chadstart 1.0.4 → 1.0.6

package/server/express-server.js

@@ -8,7 +8,7 @@ const express = require('express');
 const swaggerUi = require('swagger-ui-express');
 const rateLimit = require('express-rate-limit');
 
-const { loadYaml, saveYaml } = require('../core/yaml-loader');
+const { loadConfig, saveConfig, detectFormat, isWritableFormat } = require('../core/config-loader');
 const { validateSchema } = require('../core/schema-validator');
 const { buildCore } = require('../core/entity-engine');
 const { initDb, findAll, findAllSimple, create: dbCreate } = require('../core/db');
@@ -24,6 +24,9 @@ const { initErrorReporter, getRequestHandler, attachErrorHandler } = require('..
 const { getTelemetryConfig, initTelemetry } = require('../core/telemetry');
 const { setupFunctions, cleanup: cleanupFunctions } = require('../core/functions-engine');
 const { registerOAuthRoutes } = require('../core/oauth');
+const { initEmail, sendEmail, verifyConnection, getEmailStatus } = require('../core/email');
+const { initLogs, requestLoggerMiddleware, queryLogs, cleanupOldLogs } = require('../core/logs');
+const { createBackup, restoreBackup, listBackups } = require('../core/backup');
 const logger = require('../utils/logger');
 
 function limiter(windowMs, max) {
@@ -81,29 +84,43 @@ function buildApiLimiters(core) {
 }
 
 /**
- * Build an Express application for the given YAML config.
+ * Build an Express application for the given config file.
  *
- * @param {string}        yamlPath  Path to the chadstart.yaml file.
- * @param {Function|null} reloadFn  When provided, the PUT /admin/config route will
- *                                  trigger this callback after saving so the running
- *                                  server picks up the new config without a restart.
+ * @param {string}        configPath  Path to the config file (any supported format).
+ * @param {Function|null} reloadFn    When provided, the PUT /admin/config route will
+ *                                    trigger this callback after saving so the running
+ *                                    server picks up the new config without a restart.
  * @returns {{ app: import('express').Application, core: object }}
  */
-async function buildApp(yamlPath, reloadFn) {
-  const config = loadYaml(yamlPath);
+async function buildApp(configPath, reloadFn) {
+  const config = loadConfig(configPath);
   validateSchema(config);
   const core = buildCore(config);
+  const configFormat = detectFormat(configPath);
   logger.info(`Loading "${core.name}"...`);
 
   // Initialize OpenTelemetry (singleton — no-op on hot reload)
   const telConfig = getTelemetryConfig(core.telemetry);
   await initTelemetry(telConfig);
 
+  // Initialize email/SMTP service
+  initEmail(core.email);
+
   const dbPath = core.database
-    ? path.resolve(path.dirname(yamlPath), core.database)
+    ? path.resolve(path.dirname(configPath), core.database)
     : undefined;
   await initDb(core, dbPath);
   await initApiKeys();
+  await initLogs();
+
+  // Schedule periodic log cleanup
+  const logsCfg = core.logs || {};
+  const retentionDays = logsCfg.retention !== undefined ? logsCfg.retention : 30;
+  if (retentionDays > 0) {
+    // Run cleanup once at startup and then every 24 hours
+    cleanupOldLogs(retentionDays).catch(() => {});
+    setInterval(() => cleanupOldLogs(retentionDays).catch(() => {}), 24 * 60 * 60 * 1000).unref();
+  }
 
   initErrorReporter(core);
 
@@ -116,6 +133,10 @@ async function buildApp(yamlPath, reloadFn) {
   const sentryRequestHandler = getRequestHandler();
   if (sentryRequestHandler) app.use(sentryRequestHandler);
 
+  // Request logging middleware — placed after Sentry but before routes
+  const logExclude = (logsCfg.exclude || ['/health', '/admin/vendor']);
+  app.use(requestLoggerMiddleware({ exclude: logExclude }));
+
   // Public static files
   if (core.public && core.public.folder) {
     const publicDir = path.resolve(core.public.folder);
@@ -211,7 +232,7 @@ async function buildApp(yamlPath, reloadFn) {
   });
 
   // ── Admin config endpoints ────────────────────────────────────────────
-  // GET /admin/config — return the current YAML config as JSON (auth required)
+  // GET /admin/config — return the current config as JSON (auth required)
   app.get('/admin/config', adminRateLimiter, (req, res) => {
     const header = req.headers.authorization;
     if (!header || !header.startsWith('Bearer ')) {
@@ -221,13 +242,30 @@ async function buildApp(yamlPath, reloadFn) {
       return res.status(401).json({ error: 'Invalid token' });
     }
     try {
-      res.json(loadYaml(yamlPath));
+      res.set('X-Config-Format', configFormat);
+      res.json(loadConfig(configPath));
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
   });
 
-  // PUT /admin/config — receive JSON config, validate, save as YAML, then hot-reload
+  // GET /admin/config-info — return metadata about the config file
+  app.get('/admin/config-info', adminRateLimiter, (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+    try { verifyToken(header.slice(7)); } catch {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    res.json({
+      format: configFormat,
+      file: path.basename(configPath),
+      writable: isWritableFormat(configFormat),
+    });
+  });
+
+  // PUT /admin/config — receive JSON config, validate, save in original format, then hot-reload
   app.put('/admin/config', adminRateLimiter, (req, res) => {
     const header = req.headers.authorization;
     if (!header || !header.startsWith('Bearer ')) {
@@ -246,7 +284,7 @@ async function buildApp(yamlPath, reloadFn) {
       return res.status(400).json({ error: e.message });
     }
     try {
-      saveYaml(yamlPath, newConfig);
+      saveConfig(configPath, newConfig);
       if (reloadFn) {
         // Schedule hot reload after the response has been fully flushed
         res.on('finish', () => {
@@ -258,7 +296,44 @@ async function buildApp(yamlPath, reloadFn) {
       }
     } catch (e) {
       logger.error('Failed to save config:', e.message);
-      res.status(500).json({ error: 'Failed to save config' });
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // ── Admin email endpoints ──────────────────────────────────────────────
+  // GET /admin/email/status — check if SMTP is configured
+  app.get('/admin/email/status', adminRateLimiter, (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+    res.json(getEmailStatus());
+  });
+
+  // POST /admin/test-email — send a test email to verify SMTP configuration (auth required)
+  app.post('/admin/test-email', adminRateLimiter, async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+
+    const { to } = req.body || {};
+    if (!to || typeof to !== 'string') return res.status(400).json({ error: 'to (email address) is required' });
+
+    // First verify the SMTP connection
+    const verification = await verifyConnection();
+    if (!verification.success) return res.status(503).json(verification);
+
+    try {
+      const safeName = escAdminHtml(core.name);
+      await sendEmail({
+        to,
+        subject: 'ChadStart Test Email',
+        text: `This is a test email from your ChadStart application "${core.name}".\n\nIf you received this, your SMTP configuration is working correctly.`,
+        html: `<h2>ChadStart Test Email</h2><p>This is a test email from your ChadStart application <strong>&quot;${safeName}&quot;</strong>.</p><p>If you received this, your SMTP configuration is working correctly. &#x2705;</p>`,
+      });
+      res.json({ success: true, message: `Test email sent to ${to}` });
+    } catch (e) {
+      logger.error('Test email failed:', e.message);
+      res.status(502).json({ success: false, message: `Failed to send test email: ${e.message}` });
     }
   });
 
@@ -369,6 +444,62 @@ async function buildApp(yamlPath, reloadFn) {
     }
   });
 
+  // ── Admin logs endpoint ─────────────────────────────────────────────
+  app.get('/admin/logs', adminRateLimiter, async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+    try {
+      const { method, statusCode, path: filterPath, from, to, page, perPage, order } = req.query;
+      const result = await queryLogs(
+        { method, statusCode, path: filterPath, from, to },
+        { page, perPage, order }
+      );
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  // ── Admin backup endpoints ──────────────────────────────────────────
+  app.post('/admin/backup', adminRateLimiter, async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+    try {
+      const result = await createBackup(core.backup);
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/admin/restore', adminRateLimiter, async (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+    const { file } = req.body || {};
+    if (!file || typeof file !== 'string') return res.status(400).json({ error: 'file (backup filename) is required' });
+    try {
+      const result = await restoreBackup(file, core.backup);
+      if (!result.success) return res.status(404).json(result);
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.get('/admin/backups', adminRateLimiter, (req, res) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' });
+    try { verifyToken(header.slice(7)); } catch { return res.status(401).json({ error: 'Invalid token' }); }
+    try {
+      res.json(listBackups(core.backup));
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   // ── Admin seed endpoint ─────────────────────────────────────────────
   app.post('/admin/seed', adminRateLimiter, async (req, res) => {
     const header = req.headers.authorization;
@@ -503,14 +634,14 @@ async function buildApp(yamlPath, reloadFn) {
   return { app, core };
 }
 
-async function createServer(yamlPath) {
-  const { app, core } = await buildApp(yamlPath, null);
+async function createServer(configPath) {
+  const { app, core } = await buildApp(configPath, null);
   const server = http.createServer(app);
   initRealtime(server);
   return { app, server, core };
 }
 
-async function startServer(yamlPath) {
+async function startServer(configPath) {
   // ── Dispatcher pattern ───────────────────────────────────────────────
   // The HTTP server and WebSocket server are created once and never replaced.
   // Hot reload works by rebuilding the Express app and swapping the handler
@@ -523,7 +654,7 @@ async function startServer(yamlPath) {
 
   async function reload() {
     logger.info('Reloading config…');
-    const result = await buildApp(yamlPath, reload);
+    const result = await buildApp(configPath, reload);
     currentApp = result.app;
     logger.info(`Config loaded: "${result.core.name}"`);
     return result;

package/test/backup.test.js

@@ -0,0 +1,146 @@
+'use strict';
+
+const assert = require('assert');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const { buildCore } = require('../core/entity-engine');
+const dbModule = require('../core/db');
+const { getBackupDir, createBackup, restoreBackup, listBackups } = require('../core/backup');
+const { validateSchema } = require('../core/schema-validator');
+
+// ── Backup module ──────────────────────────────────────────────────────────
+
+describe('backup module', () => {
+  let tmpDb;
+  let tmpBackupDir;
+  const core = buildCore({
+    name: 'BackupTest',
+    entities: { Widget: { properties: ['name'] } },
+    backup: {},
+  });
+
+  before(async () => {
+    tmpDb = path.join(os.tmpdir(), `chadstart-backup-test-${Date.now()}.db`);
+    tmpBackupDir = path.join(os.tmpdir(), `chadstart-backups-${Date.now()}`);
+    await dbModule.initDb(core, tmpDb);
+  });
+
+  after(() => {
+    try { fs.unlinkSync(tmpDb); } catch { /* noop */ }
+    // Clean up backup dir
+    try {
+      if (fs.existsSync(tmpBackupDir)) {
+        for (const f of fs.readdirSync(tmpBackupDir)) {
+          fs.unlinkSync(path.join(tmpBackupDir, f));
+        }
+        fs.rmdirSync(tmpBackupDir);
+      }
+    } catch { /* noop */ }
+  });
+
+  it('getBackupDir creates directory', () => {
+    const dir = getBackupDir({ dir: tmpBackupDir });
+    assert.ok(fs.existsSync(dir));
+    assert.strictEqual(dir, tmpBackupDir);
+  });
+
+  it('getBackupDir uses default when no config', () => {
+    const dir = getBackupDir(null);
+    assert.ok(typeof dir === 'string');
+    assert.ok(dir.includes('backups'));
+    // Clean up the auto-created default dir
+    try { fs.rmdirSync(path.resolve('backups')); } catch { /* may not exist or not empty */ }
+  });
+
+  it('createBackup creates a backup file (SQLite)', async () => {
+    // Insert some data first
+    await dbModule.create('widget', { name: 'Backup Test Item' });
+
+    const result = await createBackup({ dir: tmpBackupDir });
+    assert.ok(result.file);
+    assert.ok(result.file.startsWith('backup-'));
+    assert.ok(result.file.endsWith('.db'));
+    assert.ok(result.size > 0);
+    assert.strictEqual(result.engine, 'sqlite');
+    assert.ok(fs.existsSync(result.path));
+  });
+
+  it('listBackups returns the backup we just created', () => {
+    const backups = listBackups({ dir: tmpBackupDir });
+    assert.ok(backups.length >= 1);
+    assert.ok(backups[0].file.startsWith('backup-'));
+    assert.ok(backups[0].size > 0);
+    assert.ok(backups[0].createdAt);
+  });
+
+  it('listBackups sorts newest first', async () => {
+    // Create a second backup
+    await createBackup({ dir: tmpBackupDir });
+    const backups = listBackups({ dir: tmpBackupDir });
+    assert.ok(backups.length >= 2);
+    // Newest first
+    assert.ok(backups[0].createdAt >= backups[1].createdAt);
+  });
+
+  it('listBackups returns empty for non-existent dir', () => {
+    const nonExistDir = path.join(os.tmpdir(), `nonexistent-${Date.now()}`);
+    const backups = listBackups({ dir: nonExistDir });
+    // getBackupDir creates the dir, so it returns empty array
+    assert.ok(Array.isArray(backups));
+    assert.strictEqual(backups.length, 0);
+    // Clean up
+    try { fs.rmdirSync(nonExistDir); } catch { /* noop */ }
+  });
+
+  it('restoreBackup fails for non-existent file', async () => {
+    const result = await restoreBackup('nonexistent.db', { dir: tmpBackupDir });
+    assert.strictEqual(result.success, false);
+    assert.ok(result.message.includes('not found'));
+  });
+
+  it('restoreBackup prevents path traversal', async () => {
+    const result = await restoreBackup('../../etc/passwd', { dir: tmpBackupDir });
+    assert.strictEqual(result.success, false);
+    // basename('../../etc/passwd') = 'passwd', which won't exist in backup dir
+    assert.ok(result.message.includes('not found'));
+  });
+});
+
+// ── Schema validation ───────────────────────────────────────────────────
+
+describe('schema: backup', () => {
+  it('accepts config without backup section', () => {
+    assert.strictEqual(validateSchema({ name: 'App' }), true);
+  });
+
+  it('accepts backup with dir', () => {
+    assert.strictEqual(validateSchema({ name: 'App', backup: { dir: 'my-backups' } }), true);
+  });
+
+  it('accepts empty backup object', () => {
+    assert.strictEqual(validateSchema({ name: 'App', backup: {} }), true);
+  });
+
+  it('rejects unknown backup key', () => {
+    assert.throws(() => validateSchema({
+      name: 'App',
+      backup: { schedule: '0 3 * * *' },
+    }));
+  });
+});
+
+// ── buildCore: backup passthrough ───────────────────────────────────────
+
+describe('buildCore: backup passthrough', () => {
+  it('exposes backup config when provided', () => {
+    const core = buildCore({ name: 'App', backup: { dir: 'my-backups' } });
+    assert.ok(core.backup);
+    assert.strictEqual(core.backup.dir, 'my-backups');
+  });
+
+  it('sets backup to null when not provided', () => {
+    const core = buildCore({ name: 'App' });
+    assert.strictEqual(core.backup, null);
+  });
+});

package/test/config-loader.test.js

@@ -0,0 +1,257 @@
+'use strict';
+
+const assert = require('assert');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const {
+  CONFIG_FILENAMES,
+  detectFormat,
+  isWritableFormat,
+  discoverConfigFile,
+  loadConfig,
+  saveConfig,
+  parseRaw,
+} = require('../core/config-loader');
+
+function tmpPath(ext) {
+  return path.join(os.tmpdir(), `chadstart-cl-${Date.now()}-${Math.random().toString(36).slice(2)}${ext}`);
+}
+
+describe('config-loader', () => {
+  // ── detectFormat ─────────────────────────────────────────────────────────
+  describe('detectFormat', () => {
+    it('detects .yaml as yaml', () => assert.strictEqual(detectFormat('app.yaml'), 'yaml'));
+    it('detects .yml as yaml', () => assert.strictEqual(detectFormat('app.yml'), 'yaml'));
+    it('detects .json as json', () => assert.strictEqual(detectFormat('app.json'), 'json'));
+    it('detects .json5 as json5', () => assert.strictEqual(detectFormat('app.json5'), 'json5'));
+    it('detects .jsonnet as jsonnet', () => assert.strictEqual(detectFormat('app.jsonnet'), 'jsonnet'));
+    it('detects .config.js as js', () => assert.strictEqual(detectFormat('chadstart.config.js'), 'js'));
+    it('detects .config.cjs as js', () => assert.strictEqual(detectFormat('chadstart.config.cjs'), 'js'));
+    it('defaults to yaml for unknown extensions', () => assert.strictEqual(detectFormat('app.txt'), 'yaml'));
+  });
+
+  // ── isWritableFormat ─────────────────────────────────────────────────────
+  describe('isWritableFormat', () => {
+    it('yaml is writable', () => assert.ok(isWritableFormat('yaml')));
+    it('json is writable', () => assert.ok(isWritableFormat('json')));
+    it('json5 is writable', () => assert.ok(isWritableFormat('json5')));
+    it('jsonnet is not writable', () => assert.ok(!isWritableFormat('jsonnet')));
+    it('js is not writable', () => assert.ok(!isWritableFormat('js')));
+  });
+
+  // ── discoverConfigFile ───────────────────────────────────────────────────
+  describe('discoverConfigFile', () => {
+    let tmpDir;
+
+    beforeEach(() => {
+      tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cs-disc-'));
+    });
+
+    afterEach(() => {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+
+    it('returns null when no config file exists', () => {
+      assert.strictEqual(discoverConfigFile(tmpDir), null);
+    });
+
+    it('discovers chadstart.yaml', () => {
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.yaml'), 'name: Test\n');
+      assert.strictEqual(discoverConfigFile(tmpDir), path.join(tmpDir, 'chadstart.yaml'));
+    });
+
+    it('discovers chadstart.json', () => {
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.json'), '{"name":"Test"}');
+      assert.strictEqual(discoverConfigFile(tmpDir), path.join(tmpDir, 'chadstart.json'));
+    });
+
+    it('discovers chadstart.json5', () => {
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.json5'), '{name:"Test"}');
+      assert.strictEqual(discoverConfigFile(tmpDir), path.join(tmpDir, 'chadstart.json5'));
+    });
+
+    it('prefers yaml over json when both exist', () => {
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.yaml'), 'name: YAML\n');
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.json'), '{"name":"JSON"}');
+      const found = discoverConfigFile(tmpDir);
+      assert.strictEqual(path.basename(found), 'chadstart.yaml');
+    });
+
+    it('falls back to json when yaml is absent', () => {
+      fs.writeFileSync(path.join(tmpDir, 'chadstart.json'), '{"name":"JSON"}');
+      const found = discoverConfigFile(tmpDir);
+      assert.strictEqual(path.basename(found), 'chadstart.json');
+    });
+  });
+
+  // ── loadConfig ───────────────────────────────────────────────────────────
+  describe('loadConfig', () => {
+    it('loads the existing chadstart.yaml', () => {
+      const config = loadConfig(path.resolve(__dirname, '..', 'chadstart.yaml'));
+      assert.strictEqual(typeof config.name, 'string');
+      assert.ok(config.entities);
+    });
+
+    it('throws on missing file', () => {
+      assert.throws(() => loadConfig('/nonexistent.yaml'), /not found/i);
+    });
+
+    it('loads a JSON config file', () => {
+      const tmp = tmpPath('.json');
+      fs.writeFileSync(tmp, JSON.stringify({ name: 'JSONApp', port: 4000 }), 'utf8');
+      try {
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'JSONApp');
+        assert.strictEqual(config.port, 4000);
+      } finally {
+        fs.unlinkSync(tmp);
+      }
+    });
+
+    it('loads a JSON5 config file', () => {
+      const tmp = tmpPath('.json5');
+      fs.writeFileSync(tmp, '{\n  // App name\n  name: "JSON5App",\n  port: 5000,\n}\n', 'utf8');
+      try {
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'JSON5App');
+        assert.strictEqual(config.port, 5000);
+      } finally {
+        fs.unlinkSync(tmp);
+      }
+    });
+
+    it('loads a .config.js config file', () => {
+      const tmp = path.join(os.tmpdir(), `chadstart-cl-${Date.now()}.config.js`);
+      fs.writeFileSync(tmp, 'module.exports = { name: "JSConfig", port: 6000 };\n', 'utf8');
+      try {
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'JSConfig');
+        assert.strictEqual(config.port, 6000);
+      } finally {
+        fs.unlinkSync(tmp);
+        try { delete require.cache[require.resolve(tmp)]; } catch { /* */ }
+      }
+    });
+
+    it('loads a YAML (.yml) config file', () => {
+      const tmp = tmpPath('.yml');
+      fs.writeFileSync(tmp, 'name: YMLApp\nport: 7000\n', 'utf8');
+      try {
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'YMLApp');
+        assert.strictEqual(config.port, 7000);
+      } finally {
+        fs.unlinkSync(tmp);
+      }
+    });
+  });
+
+  // ── saveConfig ───────────────────────────────────────────────────────────
+  describe('saveConfig', () => {
+    it('saves and round-trips a YAML file', () => {
+      const tmp = tmpPath('.yaml');
+      try {
+        saveConfig(tmp, { name: 'SaveYAML', port: 3000 });
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'SaveYAML');
+        assert.strictEqual(config.port, 3000);
+      } finally {
+        if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+      }
+    });
+
+    it('saves and round-trips a JSON file', () => {
+      const tmp = tmpPath('.json');
+      try {
+        saveConfig(tmp, { name: 'SaveJSON', port: 4000 });
+        const raw = fs.readFileSync(tmp, 'utf8');
+        assert.ok(raw.includes('"name"'), 'JSON file should contain double-quoted keys');
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'SaveJSON');
+        assert.strictEqual(config.port, 4000);
+      } finally {
+        if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+      }
+    });
+
+    it('saves and round-trips a JSON5 file', () => {
+      const tmp = tmpPath('.json5');
+      try {
+        saveConfig(tmp, { name: 'SaveJSON5', port: 5000 });
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.name, 'SaveJSON5');
+        assert.strictEqual(config.port, 5000);
+      } finally {
+        if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+      }
+    });
+
+    it('throws for read-only formats (js)', () => {
+      const tmp = path.join(os.tmpdir(), `chadstart-cl-${Date.now()}.config.js`);
+      assert.throws(
+        () => saveConfig(tmp, { name: 'Nope' }),
+        /read-only/i,
+      );
+    });
+
+    it('throws for read-only formats (jsonnet)', () => {
+      const tmp = tmpPath('.jsonnet');
+      assert.throws(
+        () => saveConfig(tmp, { name: 'Nope' }),
+        /read-only/i,
+      );
+    });
+
+    it('preserves YAML comments in unchanged sections', () => {
+      const tmp = tmpPath('.yaml');
+      try {
+        fs.writeFileSync(tmp, '# App name\nname: Blog\n\n# Port\nport: 3000\n', 'utf8');
+        saveConfig(tmp, { name: 'Blog', port: 4000 });
+        const raw = fs.readFileSync(tmp, 'utf8');
+        assert.ok(raw.includes('# App name'), 'Comment on name should be preserved');
+        assert.ok(raw.includes('# Port'), 'Comment on port should be preserved');
+        const config = loadConfig(tmp);
+        assert.strictEqual(config.port, 4000);
+      } finally {
+        if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+      }
+    });
+  });
+
+  // ── parseRaw ─────────────────────────────────────────────────────────────
+  describe('parseRaw', () => {
+    it('parses raw YAML', () => {
+      const obj = parseRaw('name: Test\nport: 3000\n', 'yaml');
+      assert.strictEqual(obj.name, 'Test');
+    });
+
+    it('parses raw JSON', () => {
+      const obj = parseRaw('{"name":"Test","port":3000}', 'json');
+      assert.strictEqual(obj.name, 'Test');
+    });
+
+    it('parses raw JSON5', () => {
+      const obj = parseRaw('{name:"Test",port:3000}', 'json5');
+      assert.strictEqual(obj.name, 'Test');
+    });
+
+    it('defaults to YAML for unknown format', () => {
+      const obj = parseRaw('name: Fallback\n', 'unknown');
+      assert.strictEqual(obj.name, 'Fallback');
+    });
+  });
+
+  // ── CONFIG_FILENAMES ─────────────────────────────────────────────────────
+  describe('CONFIG_FILENAMES', () => {
+    it('includes yaml, yml, json, json5, jsonnet, and js formats', () => {
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.yaml'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.yml'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.json'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.json5'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.jsonnet'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.config.js'));
+      assert.ok(CONFIG_FILENAMES.includes('chadstart.config.cjs'));
+    });
+  });
+});