Continue GC code review: Pydantic

tests/test_config.py

@@ -24,7 +24,7 @@ class TestSettingsLoading:
         """Settings constructs when OPENROUTER_API_KEY is provided."""
         monkeypatch.setenv("OPENROUTER_API_KEY", "test-key-xyz")
         settings = Settings()
-        assert settings.openrouter_api_key == "test-key-xyz"
+        assert settings.openrouter_api_key.get_secret_value() == "test-key-xyz"
 
     def test_requires_api_key(self, monkeypatch):
         """Settings raises ValidationError when OPENROUTER_API_KEY is missing."""
@@ -52,7 +52,7 @@ class TestSettingsLoading:
             ]
         )
 
-        assert settings.openrouter_api_key == "test-key"
+        assert settings.openrouter_api_key.get_secret_value() == "test-key"
         assert settings.port == 8123
         assert settings.reload is True
 
@@ -77,6 +77,29 @@ class TestProviderSettings:
         assert settings.openrouter_http_referer is None
         assert settings.openrouter_app_title is None
 
+    @pytest.mark.parametrize(
+        ("field", "value"),
+        [
+            ("transcription_temperature", -0.1),
+            ("transcription_temperature", 2.1),
+            ("transcription_top_p", -0.1),
+            ("transcription_top_p", 1.1),
+        ],
+    )
+    def test_rejects_sampling_values_outside_provider_ranges(self, field, value):
+        with pytest.raises(ValidationError):
+            _make_settings(**{field: value})
+
+    def test_rejects_prompt_paths_outside_prompt_directory(self):
+        with pytest.raises(ValidationError):
+            _make_settings(default_prompt_name="../secret.md")
+
+    def test_settings_are_immutable_runtime_snapshots(self):
+        settings = _make_settings()
+
+        with pytest.raises(ValidationError):
+            settings.port = 9000
+
     def test_provider_model_accepts_env_default(self, monkeypatch):
         """provider_model is sourced when provided through environment configuration."""
         monkeypatch.setenv("PROVIDER_MODEL", "google/gemini-2.5-flash")