Onboard: require explicit mode for env secret refs

src/commands/onboard.test.ts

@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { RuntimeEnv } from "../runtime.js";
+
+const mocks = vi.hoisted(() => ({
+  runInteractiveOnboarding: vi.fn(async () => {}),
+  runNonInteractiveOnboarding: vi.fn(async () => {}),
+}));
+
+vi.mock("./onboard-interactive.js", () => ({
+  runInteractiveOnboarding: mocks.runInteractiveOnboarding,
+}));
+
+vi.mock("./onboard-non-interactive.js", () => ({
+  runNonInteractiveOnboarding: mocks.runNonInteractiveOnboarding,
+}));
+
+const { onboardCommand } = await import("./onboard.js");
+
+function makeRuntime(): RuntimeEnv {
+  return {
+    log: vi.fn(),
+    error: vi.fn(),
+    exit: vi.fn() as unknown as RuntimeEnv["exit"],
+  };
+}
+
+describe("onboardCommand", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("fails fast for invalid secret-input-mode before onboarding starts", async () => {
+    const runtime = makeRuntime();
+
+    await onboardCommand(
+      {
+        secretInputMode: "invalid" as never,
+      },
+      runtime,
+    );
+
+    expect(runtime.error).toHaveBeenCalledWith(
+      'Invalid --secret-input-mode. Use "plaintext" or "ref".',
+    );
+    expect(runtime.exit).toHaveBeenCalledWith(1);
+    expect(mocks.runInteractiveOnboarding).not.toHaveBeenCalled();
+    expect(mocks.runNonInteractiveOnboarding).not.toHaveBeenCalled();
+  });
+});