@canonical/pragma-cli 0.30.0 → 0.32.0

package/src/capabilities/config/field.test.ts

@@ -0,0 +1,188 @@
+/**
+ * `config tier` / `channel` / `detail` — storeless, covenant-exact setters.
+ *
+ * Pins the emitted shape against the golden slice, exercises set / reset-sentinel
+ * / enum-reject / `--dry-run` plan / MCP plan-first-vs-confirm, and holds the
+ * storeless invariant (a config write never boots the store).
+ */
+
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { globalConfigPath } from "../../kernel/config/paths.js";
+import { CHANNELS } from "../../kernel/config/types.js";
+import { PragmaError } from "../../kernel/error/PragmaError.js";
+import {
+  executeVerb,
+  extractParams,
+} from "../../kernel/project/cli/dispatch.js";
+import { bootRuntime } from "../../kernel/runtime/boot.js";
+import type { GlobalFlags, PragmaRuntime } from "../../kernel/runtime/types.js";
+import { emitVerb } from "../../kernel/spec/emitSurface.js";
+import type { VerbSpec } from "../../kernel/spec/types.js";
+import { projectMcp } from "../../testing/helpers/projectMcp.js";
+import { CONFIG_FIELDS } from "./fields.js";
+import { configModule } from "./index.js";
+import { runField } from "./runField.js";
+
+const FLAGS: GlobalFlags = {
+  llm: false,
+  autoLlm: false,
+  format: "plain",
+  verbose: false,
+};
+const REAL = { dryRun: false, undo: false, yes: false };
+const DRY = { dryRun: true, undo: false, yes: false };
+
+const verbOf = (field: string): VerbSpec =>
+  configModule.verbs.find((v) => v.path[1] === field) as VerbSpec;
+const tierVerb = verbOf("tier");
+const channelVerb = verbOf("channel");
+const detailVerb = verbOf("detail");
+
+let prevXdg: string | undefined;
+const roots: string[] = [];
+const tmp = (prefix: string): string => {
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  roots.push(dir);
+  return dir;
+};
+
+beforeEach(() => {
+  prevXdg = process.env.XDG_CONFIG_HOME;
+  process.env.XDG_CONFIG_HOME = tmp("pragma-cfgfield-xdg-");
+});
+afterEach(() => {
+  process.env.XDG_CONFIG_HOME = prevXdg;
+  for (const dir of roots) rmSync(dir, { recursive: true, force: true });
+  roots.length = 0;
+});
+
+function readGlobal(): Record<string, unknown> {
+  return JSON.parse(readFileSync(globalConfigPath(), "utf-8"));
+}
+
+describe("config setters — covenant-exact emission (PROTECTED)", () => {
+  it("emits the golden slice for each field", () => {
+    expect(emitVerb(tierVerb)).toEqual({
+      v: "tier",
+      args: ["<path>"],
+      mutates: true,
+      mcp: "config_tier",
+    });
+    expect(emitVerb(channelVerb)).toEqual({
+      v: "channel",
+      args: ["<name>"],
+      mutates: true,
+      mcp: "config_channel",
+    });
+    expect(emitVerb(detailVerb)).toEqual({
+      v: "detail",
+      args: ["<level>"],
+      mutates: true,
+      mcp: "config_detail",
+    });
+  });
+});
+
+describe("config setters — write & reset", () => {
+  it("set writes the field to the GLOBAL config and never boots the store", async () => {
+    const rt: PragmaRuntime = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    const outcome = await executeVerb(tierVerb, { path: "apps/lxd" }, REAL, rt);
+
+    expect(outcome.exitCode).toBe(0);
+    expect(outcome.stdout).toContain("Set tier = apps/lxd");
+    expect(readGlobal().tier).toBe("apps/lxd");
+    // Storeless invariant: a config write never touches the store factory.
+    expect(rt.store.booted).toBe(false);
+  });
+
+  it("channel/detail write their enum value", async () => {
+    const rt = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    await executeVerb(channelVerb, { name: "experimental" }, REAL, rt);
+    await executeVerb(detailVerb, { level: "detailed" }, REAL, rt);
+    const written = readGlobal();
+    expect(written.channel).toBe("experimental");
+    expect(written.detail).toBe("detailed");
+  });
+
+  it("a reset sentinel removes the tier field", async () => {
+    const cwd = tmp("pragma-proj-");
+    await executeVerb(
+      tierVerb,
+      { path: "apps/lxd" },
+      REAL,
+      bootRuntime(FLAGS, cwd),
+    );
+    expect(readGlobal().tier).toBe("apps/lxd");
+
+    const outcome = await executeVerb(
+      tierVerb,
+      { path: "none" },
+      REAL,
+      bootRuntime(FLAGS, cwd),
+    );
+    expect(outcome.stdout).toContain("Reset tier");
+    expect("tier" in readGlobal()).toBe(false);
+  });
+});
+
+describe("config setters — enum rejection", () => {
+  it("the CLI coerce layer rejects a non-member with INVALID_INPUT + validOptions", () => {
+    let caught: unknown;
+    try {
+      extractParams(channelVerb.params, ["bogus"], {});
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(PragmaError);
+    expect((caught as PragmaError).code).toBe("INVALID_INPUT");
+    expect((caught as PragmaError).validOptions).toEqual([...CHANNELS]);
+  });
+
+  it("runField backstops a bad enum value before it reaches disk", () => {
+    const channelSpec = CONFIG_FIELDS.find((s) => s.field === "channel");
+    expect(() =>
+      runField(channelSpec as (typeof CONFIG_FIELDS)[number], {
+        name: "bogus",
+      }),
+    ).toThrow(/Invalid channel/);
+  });
+});
+
+describe("config setters — dry-run plan", () => {
+  it("--dry-run shows the WriteFile plan and writes nothing", async () => {
+    const rt = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    const outcome = await executeVerb(tierVerb, { path: "apps/lxd" }, DRY, rt);
+
+    expect(outcome.exitCode).toBe(0);
+    expect(outcome.stdout).toContain("Write file");
+    expect(outcome.stdout).toContain(globalConfigPath());
+    expect(existsSync(globalConfigPath())).toBe(false);
+  });
+});
+
+describe("config setters — MCP plan-first / confirm parity", () => {
+  it("config_tier returns a plan without confirm, writes with confirm:true", async () => {
+    const cwd = tmp("pragma-proj-");
+    const mcp = await projectMcp([configModule], cwd);
+
+    const plan = await mcp.callTool("config_tier", { path: "apps/lxd" });
+    expect(plan.ok).toBe(true);
+    expect(plan.meta).toMatchObject({ planOnly: true, confirmRequired: true });
+    const planLines = (plan.data as { plan: string[] }).plan;
+    expect(planLines.some((line) => line.includes("Write file"))).toBe(true);
+    expect(existsSync(globalConfigPath())).toBe(false);
+
+    const done = await mcp.callTool("config_tier", {
+      path: "apps/lxd",
+      confirm: true,
+    });
+    await mcp.cleanup();
+
+    expect(done.ok).toBe(true);
+    expect(done.data).toMatchObject({ field: "tier", value: "apps/lxd" });
+    expect(readGlobal().tier).toBe("apps/lxd");
+  });
+});

package/src/capabilities/config/fields.ts

@@ -0,0 +1,152 @@
+/**
+ * The config field table — one declarative row per writable field drives all
+ * three setters (`tier` / `channel` / `detail`), the way the pack grammar
+ * compiles read verbs from a table.
+ *
+ * Covenant-exact emission is the hard gate (surfaceConformance): each verb must
+ * `emitVerb` to `{ v:<field>, args:["<positional>"], mutates:true,
+ * mcp:"config_<field>" }` — one REQUIRED positional, NO flags, NO needsStore
+ * (config setters are storeless; the old store-backed `validateTier` is dropped
+ * — PARITY_GAP `config-tier-no-ontology-validation`). The factory produces
+ * exactly that shape; the `field.test.ts` deep-equals the golden slice.
+ */
+
+import type { Task } from "@canonical/task";
+import { DETAIL_LEVELS } from "../../constants.js";
+import type { RawConfig } from "../../kernel/config/types.js";
+import { CHANNELS } from "../../kernel/config/types.js";
+import { asVerb } from "../../kernel/spec/asVerb.js";
+import type { ParamSpec, VerbSpec } from "../../kernel/spec/types.js";
+import { configFieldFormatters } from "./field.render.js";
+import type { ConfigFieldResult } from "./types.js";
+
+/** One writable config field and how its single positional is shaped/validated. */
+export interface ConfigFieldSpec {
+  /** The `RawConfig` key written (also the verb label + `config_<field>` tool). */
+  readonly field: keyof RawConfig & ("tier" | "channel" | "detail");
+  /** The positional param NAME — its usage token is `<positional>` (covenant). */
+  readonly positional: string;
+  /** A free string (`tier`) or a fixed enum (`channel` / `detail`). */
+  readonly kind: "string" | "enum";
+  /** The allowed values for an enum field. */
+  readonly values?: readonly string[];
+  /** One-line verb summary. */
+  readonly summary: string;
+  /** Extended help doc. */
+  readonly doc: string;
+  /** Reserved values that REMOVE the field instead of setting it. */
+  readonly resetSentinel?: readonly string[];
+  /** Verb help examples. */
+  readonly examples: readonly { cmd: string; note?: string }[];
+}
+
+/**
+ * The three writable fields. Only `tier` (a free string with a meaningful
+ * "no value") carries reset sentinels; `channel`/`detail` reset by setting
+ * their default (`normal`/`standard`) — no `--reset` flag exists, because a
+ * flag would emit `flags:[...]` and break the covenant (PARITY_GAP
+ * `config-field-reset-sentinel`). Query is `config show` — the covenant gives
+ * each setter exactly ONE required positional, so a no-arg "print current" mode
+ * is impossible here (PARITY_GAP `config-field-query-via-show`).
+ */
+export const CONFIG_FIELDS: readonly ConfigFieldSpec[] = [
+  {
+    field: "tier",
+    positional: "path",
+    kind: "string",
+    resetSentinel: ["none", "default", "-"],
+    summary: "Set the active design-system tier.",
+    doc: "Writes the `tier` field to the global config. Pass `none`, `default`, or `-` to clear it. Written to the global layer only — project configs are authored by hand.",
+    examples: [
+      { cmd: "pragma config tier apps/lxd", note: "scope reads to a tier" },
+      { cmd: "pragma config tier none", note: "clear the tier" },
+    ],
+  },
+  {
+    field: "channel",
+    positional: "name",
+    kind: "enum",
+    values: CHANNELS,
+    summary: "Set the release channel controlling component visibility.",
+    doc: "Writes the `channel` field to the global config. Reset by setting the default, `normal`.",
+    examples: [
+      { cmd: "pragma config channel experimental" },
+      { cmd: "pragma config channel normal", note: "back to the default" },
+    ],
+  },
+  {
+    field: "detail",
+    positional: "level",
+    kind: "enum",
+    values: DETAIL_LEVELS,
+    summary: "Set the default progressive-disclosure level.",
+    doc: "Writes the `detail` field to the global config. Reset by setting the default, `standard`.",
+    examples: [
+      { cmd: "pragma config detail detailed" },
+      { cmd: "pragma config detail standard", note: "back to the default" },
+    ],
+  },
+];
+
+/** The single required positional for a field, shaped per its `kind`. */
+function fieldPositional(spec: ConfigFieldSpec): ParamSpec {
+  // Name the positional by its usage token (`<path>`/`<name>`/`<level>`) so the
+  // doc and the token agree (was "The tier value to write." for a `<path>`).
+  const doc = `The ${spec.field} ${spec.positional} to write.`;
+  if (spec.kind === "enum") {
+    return {
+      kind: "enum",
+      name: spec.positional,
+      doc,
+      values: spec.values ?? [],
+      required: true,
+      positional: true,
+    };
+  }
+  return {
+    kind: "string",
+    name: spec.positional,
+    doc,
+    required: true,
+    positional: true,
+  };
+}
+
+/**
+ * Build one storeless, mutating config setter from a field spec.
+ *
+ * `run` lazily imports the write body and presents `Promise<Task<R>>` through
+ * the `Task<R>` arm by the honest cast (the same seam `sources update` uses) —
+ * a literal `Promise<Task>` union arm would poison async read-verb inference.
+ *
+ * @param spec - The field-table row.
+ * @returns The verb spec for `config <field>`.
+ */
+export function fieldVerb(
+  spec: ConfigFieldSpec,
+): VerbSpec<Record<string, unknown>, ConfigFieldResult> {
+  return {
+    path: ["config", spec.field],
+    summary: spec.summary,
+    doc: spec.doc,
+    params: [fieldPositional(spec)],
+    output: { formatters: configFieldFormatters },
+    examples: [...spec.examples],
+    capability: {
+      needsStore: false,
+      mutates: true,
+      mcp: {
+        expose: true,
+        annotations: { readOnlyHint: false, openWorldHint: false },
+      },
+    },
+    run: (params) =>
+      import("./runField.js").then((m) =>
+        m.runField(spec, params),
+      ) as unknown as Task<ConfigFieldResult>,
+  };
+}
+
+/** The three config setters, in covenant order (tier, channel, detail). */
+export const configFieldVerbs: VerbSpec[] =
+  CONFIG_FIELDS.map(fieldVerb).map(asVerb);

package/src/capabilities/config/index.ts

@@ -0,0 +1,6 @@
+/**
+ * The `config` capability barrel.
+ */
+
+export { configModule } from "./show.verb.js";
+export type { ConfigFieldResult, ConfigShowData } from "./types.js";

package/src/capabilities/config/runField.ts

@@ -0,0 +1,59 @@
+/**
+ * The `config <field>` write body (lazily imported, off the fast path).
+ *
+ * Resolves the single positional and composes the write as a Task over the
+ * kernel `writeConfigField` (global-layer only): a reset sentinel removes the
+ * field (`writeConfigField(field, undefined)`), otherwise the value is written.
+ * An enum field re-validates its value as a belt-and-braces backstop — the CLI
+ * `coerceParam` and the MCP zod schema already reject a non-member before `run`,
+ * but a direct call (a test, a future caller) must not slip an invalid value to
+ * disk.
+ */
+
+import { map, type Task } from "@canonical/task";
+import { writeConfigField } from "../../kernel/config/writeConfigField.js";
+import { PragmaError } from "../../kernel/error/PragmaError.js";
+import type { ConfigFieldSpec } from "./fields.js";
+import type { ConfigFieldResult } from "./types.js";
+
+/**
+ * Build the Task that writes (or resets) one config field.
+ *
+ * @param spec - The field-table row for the target field.
+ * @param params - The coerced param bag (carries the single positional).
+ * @returns A Task yielding the write outcome.
+ * @throws PragmaError INVALID_INPUT for an out-of-set enum value (backstop).
+ */
+export function runField(
+  spec: ConfigFieldSpec,
+  params: Record<string, unknown>,
+): Task<ConfigFieldResult> {
+  const value = String(params[spec.positional] ?? "");
+
+  if (spec.resetSentinel?.includes(value)) {
+    return map(
+      writeConfigField(spec.field, undefined),
+      (result): ConfigFieldResult => ({
+        field: result.field,
+        path: result.path,
+        reset: true,
+      }),
+    );
+  }
+
+  if (spec.kind === "enum" && !(spec.values ?? []).includes(value)) {
+    throw PragmaError.invalidInput(spec.field, value, {
+      validOptions: [...(spec.values ?? [])],
+    });
+  }
+
+  return map(
+    writeConfigField(spec.field, value),
+    (result): ConfigFieldResult => ({
+      field: result.field,
+      value,
+      path: result.path,
+      reset: false,
+    }),
+  );
+}

package/src/capabilities/config/runSet.ts

@@ -0,0 +1,38 @@
+/**
+ * The `config set <key> <value>` write body (lazily imported, off the fast path).
+ *
+ * `config set` is the single-command form of the per-field setters: it resolves
+ * `<key>` to its {@link ConfigFieldSpec} and delegates to the SAME
+ * {@link runField} write path, so reset sentinels, enum re-validation, and the
+ * global-layer write all behave identically to `config <field>`. An unknown key
+ * is a backstop INVALID_INPUT — the CLI enum coerce and the MCP schema already
+ * reject a non-member first, but a direct call must not slip through.
+ */
+
+import type { Task } from "@canonical/task";
+import { PragmaError } from "../../kernel/error/PragmaError.js";
+import { CONFIG_FIELDS } from "./fields.js";
+import { runField } from "./runField.js";
+import type { ConfigFieldResult } from "./types.js";
+
+/**
+ * Build the Task that writes (or resets) the config field named by `<key>`.
+ *
+ * @param params - The coerced param bag: `key` (field name) and `value`.
+ * @returns A Task yielding the write outcome.
+ * @throws PragmaError INVALID_INPUT for an unknown key (backstop).
+ */
+export function runSet(
+  params: Record<string, unknown>,
+): Task<ConfigFieldResult> {
+  const key = String(params.key ?? "");
+  const spec = CONFIG_FIELDS.find((field) => field.field === key);
+  if (!spec) {
+    throw PragmaError.invalidInput("key", key, {
+      validOptions: CONFIG_FIELDS.map((field) => field.field),
+    });
+  }
+  // Re-key the value under the field's own positional (`path`/`name`/`level`) so
+  // runField reads it exactly as the per-field verb would.
+  return runField(spec, { [spec.positional]: String(params.value ?? "") });
+}

package/src/capabilities/config/set.test.ts

@@ -0,0 +1,207 @@
+/**
+ * `config set <key> <value>` — the additive one-command setter (PR9, COVENANT).
+ *
+ * Pins the emitted covenant slice (`{ v:"set", args:["<key>","<value>"],
+ * mutates:true, mcp:"config_set" }`), proves it shares the per-field write path
+ * (set / reset-sentinel / enum-backstop), rejects an unknown key and an
+ * out-of-set enum value with INVALID_INPUT, and holds MCP plan-first/confirm
+ * parity. The frozen `config tier/channel/detail` verbs are UNTOUCHED — this is
+ * purely additive.
+ */
+
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { globalConfigPath } from "../../kernel/config/paths.js";
+import { CHANNELS } from "../../kernel/config/types.js";
+import { PragmaError } from "../../kernel/error/PragmaError.js";
+import {
+  executeVerb,
+  extractParams,
+} from "../../kernel/project/cli/dispatch.js";
+import { bootRuntime } from "../../kernel/runtime/boot.js";
+import type { GlobalFlags, PragmaRuntime } from "../../kernel/runtime/types.js";
+import { emitVerb } from "../../kernel/spec/emitSurface.js";
+import type { VerbSpec } from "../../kernel/spec/types.js";
+import { projectMcp } from "../../testing/helpers/projectMcp.js";
+import { configModule } from "./index.js";
+import { runSet } from "./runSet.js";
+
+const FLAGS: GlobalFlags = {
+  llm: false,
+  autoLlm: false,
+  format: "plain",
+  verbose: false,
+};
+const REAL = { dryRun: false, undo: false, yes: false };
+const DRY = { dryRun: true, undo: false, yes: false };
+
+const setVerb = configModule.verbs.find((v) => v.path[1] === "set") as VerbSpec;
+
+let prevXdg: string | undefined;
+const roots: string[] = [];
+const tmp = (prefix: string): string => {
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  roots.push(dir);
+  return dir;
+};
+
+beforeEach(() => {
+  prevXdg = process.env.XDG_CONFIG_HOME;
+  process.env.XDG_CONFIG_HOME = tmp("pragma-cfgset-xdg-");
+});
+afterEach(() => {
+  process.env.XDG_CONFIG_HOME = prevXdg;
+  for (const dir of roots) rmSync(dir, { recursive: true, force: true });
+  roots.length = 0;
+});
+
+function readGlobal(): Record<string, unknown> {
+  return JSON.parse(readFileSync(globalConfigPath(), "utf-8"));
+}
+
+describe("config set — covenant-exact emission (PROTECTED)", () => {
+  it("emits the two-positional slice with the config_set tool", () => {
+    expect(emitVerb(setVerb)).toEqual({
+      v: "set",
+      args: ["<key>", "<value>"],
+      mutates: true,
+      mcp: "config_set",
+    });
+  });
+});
+
+describe("config set — write & reset (shares the per-field path)", () => {
+  it("set tier writes the field to the GLOBAL config, never booting the store", async () => {
+    const rt: PragmaRuntime = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    const outcome = await executeVerb(
+      setVerb,
+      { key: "tier", value: "apps/lxd" },
+      REAL,
+      rt,
+    );
+
+    expect(outcome.exitCode).toBe(0);
+    expect(outcome.stdout).toContain("Set tier = apps/lxd");
+    expect(readGlobal().tier).toBe("apps/lxd");
+    expect(rt.store.booted).toBe(false);
+  });
+
+  it("set channel/detail write their enum value", async () => {
+    const rt = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    await executeVerb(
+      setVerb,
+      { key: "channel", value: "experimental" },
+      REAL,
+      rt,
+    );
+    await executeVerb(setVerb, { key: "detail", value: "detailed" }, REAL, rt);
+    const written = readGlobal();
+    expect(written.channel).toBe("experimental");
+    expect(written.detail).toBe("detailed");
+  });
+
+  it("a reset sentinel via set removes the tier field", async () => {
+    const cwd = tmp("pragma-proj-");
+    await executeVerb(
+      setVerb,
+      { key: "tier", value: "apps/lxd" },
+      REAL,
+      bootRuntime(FLAGS, cwd),
+    );
+    const outcome = await executeVerb(
+      setVerb,
+      { key: "tier", value: "none" },
+      REAL,
+      bootRuntime(FLAGS, cwd),
+    );
+    expect(outcome.stdout).toContain("Reset tier");
+    expect("tier" in readGlobal()).toBe(false);
+  });
+});
+
+describe("config set — input rejection (INVALID_INPUT)", () => {
+  it("the CLI enum coerce rejects an unknown key with the valid field names", () => {
+    let caught: unknown;
+    try {
+      extractParams(setVerb.params, ["bogus", "x"], {});
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(PragmaError);
+    expect((caught as PragmaError).code).toBe("INVALID_INPUT");
+    expect((caught as PragmaError).validOptions).toEqual([
+      "tier",
+      "channel",
+      "detail",
+    ]);
+  });
+
+  it("runSet backstops an unknown key before it reaches a field", () => {
+    expect(() => runSet({ key: "bogus", value: "x" })).toThrow(PragmaError);
+    try {
+      runSet({ key: "bogus", value: "x" });
+    } catch (error) {
+      expect((error as PragmaError).code).toBe("INVALID_INPUT");
+      expect((error as PragmaError).validOptions).toEqual([
+        "tier",
+        "channel",
+        "detail",
+      ]);
+    }
+  });
+
+  it("an out-of-set enum value is rejected by the shared runField backstop", () => {
+    expect(() => runSet({ key: "channel", value: "bogus" })).toThrow(
+      /Invalid channel/,
+    );
+    // Sanity: the same key with a real member does not throw.
+    expect(() =>
+      runSet({ key: "channel", value: CHANNELS[0] as string }),
+    ).not.toThrow();
+  });
+});
+
+describe("config set — dry-run plan", () => {
+  it("--dry-run shows the WriteFile plan and writes nothing", async () => {
+    const rt = bootRuntime(FLAGS, tmp("pragma-proj-"));
+    const outcome = await executeVerb(
+      setVerb,
+      { key: "tier", value: "apps/lxd" },
+      DRY,
+      rt,
+    );
+    expect(outcome.exitCode).toBe(0);
+    expect(outcome.stdout).toContain("Write file");
+    expect(existsSync(globalConfigPath())).toBe(false);
+  });
+});
+
+describe("config set — MCP plan-first / confirm parity", () => {
+  it("config_set returns a plan without confirm, writes with confirm:true", async () => {
+    const cwd = tmp("pragma-proj-");
+    const mcp = await projectMcp([configModule], cwd);
+
+    const plan = await mcp.callTool("config_set", {
+      key: "tier",
+      value: "apps/lxd",
+    });
+    expect(plan.ok).toBe(true);
+    expect(plan.meta).toMatchObject({ planOnly: true, confirmRequired: true });
+    const planLines = (plan.data as { plan: string[] }).plan;
+    expect(planLines.some((line) => line.includes("Write file"))).toBe(true);
+    expect(existsSync(globalConfigPath())).toBe(false);
+
+    const done = await mcp.callTool("config_set", {
+      key: "tier",
+      value: "apps/lxd",
+      confirm: true,
+    });
+    await mcp.cleanup();
+
+    expect(done.ok).toBe(true);
+    expect(done.data).toMatchObject({ field: "tier", value: "apps/lxd" });
+    expect(readGlobal().tier).toBe("apps/lxd");
+  });
+});