Audit: ./src/config

[avoidwork]

Audit Summary

Three files audited in ./src/config: mutate.js, loader.js, schemas.js.

Medium Severity

1. loader.js — Unhandled YAML parse error
   yaml.load() on line 139 has no try/catch. A malformed config.yaml will throw an unhandled exception, crashing the config loader at startup.

2. loader.js — In-memory/disk divergence on save failure
   setConfigValue() mutates the in-memory config object before calling saveConfig(). If writeFileSync fails (disk full, permissions, etc.), the in-memory state has already been mutated with no rollback.

Low Severity

3. loader.js — Duplicate parseValue implementation
   _parseValue() (line 36) duplicates the exported parseValue() from mutate.js. Should import and reuse.

4. schemas.js — Dead code: unused provider schemas
   _OpenaiProviderConfigSchema, _OpenrouterProviderConfigSchema, and _FalProviderConfigSchema are defined but never referenced in ConfigSchema. Leftover from a planned provider-specific config structure.

5. mutate.js — No object guard in assignPath
assignPath() does not validate that obj is a non-null object before mutating. Calling with null or undefined produces a confusing TypeError rather than a clear validation error.

Audit Table

File	Type	Severity	Summary
loader.js	bug	medium	yaml.load() has no try/catch — malformed YAML crashes config loader
loader.js	bug	medium	setConfigValue() mutates in-memory state before persisting — no rollback on save failure
loader.js	performance	low	_parseValue() duplicates parseValue() from mutate.js
schemas.js	performance	low	Three unused provider schemas (_OpenaiProviderConfigSchema, _OpenrouterProviderConfigSchema, _FalProviderConfigSchema)
mutate.js	bug	low	assignPath() lacks null/object guard on obj parameter

Files Audited

File	Lines
mutate.js	54
loader.js	171
schemas.js	281