fix(config): addresses code review findings

- inlines one-use keysProvided variable in updateConfig
- adds updateRateLimitFromHeaders unit tests (valid, missing, malformed header)
- adds safePositiveInt edge case tests (zero, negative limit fallback)
- documents resetConfig() safety outside reactive root

Author: wgordon17

src/app/stores/config.ts

@@ -76,8 +76,9 @@ export function updateConfig(partial: Partial<Config>): void {
   // Only merge keys the caller actually provided: Zod .partial().safeParse()
   // still applies per-field .default() values for absent keys, inflating
   // validated.data with defaults that would overwrite live state.
-  const keysProvided = Object.keys(partial) as (keyof Config)[];
-  const filtered = Object.fromEntries(keysProvided.map((k) => [k, validated.data[k]]));
+  const filtered = Object.fromEntries(
+    (Object.keys(partial) as (keyof Config)[]).map((k) => [k, validated.data[k]])
+  );
   setConfig(
     produce((draft) => {
       Object.assign(draft, filtered);

tests/services/github.test.ts

@@ -1,7 +1,7 @@
 import "fake-indexeddb/auto";
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { createRoot } from "solid-js";
-import { createGitHubClient, cachedRequest, getClient, initClientWatcher, getGraphqlRateLimit, updateGraphqlRateLimit } from "../../src/app/services/github";
+import { createGitHubClient, cachedRequest, getClient, initClientWatcher, getGraphqlRateLimit, updateGraphqlRateLimit, updateRateLimitFromHeaders, getCoreRateLimit } from "../../src/app/services/github";
 import { clearCache } from "../../src/app/stores/cache";
 
 // ── createGitHubClient ───────────────────────────────────────────────────────
@@ -328,4 +328,56 @@ describe("getGraphqlRateLimit", () => {
     expect(rl!.limit).toBe(5000);
     expect(rl!.remaining).toBe(3000);
   });
+
+  it("falls back to previous limit when zero is provided", () => {
+    updateGraphqlRateLimit({ limit: 5000, remaining: 100, resetAt: "2024-06-01T12:00:00Z" });
+    updateGraphqlRateLimit({ limit: 0, remaining: 50, resetAt: "2024-06-01T13:00:00Z" });
+    const rl = getGraphqlRateLimit();
+    expect(rl!.limit).toBe(5000);
+    expect(rl!.remaining).toBe(50);
+  });
+
+  it("falls back to previous limit when negative is provided", () => {
+    updateGraphqlRateLimit({ limit: 10000, remaining: 100, resetAt: "2024-06-01T12:00:00Z" });
+    updateGraphqlRateLimit({ limit: -1, remaining: 50, resetAt: "2024-06-01T13:00:00Z" });
+    const rl = getGraphqlRateLimit();
+    expect(rl!.limit).toBe(10000);
+  });
+});
+
+// ── updateRateLimitFromHeaders ───────────────────────────────────────────────
+
+describe("updateRateLimitFromHeaders", () => {
+  it("parses limit from x-ratelimit-limit header", () => {
+    updateRateLimitFromHeaders({
+      "x-ratelimit-remaining": "4500",
+      "x-ratelimit-reset": String(Math.floor(Date.now() / 1000) + 3600),
+      "x-ratelimit-limit": "10000",
+    });
+    const rl = getCoreRateLimit();
+    expect(rl).not.toBeNull();
+    expect(rl!.limit).toBe(10000);
+    expect(rl!.remaining).toBe(4500);
+  });
+
+  it("falls back to 5000 when x-ratelimit-limit header is absent", () => {
+    updateRateLimitFromHeaders({
+      "x-ratelimit-remaining": "4999",
+      "x-ratelimit-reset": String(Math.floor(Date.now() / 1000) + 3600),
+    });
+    const rl = getCoreRateLimit();
+    expect(rl).not.toBeNull();
+    expect(rl!.limit).toBe(5000);
+  });
+
+  it("falls back to 5000 when x-ratelimit-limit header is malformed", () => {
+    updateRateLimitFromHeaders({
+      "x-ratelimit-remaining": "4999",
+      "x-ratelimit-reset": String(Math.floor(Date.now() / 1000) + 3600),
+      "x-ratelimit-limit": "abc",
+    });
+    const rl = getCoreRateLimit();
+    expect(rl).not.toBeNull();
+    expect(rl!.limit).toBe(5000);
+  });
 });

tests/stores/config.test.ts

@@ -213,6 +213,7 @@ describe("store merge behavior (produce + Object.assign)", () => {
 });
 
 describe("updateConfig (real export)", () => {
+  // resetConfig() only calls setConfig(defaults) — no reactive effects, safe outside a root
   beforeEach(() => {
     resetConfig();
   });