@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/config/settings.ts

@@ -62,6 +62,7 @@ import {
 	validateAutoroutingEffective,
 	validateAutoroutingLocal,
 } from "./autorouting-contract";
+import type { ConfigHotReloadFileSnapshot } from "./config-hot-reload";
 import { isModelSelectorValue, type ModelSelectorValue, normalizeModelSelectorValue } from "./model-selector-value";
 
 import {
@@ -92,6 +93,53 @@ export interface RawSettings {
 	[key: string]: unknown;
 }
 
+/** Validated candidate view. `get` includes local patches and effective overlays. */
+export interface SettingsGlobalConfigCandidate {
+	readonly configPath: string;
+	readonly diagnostics: SettingsSchemaReport;
+	get<P extends SettingPath>(settingPath: P): SettingValue<P>;
+	/** Candidate global values include pending local patches, but exclude other layers. */
+	getGlobal<P extends SettingPath>(settingPath: P): SettingValue<P> | undefined;
+}
+
+export interface SettingsConfigReloadPublication {
+	finalize(): void;
+	rollback(): void;
+}
+
+export class SettingsGlobalConfigReloadError extends Error {
+	constructor(
+		message: string,
+		readonly configPath: string | null,
+		readonly diagnostics?: SettingsSchemaReport,
+	) {
+		super(message);
+		this.name = "SettingsGlobalConfigReloadError";
+	}
+}
+
+interface SettingsGlobalConfigCandidateState {
+	owner: Settings;
+	configPath: string;
+	globalWithPendingPatches: RawSettings;
+	effective: RawSettings;
+	diagnostics: SettingsSchemaReport;
+	rawConfig: RawSettings;
+	currentGlobal: RawSettings;
+	currentProject: RawSettings;
+	currentOverrides: RawSettings;
+	currentMerged: RawSettings;
+	cwd: string;
+	sourcePresent: boolean;
+	futureSchemaVersion: boolean;
+	published: boolean;
+}
+
+const settingsGlobalConfigCandidateStates = new WeakMap<
+	SettingsGlobalConfigCandidate,
+	SettingsGlobalConfigCandidateState
+>();
+
 const UNSAFE_EDIT_VARIANT_PATTERNS = new Set(["__proto__", "constructor", "prototype"]);
 
 const CONFIG_ROOT_WORKFLOW_MIGRATION_KEYS: readonly WorkflowSettingKey[] = [
@@ -263,6 +311,12 @@ export class NotificationSettingsOverrideError extends Error {
 }
 
 const LOCAL_NOTIFICATION_SETTING_KEYS = new Set(["terminalBell", "bellOnComplete", "bellOnApproval", "bellOnAsk"]);
+/** `auth.*` keys that select credentials; startup reads them from global config only, so project copies are dropped. */
+const GLOBAL_ONLY_AUTH_SETTING_KEYS = new Set([
+	"credentialPins",
+	"credentialPinStoreIdentity",
+	"credentialPreferences",
+]);
 const LOCAL_NOTIFICATION_SETTING_PATHS = new Set(
 	[...LOCAL_NOTIFICATION_SETTING_KEYS].map(key => `notifications.${key}`),
 );
@@ -336,6 +390,13 @@ const GLOBAL_ONLY_SETTINGS = new Set<SettingPath>([
 	"paseo.autoImport",
 	"ui.language",
 	"telemetry.enabled",
+	// Destination of the operator Hindsight server. A project file must not redirect it.
+	"hindsight.apiUrl",
+	// Destination of generic remote compaction. A project file must not redirect the transcript POST.
+	"compaction.remoteEndpoint",
+	// Operator consent for repository skills. A project file must not flip it.
+	"skills.trustProjectSkills",
+	"skills.enablePiProject",
 ]);
 const LEGACY_THEME_NAME_REPLACEMENTS = {
 	dark: "red-claw",
@@ -544,6 +605,8 @@ export class Settings implements NotificationSettingsReader {
 	#schemaMigrationPending = false;
 	/** A newer config schema must never be rewritten by legacy migrations. */
 	#futureSchemaVersion = false;
+	/** Set only after a valid disk-backed global config has been loaded or published. */
+	#hasAcceptedGlobalConfigFile = false;
 	#hasMalformedConfigRoot = false;
 	/** YAML syntax was unrecoverable, so the loaded defaults are read-only until config.yml is repaired. */
 	#hasRecoveredConfigSyntax = false;
@@ -745,6 +808,357 @@ export class Settings implements NotificationSettingsReader {
 		return () => this.#changeListeners.delete(listener);
 	}
 
+	/** The resolved global config.yml path, or null for in-memory settings. */
+	getGlobalConfigPath(): string | null {
+		return this.#configPath;
+	}
+
+	/**
+	 * Validate the watcher's exact snapshot without writing or rereading it.
+	 * Rebase pending local patches after prior durable operations settle.
+	 */
+	async stageGlobalConfigReload(snapshot: ConfigHotReloadFileSnapshot): Promise<SettingsGlobalConfigCandidate> {
+		const configPath = this.#configPath;
+		if (!configPath) {
+			throw new SettingsGlobalConfigReloadError(
+				"Global config reload requires a disk-backed Settings instance.",
+				null,
+			);
+		}
+
+		if (path.resolve(snapshot.path) !== path.resolve(configPath)) {
+			throw new SettingsGlobalConfigReloadError("Global config snapshot path does not match Settings.", configPath);
+		}
+		const pendingAtStage = structuredClone(this.#pendingPatchesInGenerationOrder());
+		return enqueueAtomicYamlOperation(configPath, async () => {
+			const sourcePresent = snapshot.text !== null;
+			const content = snapshot.text ?? "";
+			if (!sourcePresent) {
+				if (this.#hasAcceptedGlobalConfigFile) {
+					const diagnostics: SettingsSchemaReport = {
+						valid: false,
+						issues: [
+							{
+								path: "config.yml",
+								kind: "invalid",
+								detail: "The previously accepted global config.yml is missing.",
+							},
+						],
+					};
+					throw new SettingsGlobalConfigReloadError(
+						"Cannot stage global config reload because the previously accepted config.yml is missing.",
+						configPath,
+						diagnostics,
+					);
+				}
+			}
+
+			let rawConfig: RawSettings = {};
+			if (content.trim() !== "") {
+				let parsed: unknown;
+				try {
+					parsed = YAML.parse(content);
+				} catch {
+					const diagnostics: SettingsSchemaReport = {
+						valid: false,
+						issues: [
+							{
+								path: "config.yml",
+								kind: "invalid",
+								detail: "Configuration YAML syntax is invalid; repair config.yml before reloading.",
+							},
+						],
+					};
+					throw new SettingsGlobalConfigReloadError(
+						"Cannot stage global config reload because config.yml has invalid YAML syntax.",
+						configPath,
+						diagnostics,
+					);
+				}
+				if (parsed !== undefined) {
+					if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+						const diagnostics: SettingsSchemaReport = {
+							valid: false,
+							issues: [
+								{
+									path: "config.yml",
+									kind: "invalid",
+									detail: "Configuration root must be a YAML mapping.",
+								},
+							],
+						};
+						throw new SettingsGlobalConfigReloadError(
+							"Cannot stage global config reload because the config.yml root is not a mapping.",
+							configPath,
+							diagnostics,
+						);
+					}
+					rawConfig = parsed as RawSettings;
+				}
+			}
+
+			const configSchemaVersion = normalizeConfigSchemaVersion(rawConfig.configSchemaVersion);
+			const futureSchemaVersion =
+				typeof configSchemaVersion === "number" && configSchemaVersion > CONFIG_SCHEMA_VERSION;
+			const migratedRawConfig = this.#migrateRawSettings(structuredClone(rawConfig));
+			const reconciled = reconcileSettingsSchema(migratedRawConfig);
+			const diagnostics = reconciled.report;
+			for (const [settingPath, pathSegments] of [
+				["modelRoles", ["modelRoles"]],
+				["task.agentModelOverrides", ["task", "agentModelOverrides"]],
+			] as const) {
+				const value = getByPath(reconciled.settings, [...pathSegments]);
+				if (value === undefined) continue;
+				const record = rawSettingsRecord(value);
+				if (!record || Object.keys(shallowModelSelectorRecord(record)).length !== Object.keys(record).length) {
+					diagnostics.issues.push({
+						path: settingPath,
+						kind: "invalid",
+						detail: "Model selector records contain invalid values.",
+					});
+					diagnostics.valid = false;
+				}
+			}
+			if (futureSchemaVersion) {
+				diagnostics.issues.push({
+					path: "configSchemaVersion",
+					kind: "pending-migration",
+					detail: `Configuration requires schema version ${configSchemaVersion}.`,
+				});
+			}
+			if (sourcePresent && hasLegacyCustomImageProvider(rawConfig)) {
+				diagnostics.issues.push({
+					path: "providers.image",
+					kind: "invalid",
+					detail: LEGACY_CUSTOM_IMAGE_PROVIDER_DIAGNOSTIC,
+				});
+				diagnostics.valid = false;
+			}
+			try {
+				parseNotificationSettingsSnapshot(rawConfig);
+			} catch (error) {
+				if (!(error instanceof Error) || error.message !== "gjc_notify_daemon_invalid_configuration") throw error;
+				diagnostics.issues.push({
+					path: "notifications",
+					kind: "invalid",
+					detail: "Global notification settings are invalid.",
+				});
+				diagnostics.valid = false;
+			}
+			const currentGlobal = structuredClone(this.#global);
+			const currentProject = structuredClone(this.#project);
+			const currentOverrides = structuredClone(this.#overrides);
+			const currentMerged = structuredClone(this.#merged);
+			const globalWithPendingPatches = structuredClone(reconciled.settings) as RawSettings;
+			const rawWithPendingPatches = structuredClone(rawConfig);
+			for (const patch of [...pendingAtStage, ...this.#pendingPatchesInGenerationOrder()]) {
+				applySettingsPatch(globalWithPendingPatches, { ...patch, value: structuredClone(patch.value) });
+				applySettingsPatch(rawWithPendingPatches, { ...patch, value: structuredClone(patch.value) });
+			}
+			const effective = this.#mergeSettingsLayers(globalWithPendingPatches, currentProject, currentOverrides);
+			diagnostics.issues = diagnostics.issues.filter(
+				issue =>
+					!(
+						(issue.kind === "invalid" || issue.kind === "unknown") &&
+						(issue.path === "task.autorouting" || issue.path.startsWith("task.autorouting."))
+					),
+			);
+			for (const source of [globalWithPendingPatches, currentProject, currentOverrides]) {
+				const fragment = getByPath(source, ["task", "autorouting"]);
+				diagnostics.issues.push(
+					...validateAutoroutingLocal(fragment).map(localIssue => ({
+						path: localIssue.path ? `task.autorouting.${localIssue.path}` : "task.autorouting",
+						kind: "invalid" as const,
+						detail: localIssue.detail,
+					})),
+				);
+			}
+			const effectiveAutorouting = validateAutoroutingEffective(getByPath(effective, ["task", "autorouting"]));
+			if (!effectiveAutorouting.active && effectiveAutorouting.issue) {
+				diagnostics.issues.push({
+					path: "task.autorouting",
+					kind: "invalid",
+					detail: effectiveAutorouting.issue.detail,
+				});
+			}
+			diagnostics.valid = !diagnostics.issues.some(issue => issue.kind === "invalid");
+			if (!diagnostics.valid) {
+				throw new SettingsGlobalConfigReloadError(
+					"Cannot stage global config reload because settings validation failed.",
+					configPath,
+					structuredClone(diagnostics),
+				);
+			}
+			const state: SettingsGlobalConfigCandidateState = {
+				owner: this,
+				configPath,
+				globalWithPendingPatches,
+				effective,
+				diagnostics: structuredClone(diagnostics),
+				rawConfig: rawWithPendingPatches,
+				currentGlobal,
+				currentProject,
+				currentOverrides,
+				currentMerged,
+				cwd: this.#cwd,
+				sourcePresent,
+				futureSchemaVersion,
+				published: false,
+			};
+			const candidate: SettingsGlobalConfigCandidate = {
+				configPath,
+				diagnostics: structuredClone(diagnostics),
+				get<P extends SettingPath>(settingPath: P): SettingValue<P> {
+					const value = getByPath(state.effective, settingPath.split("."));
+					if (value === undefined) return structuredClone(getDefault(settingPath));
+					const pathScopedValue = resolvePathScopedStringArray(settingPath, value, state.cwd);
+					return structuredClone((pathScopedValue ?? value) as SettingValue<P>);
+				},
+				getGlobal<P extends SettingPath>(settingPath: P): SettingValue<P> | undefined {
+					const value = getByPath(state.globalWithPendingPatches, settingPath.split("."));
+					return value === undefined ? undefined : structuredClone(value as SettingValue<P>);
+				},
+			};
+			settingsGlobalConfigCandidateStates.set(candidate, state);
+			return Object.freeze(candidate);
+		});
+	}
+
+	/**
+	 * Publish a staged global config and its dependent synchronous model commit as
+	 * one in-memory transaction. A thrown commit restores settings without hooks.
+	 */
+	publishGlobalConfigReload(
+		candidate: SettingsGlobalConfigCandidate,
+		commitSync: () => void = () => {},
+	): SettingsConfigReloadPublication {
+		const state = settingsGlobalConfigCandidateStates.get(candidate);
+		if (!state || state.owner !== this) {
+			throw new SettingsGlobalConfigReloadError(
+				"The global config candidate does not belong to this Settings instance.",
+				this.#configPath,
+			);
+		}
+		if (state.published) {
+			throw new SettingsGlobalConfigReloadError(
+				"The global config candidate has already been published.",
+				state.configPath,
+			);
+		}
+		if (
+			this.#configPath !== state.configPath ||
+			!util.isDeepStrictEqual(this.#global, state.currentGlobal) ||
+			!util.isDeepStrictEqual(this.#project, state.currentProject) ||
+			!util.isDeepStrictEqual(this.#overrides, state.currentOverrides) ||
+			!util.isDeepStrictEqual(this.#merged, state.currentMerged)
+		) {
+			throw new SettingsGlobalConfigReloadError(
+				"Settings changed while the global config candidate was being prepared; stage it again.",
+				state.configPath,
+				structuredClone(state.diagnostics),
+			);
+		}
+
+		const previousValues = new Map<SettingPath, unknown>();
+		for (const settingPath of Object.keys(SETTINGS_SCHEMA) as SettingPath[]) {
+			previousValues.set(settingPath, structuredClone(this.get(settingPath)));
+		}
+		const previous = {
+			global: this.#global,
+			overrides: structuredClone(this.#overrides),
+			rawNotificationConfig: this.#rawNotificationConfig,
+			durableRawNotificationConfig: this.#durableRawNotificationConfig,
+			durableNotificationFingerprint: this.#durableNotificationFingerprint,
+			merged: this.#merged,
+			schemaReport: this.#schemaReport,
+			autoroutingEffective: this.#autoroutingEffective,
+			autoroutingLocalIssues: this.#autoroutingLocalIssues,
+			futureSchemaVersion: this.#futureSchemaVersion,
+			hasAcceptedGlobalConfigFile: this.#hasAcceptedGlobalConfigFile,
+			hasMalformedConfigRoot: this.#hasMalformedConfigRoot,
+			hasRecoveredConfigSyntax: this.#hasRecoveredConfigSyntax,
+			hasInvalidNotificationGlobal: this.#hasInvalidNotificationGlobal,
+			notificationValidationGeneration: this.#notificationValidationGeneration,
+		};
+		let publicationState: "pending" | "finalized" | "rolled-back" = "pending";
+		const rollback = () => {
+			if (publicationState === "rolled-back") return;
+			if (publicationState === "finalized") throw new Error("Cannot roll back finalized configuration.");
+			this.#global = previous.global;
+			this.#overrides = previous.overrides;
+			this.#rawNotificationConfig = previous.rawNotificationConfig;
+			this.#durableRawNotificationConfig = previous.durableRawNotificationConfig;
+			this.#durableNotificationFingerprint = previous.durableNotificationFingerprint;
+			this.#merged = previous.merged;
+			this.#schemaReport = previous.schemaReport;
+			this.#autoroutingEffective = previous.autoroutingEffective;
+			this.#autoroutingLocalIssues = previous.autoroutingLocalIssues;
+			this.#futureSchemaVersion = previous.futureSchemaVersion;
+			this.#hasAcceptedGlobalConfigFile = previous.hasAcceptedGlobalConfigFile;
+			this.#hasMalformedConfigRoot = previous.hasMalformedConfigRoot;
+			this.#hasRecoveredConfigSyntax = previous.hasRecoveredConfigSyntax;
+			this.#hasInvalidNotificationGlobal = previous.hasInvalidNotificationGlobal;
+			this.#notificationValidationGeneration = previous.notificationValidationGeneration;
+			publicationState = "rolled-back";
+		};
+		this.#global = structuredClone(state.globalWithPendingPatches);
+		const previousNotificationFingerprint = this.#durableNotificationFingerprint;
+		this.#captureRawNotificationConfig(state.rawConfig);
+		for (const patch of this.#pendingPatchesInGenerationOrder()) {
+			this.#applyNotificationMutationToRaw(patch.path, patch.value);
+		}
+		if (previousNotificationFingerprint !== this.#durableNotificationFingerprint) {
+			this.#notificationValidationGeneration++;
+		}
+		this.#schemaReport = structuredClone(state.diagnostics);
+		this.#futureSchemaVersion = state.futureSchemaVersion;
+		this.#hasMalformedConfigRoot = false;
+		this.#hasRecoveredConfigSyntax = false;
+		this.#hasInvalidNotificationGlobal = false;
+		this.#rebuildMerged();
+		this.#recomputeNotificationValidationFromRaw();
+
+		try {
+			const result: unknown = commitSync();
+			if (result && typeof result === "object" && "then" in result) {
+				throw new TypeError("Global config reload commit callback must be synchronous.");
+			}
+		} catch (error) {
+			rollback();
+			throw error;
+		}
+
+		this.#hasAcceptedGlobalConfigFile ||= state.sourcePresent;
+		state.published = true;
+		return {
+			rollback,
+			finalize: () => {
+				if (publicationState !== "pending") return;
+				publicationState = "finalized";
+				for (const settingPath of Object.keys(SETTINGS_SCHEMA) as SettingPath[]) {
+					const previousValue = previousValues.get(settingPath);
+					const nextValue = this.get(settingPath);
+					if (util.isDeepStrictEqual(previousValue, nextValue)) continue;
+					const hook = SETTING_HOOKS[settingPath];
+					if (hook) {
+						try {
+							hook(nextValue, previousValue);
+						} catch {
+							logger.warn("Configuration reload setting hook failed", { settingPath });
+						}
+					}
+					for (const listener of this.#changeListeners) {
+						try {
+							listener(settingPath);
+						} catch {
+							logger.warn("Configuration reload listener failed", { settingPath });
+						}
+					}
+				}
+			},
+		};
+	}
+
 	/** Whether durable settings mutations are permitted for the loaded configuration. */
 	canWriteDurableConfig(): boolean {
 		return !this.#persist || !this.#hasRecoveredConfigSyntax;
@@ -1156,6 +1570,7 @@ export class Settings implements NotificationSettingsReader {
 		cloned.#autoroutingLocalIssues = structuredClone(this.#autoroutingLocalIssues);
 		cloned.#schemaMigrationPending = this.#schemaMigrationPending;
 		cloned.#futureSchemaVersion = this.#futureSchemaVersion;
+		cloned.#hasAcceptedGlobalConfigFile = this.#hasAcceptedGlobalConfigFile;
 		cloned.#hasMalformedConfigRoot = this.#hasMalformedConfigRoot;
 		cloned.#hasRecoveredConfigSyntax = this.#hasRecoveredConfigSyntax;
 		cloned.#hasInvalidNotificationGlobal = this.#hasInvalidNotificationGlobal;
@@ -1206,10 +1621,12 @@ export class Settings implements NotificationSettingsReader {
 	}
 
 	/**
-	 * Get shell configuration based on settings.
+	 * Shell configuration for bash and the Python executor.
+	 * `shellPath` comes from the user/global config only, so a project
+	 * `.gjc/settings.json` cannot select the binary those executors run.
 	 */
 	getShellConfig() {
-		const shell = this.get("shellPath");
+		const shell = this.getGlobal("shellPath");
 		return resolveShellConfig(shell);
 	}
 
@@ -1516,7 +1933,10 @@ export class Settings implements NotificationSettingsReader {
 			throw error;
 		}
 		this.#resetYamlLoadState();
-		if (content.trim() === "") return {};
+		if (content.trim() === "") {
+			if (filePath === this.#configPath) this.#hasAcceptedGlobalConfigFile = true;
+			return {};
+		}
 		let parsed: unknown;
 		try {
 			parsed = YAML.parse(content);
@@ -1536,7 +1956,10 @@ export class Settings implements NotificationSettingsReader {
 			this.#captureRawNotificationConfig(undefined);
 			return {};
 		}
-		if (parsed === undefined) return {};
+		if (parsed === undefined) {
+			if (filePath === this.#configPath) this.#hasAcceptedGlobalConfigFile = true;
+			return {};
+		}
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
 			this.#hasMalformedConfigRoot = true;
 			this.#schemaReport = {
@@ -1604,6 +2027,14 @@ export class Settings implements NotificationSettingsReader {
 			});
 		}
 		this.#schemaReport = reconciled.report;
+		if (
+			filePath === this.#configPath &&
+			reconciled.report.valid &&
+			!this.#hasInvalidNotificationGlobal &&
+			!hasLegacyCustomImageProvider(parsedRaw)
+		) {
+			this.#hasAcceptedGlobalConfigFile = true;
+		}
 		return reconciled.settings;
 	}
 
@@ -1625,13 +2056,16 @@ export class Settings implements NotificationSettingsReader {
 				const data = item.path.endsWith(`${path.sep}settings.json`)
 					? await this.#stripRetiredWorkflowKeys(item.path, structuredClone(item.data as RawSettings))
 					: (item.data as RawSettings);
-				const { settings, rejectedNotifications, rejectedCredentialPins } =
+				const { settings, rejectedNotifications, rejectedCredentialSelection } =
 					this.#stripProjectNotificationSettings(data);
 				if (rejectedNotifications) {
 					logger.warn("Settings: ignoring project notification settings", { path: item.path });
 				}
-				if (rejectedCredentialPins) {
-					logger.warn("Settings: ignoring project auth.credentialPins; pins are global-only", { path: item.path });
+				if (rejectedCredentialSelection) {
+					logger.warn(
+						"Settings: ignoring project auth credential pins/preferences; credential selection is global-only",
+						{ path: item.path },
+					);
 				}
 				merged = this.#deepMerge(merged, settings);
 			}
@@ -6022,16 +6456,20 @@ export class Settings implements NotificationSettingsReader {
 	}
 
 	#rebuildMerged(): void {
-		const project = structuredClone(this.#project);
-		const overrides = structuredClone(this.#overrides);
+		this.#merged = this.#mergeSettingsLayers(this.#global, this.#project, this.#overrides);
+		this.#recomputeAutoroutingDiagnostic();
+	}
+
+	#mergeSettingsLayers(global: RawSettings, projectLayer: RawSettings, overrideLayer: RawSettings): RawSettings {
+		const project = structuredClone(projectLayer);
+		const overrides = structuredClone(overrideLayer);
 		for (const settingPath of GLOBAL_ONLY_SETTINGS) {
 			const segments = settingPath.split(".");
 			deleteByPath(project, segments);
 			deleteByPath(overrides, segments);
 		}
-		this.#merged = this.#deepMerge(this.#deepMerge({}, this.#global), project);
-		this.#merged = this.#deepMerge(this.#merged, overrides);
-		this.#recomputeAutoroutingDiagnostic();
+		const merged = this.#deepMerge(this.#deepMerge({}, global), project);
+		return this.#deepMerge(merged, overrides);
 	}
 
 	#fireAllHooks(): void {
@@ -6047,27 +6485,25 @@ export class Settings implements NotificationSettingsReader {
 	#stripProjectNotificationSettings(settings: RawSettings): {
 		settings: RawSettings;
 		rejectedNotifications: boolean;
-		rejectedCredentialPins: boolean;
+		rejectedCredentialSelection: boolean;
 	} {
 		let rejectedNotifications = false;
-		let rejectedCredentialPins = false;
+		let rejectedCredentialSelection = false;
 		const sanitized: RawSettings = {};
 		for (const [key, value] of Object.entries(settings)) {
 			if (key === "auth" && value && typeof value === "object" && !Array.isArray(value)) {
 				const authSettings = { ...(value as Record<string, unknown>) };
-				if (Object.hasOwn(authSettings, "credentialPins")) {
-					delete authSettings.credentialPins;
-					rejectedCredentialPins = true;
-				}
-				if (Object.hasOwn(authSettings, "credentialPinStoreIdentity")) {
-					delete authSettings.credentialPinStoreIdentity;
-					rejectedCredentialPins = true;
+				for (const key of GLOBAL_ONLY_AUTH_SETTING_KEYS) {
+					if (Object.hasOwn(authSettings, key)) {
+						delete authSettings[key];
+						rejectedCredentialSelection = true;
+					}
 				}
 				if (Object.keys(authSettings).length > 0) sanitized[key] = authSettings;
 				continue;
 			}
-			if (key === "auth.credentialPins" || key === "auth.credentialPinStoreIdentity") {
-				rejectedCredentialPins = true;
+			if (key.startsWith("auth.") && GLOBAL_ONLY_AUTH_SETTING_KEYS.has(key.slice("auth.".length))) {
+				rejectedCredentialSelection = true;
 				continue;
 			}
 			if (key === "notifications" && value && typeof value === "object" && !Array.isArray(value)) {
@@ -6088,7 +6524,7 @@ export class Settings implements NotificationSettingsReader {
 			}
 			sanitized[key] = value;
 		}
-		return { settings: sanitized, rejectedNotifications, rejectedCredentialPins };
+		return { settings: sanitized, rejectedNotifications, rejectedCredentialSelection };
 	}
 
 	#deepMerge(base: RawSettings, overrides: RawSettings): RawSettings {

package/src/coordinator-mcp/policy.ts

@@ -3,6 +3,7 @@ import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { canonicalEnvKey, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { coordinatorMcpStateRoot, gjcRoot } from "../gjc-runtime/session-layout";
 import {
 	DEFAULT_SESSION_IDLE_TTL_MS,
@@ -121,6 +122,30 @@ function parseRootList(value: string | undefined): string[] {
 		.filter(Boolean);
 }
 
+const MANAGED_WORKTREE_DIR_ENV = "GJC_WORKTREE_DIR";
+/** Captured at load so a later chdir or dotenv delete cannot hide the declaration. */
+const startupManagedWorktreeSnapshot = projectEnvSnapshot();
+
+/**
+ * Operator value only. A project dotenv declaration, including a dynamic one,
+ * must not widen managed worktree roots. An operator value the project does
+ * not declare is kept.
+ */
+function trustedManagedWorktreeDir(env: NodeJS.ProcessEnv): string | undefined {
+	const raw = env[MANAGED_WORKTREE_DIR_ENV];
+	if (!raw) return undefined;
+	const key = canonicalEnvKey(MANAGED_WORKTREE_DIR_ENV);
+	const declared = startupManagedWorktreeSnapshot.values[key];
+	const trimmed = raw.trim();
+	if (
+		declared !== undefined &&
+		(startupManagedWorktreeSnapshot.dynamic.has(key) || declared === raw || declared === trimmed)
+	) {
+		return undefined;
+	}
+	return trimmed.length > 0 ? trimmed : undefined;
+}
+
 function resolveManagedWorktreeRoot(root: string, configured: string | undefined): string {
 	// Function replacers so a `$` in the home or repository path is kept verbatim.
 	const template = (configured?.trim() || "{repo}/.worktrees").replace(/^~(?=\/|$)/, () => os.homedir());
@@ -168,7 +193,7 @@ export function buildCoordinatorMcpConfig(env: NodeJS.ProcessEnv = process.env):
 	return {
 		allowedRoots: parseRootList(env.GJC_COORDINATOR_MCP_WORKDIR_ROOTS).map(root => path.resolve(root)),
 		managedWorktreeRoots: parseRootList(env.GJC_COORDINATOR_MCP_WORKDIR_ROOTS).map(root =>
-			resolveManagedWorktreeRoot(path.resolve(root), env.GJC_WORKTREE_DIR),
+			resolveManagedWorktreeRoot(path.resolve(root), trustedManagedWorktreeDir(env)),
 		),
 		mutationClasses: parseMutationClasses(
 			env.GJC_COORDINATOR_MCP_MUTATIONS ?? env.GJC_COORDINATOR_MCP_ENABLE_MUTATION_CLASSES,