feat(config): use EditableJson for non-destructive config saving

Use EditableJson for preserving existing properties and key order when
updating config values. This prevents overwriting unrelated config
properties during partial updates.

- Add standalone EditableJson implementation in src/utils/editable-json.mts
- Update config.mts to use EditableJson for config file writes
- Fix socketAppDataPath usage to include config.json filename
- Add resetConfigForTesting() helper for test isolation
- Update tests to use Node.js built-in fs functions

Author: jdalton

src/utils/config.mts

@@ -31,6 +31,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 import { naturalCompare } from '@socketsecurity/registry/lib/sorts'
 
 import { debugConfig } from './debug.mts'
+import { getEditableJsonClass } from './editable-json.mts'
 import constants, {
   CONFIG_KEY_API_BASE_URL,
   CONFIG_KEY_API_PROXY,
@@ -98,17 +99,18 @@ function getConfigValues(): LocalConfig {
     _cachedConfig = {} as LocalConfig
     const { socketAppDataPath } = constants
     if (socketAppDataPath) {
-      const raw = safeReadFileSync(socketAppDataPath)
+      const configFilePath = path.join(socketAppDataPath, 'config.json')
+      const raw = safeReadFileSync(configFilePath)
       if (raw) {
         try {
           Object.assign(
             _cachedConfig,
             JSON.parse(Buffer.from(raw, 'base64').toString()),
           )
-          debugConfig(socketAppDataPath, true)
+          debugConfig(configFilePath, true)
         } catch (e) {
-          logger.warn(`Failed to parse config at ${socketAppDataPath}`)
-          debugConfig(socketAppDataPath, false, e)
+          logger.warn(`Failed to parse config at ${configFilePath}`)
+          debugConfig(configFilePath, false, e)
         }
         // Normalize apiKey to apiToken and persist it.
         // This is a one time migration per user.
@@ -118,7 +120,7 @@ function getConfigValues(): LocalConfig {
           updateConfigValue(CONFIG_KEY_API_TOKEN, token)
         }
       } else {
-        mkdirSync(path.dirname(socketAppDataPath), { recursive: true })
+        mkdirSync(socketAppDataPath, { recursive: true })
       }
     }
   }
@@ -243,6 +245,16 @@ let _cachedConfig: LocalConfig | undefined
 // When using --config or SOCKET_CLI_CONFIG, do not persist the config.
 let _configFromFlag = false
 
+/**
+ * Reset config cache for testing purposes.
+ * This allows tests to start with a fresh config state.
+ * @internal
+ */
+export function resetConfigForTesting(): void {
+  _cachedConfig = undefined
+  _configFromFlag = false
+}
+
 export function overrideCachedConfig(jsonConfig: unknown): CResult<undefined> {
   debugFn('notice', 'override: full config (not stored)')
 
@@ -338,13 +350,44 @@ export function updateConfigValue<Key extends keyof LocalConfig>(
 
   if (!_pendingSave) {
     _pendingSave = true
+    // Capture the current config state to save.
+    const configToSave = { ...localConfig }
     process.nextTick(() => {
       _pendingSave = false
       const { socketAppDataPath } = constants
       if (socketAppDataPath) {
+        mkdirSync(socketAppDataPath, { recursive: true })
+        const configFilePath = path.join(socketAppDataPath, 'config.json')
+        // Read existing file to preserve formatting, then update with new values.
+        const existingRaw = safeReadFileSync(configFilePath)
+        const EditableJson = getEditableJsonClass<LocalConfig>()
+        const editor = new EditableJson()
+        if (existingRaw !== undefined) {
+          const rawString = Buffer.isBuffer(existingRaw)
+            ? existingRaw.toString('utf8')
+            : existingRaw
+          try {
+            const decoded = Buffer.from(rawString, 'base64').toString('utf8')
+            editor.fromJSON(decoded)
+          } catch {
+            // If decoding fails, start fresh.
+          }
+        } else {
+          // Initialize empty editor for new file.
+          editor.create(configFilePath)
+        }
+        // Update with the captured config state.
+        editor.update(configToSave)
+        // Get content with formatting symbols stripped.
+        const contentToSave = Object.fromEntries(
+          Object.entries(editor.content).filter(
+            ([key]) => typeof key === 'string',
+          ),
+        )
+        const jsonContent = JSON.stringify(contentToSave)
         writeFileSync(
-          socketAppDataPath,
-          Buffer.from(JSON.stringify(localConfig)).toString('base64'),
+          configFilePath,
+          Buffer.from(jsonContent).toString('base64'),
         )
       }
     })

src/utils/config.test.mts

@@ -1,16 +1,26 @@
-import { promises as fs, mkdtempSync } from 'node:fs'
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+  promises as fs,
+} from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 
 import {
   findSocketYmlSync,
+  getConfigValue,
   overrideCachedConfig,
+  resetConfigForTesting,
   updateConfigValue,
 } from './config.mts'
 import { testPath } from '../../test/utils.mts'
 
+import type { LocalConfig } from './config.mts'
+
 const fixtureBaseDir = path.join(testPath, 'fixtures/utils/config')
 
 describe('utils/config', () => {
@@ -80,7 +90,7 @@ describe('utils/config', () => {
         expect(result.data).toBe(undefined)
       } finally {
         // Clean up the temporary directory.
-        await fs.rm(tmpDir, { force: true, recursive: true })
+        rmSync(tmpDir, { force: true, recursive: true })
       }
     })
   })