.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The new persisted-document validation remains compatible with repository writers and legacy boolean subagent settings, preserves unknown extension fields, and introduces no problematic runtime import cycle.

Important Files Changed

Filename	Overview
src/user-config.ts	Replaces unchecked JSON casts with passthrough Zod schemas and reports parsing or validation failures through the existing file-read error boundary.
src/local-agent-config.ts	Exports the existing structured subagent schema and adds a reusable union schema supporting both legacy booleans and structured configuration.
src/user-config.test.ts	Covers successful config and auth decoding, known-field type rejection, unknown-field preservation, and malformed JSON handling.
package.json	Includes the new user-configuration test in the repository test sequence.

_{Reviews (1): Last reviewed commit: "fix(config): preserve legacy extension f..." | Re-trigger Greptile}