@ktpartners/dgs-platform 2.9.0 → 3.3.0

package/deliver-great-systems/bin/lib/commit-verify.test.cjs

@@ -0,0 +1,236 @@
+/**
+ * RED test scaffold for REL-01 (Phase 156 plan 02).
+ *
+ * The `verifyPlanCommit` helper is implemented in plan 02; running this
+ * file before plan 02 lands MUST produce 6 failed tests with
+ * 'not yet implemented — REL-01' style messages.
+ *
+ * Behaviour under test:
+ *   - happy path: planner-reported created_files match HEAD; returns
+ *     { ok: true, hash: '<short>', missing: [] }
+ *   - missing-file: planner reports a file not on disk → returns
+ *     { ok: false, exitLabel: 'plan-commit-incomplete', missing: [...] }
+ *   - commit_docs:false: silently treated as success
+ *     ({ ok: true, hash: null, reason: 'skipped_commit_docs_false' })
+ *   - empty createdFiles: returns plan-commit-incomplete WITHOUT calling
+ *     cmdCommit (defends against the cmdCommit `['.']` fallback at
+ *     bin/lib/commands.cjs:321 — Hypothesis C from 156-Q1-FINDINGS.md)
+ *   - commit failure (cmdCommit returns committed:false with
+ *     non-skipped reason): returns plan-commit-incomplete
+ *   - working tree unchanged on plan-commit-incomplete: snapshot of
+ *     git status --porcelain before/after the failed call MUST match
+ *
+ * Conventions:
+ *   - Uses node:test runner + node:assert (matches state-transition-gate.test.cjs)
+ *   - Each test creates and tears down its own temp git repo via os.tmpdir()
+ *   - Until plan 02 lands, every test fails with 'not yet implemented'
+ *     so the file is RED in a controlled way (no parse errors).
+ */
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const NOT_IMPL = 'verifyPlanCommit not yet implemented — REL-01';
+
+// ─── Helpers ──────────────────────────────────────────────────────────────
+
+function tryRequireCommands() {
+  try {
+    // Reset the planning-root cache between tests so each makeTempRepo()
+    // sees a fresh root; getPlanningRoot caches per-process and would
+    // otherwise pin the first temp dir for the whole test run.
+    try { require('./paths.cjs').resetPaths(); } catch { /* paths module may not load if commands fails */ }
+    return require('./commands.cjs');
+  } catch (err) {
+    return null;
+  }
+}
+
+function makeTempRepo() {
+  // Resolve real path to handle symlink wrap on macOS (/tmp -> /private/tmp).
+  // getPlanningRoot returns the symlink-resolved path; loadConfig later
+  // composes it with config.json — they MUST match.
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'commit-verify-test-')));
+  execSync('git init --quiet', { cwd: dir });
+  execSync('git config user.email test@example.com', { cwd: dir });
+  execSync('git config user.name "Test User"', { cwd: dir });
+  // Create a config.json with commit_docs: true for verifyPlanCommit's loadConfig path.
+  // Stage and commit it FIRST so the seed commit exists, then any later
+  // overwrite of config.json (test 3) is just an unstaged edit on top.
+  fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({ commit_docs: true }, null, 2));
+  fs.writeFileSync(path.join(dir, 'README.md'), '# seed\n');
+  execSync('git add README.md config.json', { cwd: dir });
+  execSync('git commit --quiet -m "seed"', { cwd: dir });
+  return dir;
+}
+
+function cleanupRepo(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
+}
+
+function porcelain(cwd) {
+  return execSync('git status --porcelain', { cwd }).toString();
+}
+
+// ─── Test 1: happy path ────────────────────────────────────────────────────
+
+test('REL-01 happy path: orchestrator commits planner-reported created_files and verification passes', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    const created = ['plan-01.md', 'plan-02.md', 'plan-03.md'];
+    for (const f of created) fs.writeFileSync(path.join(repo, f), '# ' + f + '\n');
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: created,
+    }, true);
+    assert.strictEqual(result.ok, true, 'expected ok:true');
+    assert.match(result.hash || '', /^[0-9a-f]{6,}/, 'expected short hash');
+    assert.deepStrictEqual(result.missing || [], [], 'no missing files expected');
+  } finally {
+    cleanupRepo(repo);
+  }
+});
+
+// ─── Test 2: missing-file ──────────────────────────────────────────────────
+
+test('REL-01 missing-file: planner reported a path that is not in the commit returns plan-commit-incomplete', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    // Only 2 of 3 reported files exist on disk
+    fs.writeFileSync(path.join(repo, 'plan-01.md'), 'a\n');
+    fs.writeFileSync(path.join(repo, 'plan-02.md'), 'b\n');
+    const created = ['plan-01.md', 'plan-02.md', 'plan-03.md'];
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: created,
+    }, true);
+    assert.strictEqual(result.ok, false, 'expected ok:false');
+    assert.strictEqual(result.exitLabel, 'plan-commit-incomplete');
+    assert.ok(Array.isArray(result.missing) && result.missing.length > 0, 'expected missing array');
+    assert.ok(result.missing.includes('plan-03.md'), 'missing should list plan-03.md');
+  } finally {
+    cleanupRepo(repo);
+  }
+});
+
+// ─── Test 3: commit_docs:false silent success ──────────────────────────────
+
+test('REL-01 commit_docs:false skipped is treated as success silently (NOT plan-commit-incomplete)', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    // Override config to disable commit_docs
+    fs.writeFileSync(path.join(repo, 'config.json'), JSON.stringify({ commit_docs: false }));
+    fs.writeFileSync(path.join(repo, 'plan-01.md'), 'a\n');
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: ['plan-01.md'],
+    }, true);
+    assert.strictEqual(result.ok, true, 'commit_docs:false MUST NOT be treated as plan-commit-incomplete');
+    assert.strictEqual(result.hash, null);
+    assert.strictEqual(result.reason, 'skipped_commit_docs_false');
+  } finally {
+    cleanupRepo(repo);
+  }
+});
+
+// ─── Test 4: empty createdFiles list ───────────────────────────────────────
+
+test('REL-01 empty created_files list exits plan-commit-incomplete (no [.] fallback)', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    // Add an extra dirty file in the working tree to detect a `['.']` sweep
+    // — if the helper falls back to `['.']` the commit would include this
+    // unrelated file. The helper must reject empty createdFiles BEFORE
+    // any cmdCommit call.
+    fs.writeFileSync(path.join(repo, 'unrelated-edit.md'), 'should not be committed\n');
+    const before = porcelain(repo);
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: [],
+    }, true);
+    assert.strictEqual(result.ok, false);
+    assert.strictEqual(result.exitLabel, 'plan-commit-incomplete');
+    assert.strictEqual(result.reason, 'empty_created_files');
+    // Working tree must be unchanged — no commit should have happened.
+    const after = porcelain(repo);
+    assert.strictEqual(after, before, 'working tree must be unchanged after empty-list rejection');
+  } finally {
+    cleanupRepo(repo);
+  }
+});
+
+// ─── Test 5: cmdCommit returns committed:false with non-skipped reason ────
+
+test('REL-01 cmdCommit returns committed:false with non-skipped reason exits plan-commit-incomplete', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    // The reported file does not exist on disk, so cmdCommit's `git add`
+    // will fail and the commit will resolve as nothing_to_commit /
+    // commit_failed. verifyPlanCommit must surface this as
+    // plan-commit-incomplete.
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: ['nonexistent-plan.md'],
+    }, true);
+    assert.strictEqual(result.ok, false);
+    assert.strictEqual(result.exitLabel, 'plan-commit-incomplete');
+  } finally {
+    cleanupRepo(repo);
+  }
+});
+
+// ─── Test 6: working tree unchanged on plan-commit-incomplete ─────────────
+
+test('REL-01 working tree unchanged on plan-commit-incomplete', () => {
+  const cmds = tryRequireCommands();
+  if (!cmds || typeof cmds.verifyPlanCommit !== 'function') {
+    assert.fail(NOT_IMPL);
+    return;
+  }
+  const repo = makeTempRepo();
+  try {
+    // One reported file that does not exist on disk
+    const before = porcelain(repo);
+    const result = cmds.verifyPlanCommit(repo, {
+      message: 'docs(99): create phase plan',
+      createdFiles: ['missing.md'],
+    }, true);
+    assert.strictEqual(result.ok, false);
+    const after = porcelain(repo);
+    assert.strictEqual(after, before, 'porcelain output must match before/after');
+    // No new commit was created (HEAD still points at seed)
+    const log = execSync('git log --oneline', { cwd: repo }).toString().trim().split('\n');
+    assert.strictEqual(log.length, 1, 'no new commit expected after plan-commit-incomplete');
+  } finally {
+    cleanupRepo(repo);
+  }
+});

package/deliver-great-systems/bin/lib/config.cjs

@@ -26,6 +26,7 @@ const LOCAL_KEYS = new Set([
   'planningRoot',
   'v2_hint_shown',
   'sync_hint_shown',
+  'execution',
 ]);
 
 const VALID_CONFIG_KEYS = new Set([
@@ -34,11 +35,28 @@ const VALID_CONFIG_KEYS = new Set([
   'workflow.research', 'workflow.plan_check', 'workflow.verifier',
   'workflow.nyquist_validation', 'workflow.ui_phase', 'workflow.ui_safety_gate',
   'workflow._auto_chain_active', 'workflow.discipline', 'workflow.codereview',
-  'git.base_branch', 'git.branching_strategy', 'git.phase_branch_template', 'git.milestone_branch_template',
+  'workflow.four_eyes',
+  'git.base_branch',
   'git.sync', 'git.sync_push', 'git.sync_pull',
   'planning.commit_docs', 'planning.search_gitignored',
+  'testing.packages.tool',
+  'testing.packages.severity_threshold',
+  'testing.packages.include_dev_dependencies',
+  'testing.packages.timeout_seconds',
+  // UAT Bug 2: Snyk org UUID for multi-org accounts. Free-form string or null.
+  // Not local-only — shareable setting; config.local.json still wins via _readPackagesConfig merge.
+  'testing.packages.snyk_org',
 ]);
 
+/** Enum: valid values for testing.packages.tool. Pinned to Phase 150 cascade. */
+const VALID_PACKAGES_TOOL = new Set(['auto', 'snyk', 'osv', 'native']);
+
+/** Enum: valid values for testing.packages.severity_threshold. */
+const VALID_PACKAGES_SEVERITY = new Set(['critical', 'high', 'medium', 'low']);
+
+/** Keys rejected by cmdConfigSet -- require cmdConfigLocalSet (secrets / machine-specific). */
+const LOCAL_ONLY_KEYS = new Set(['testing.packages.snyk_token']);
+
 /**
  * Get the path to the shared (tracked) config file.
  *
@@ -161,9 +179,6 @@ function cmdConfigEnsureSection(cwd, raw) {
     model_profile: 'balanced',
     commit_docs: true,
     search_gitignored: false,
-    branching_strategy: 'none',
-    phase_branch_template: 'dgs/{project}/phase-{phase}-{slug}',
-    milestone_branch_template: 'dgs/{project}/{milestone}-{slug}',
     base_branch: 'main',
     workflow: {
       research: true,
@@ -173,8 +188,8 @@ function cmdConfigEnsureSection(cwd, raw) {
       discipline: true,
     },
     git: {
-      sync_push: 'prompt',
-      sync_pull: 'prompt',
+      sync_push: 'auto',
+      sync_pull: 'auto',
     },
     parallelization: true,
     brave_search: hasBraveSearch,
@@ -205,6 +220,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     error('Usage: config-set <key.path> <value>');
   }
 
+  // LOCAL_ONLY guard -- runs BEFORE the unknown-key check so the error is precise
+  // (PKG-19: testing.packages.snyk_token is a secret; must route through config-local-set)
+  if (LOCAL_ONLY_KEYS.has(keyPath)) {
+    error(`"${keyPath}" is a local-only key. Use: dgs-tools config-local-set ${keyPath} <value>`);
+  }
+
   if (!VALID_CONFIG_KEYS.has(keyPath)) {
     error(`Unknown config key: "${keyPath}". Valid keys: ${[...VALID_CONFIG_KEYS].sort().join(', ')}`);
   }
@@ -215,6 +236,24 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     error(`Invalid sync mode: "${value}". Valid values: off, prompt, auto`);
   }
 
+  // PKG-19: testing.packages.tool enum validator
+  if (keyPath === 'testing.packages.tool' && !VALID_PACKAGES_TOOL.has(value)) {
+    error(`Invalid packages tool: "${value}". Valid values: auto, snyk, osv, native`);
+  }
+
+  // PKG-19: testing.packages.severity_threshold enum validator
+  if (keyPath === 'testing.packages.severity_threshold' && !VALID_PACKAGES_SEVERITY.has(value)) {
+    error(`Invalid packages severity: "${value}". Valid values: critical, high, medium, low`);
+  }
+
+  // PKG-19: testing.packages.timeout_seconds integer range validator [10, 3600]
+  if (keyPath === 'testing.packages.timeout_seconds') {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < 10 || n > 3600) {
+      error(`Invalid packages timeout: "${value}". Must be integer between 10 and 3600 seconds`);
+    }
+  }
+
   // Parse value (handle booleans and numbers)
   let parsedValue = value;
   if (value === 'true') parsedValue = true;
@@ -265,6 +304,40 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
   }
 }
 
+/**
+ * CLI: Set a key in config.local.json (no VALID_CONFIG_KEYS gate).
+ * Used by workflows to write local-only fields like execution.active_context.
+ */
+function cmdConfigLocalSet(cwd, keyPath, value, raw) {
+  if (!keyPath) {
+    error('Usage: config-local-set <key.path> <value>');
+  }
+
+  let parsedValue = value;
+  if (value === 'true') parsedValue = true;
+  else if (value === 'false') parsedValue = false;
+  else if (value === 'null') parsedValue = null;
+  else if (!isNaN(value) && value !== '') parsedValue = Number(value);
+
+  const localPath = getLocalConfigPath(cwd);
+  let config = _readJsonSafe(localPath);
+
+  const keys = keyPath.split('.');
+  let current = config;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (current[key] === undefined || typeof current[key] !== 'object') {
+      current[key] = {};
+    }
+    current = current[key];
+  }
+  current[keys[keys.length - 1]] = parsedValue;
+
+  _writeJson(localPath, config);
+  const result = { updated: true, key: keyPath, value: parsedValue, file: 'config.local.json' };
+  output(result, raw, `${keyPath}=${parsedValue}`);
+}
+
 function cmdConfigGet(cwd, keyPath, raw) {
   if (!keyPath) {
     error('Usage: config-get <key.path>');
@@ -520,6 +593,7 @@ module.exports = {
   getReviewKeysPath,
   cmdConfigEnsureSection,
   cmdConfigSet,
+  cmdConfigLocalSet,
   cmdConfigGet,
   writeConfigField,
   loadReviewConfig,

package/deliver-great-systems/bin/lib/config.test.cjs

@@ -0,0 +1,309 @@
+/**
+ * config.test.cjs -- Unit tests for config validators, including Phase 150
+ * testing.packages.* extensions (PKG-19).
+ *
+ * Phase 150 Plan 01 -- testing.packages.* config key validators + LOCAL_ONLY guard.
+ * Verifies:
+ *   - four testing.packages.* keys accepted by VALID_CONFIG_KEYS
+ *   - VALID_PACKAGES_TOOL enum validation (auto/snyk/osv/native)
+ *   - VALID_PACKAGES_SEVERITY enum validation (critical/high/medium/low)
+ *   - include_dev_dependencies boolean coercion
+ *   - timeout_seconds integer range [10, 3600]
+ *   - LOCAL_ONLY_KEYS guard redirects snyk_token to config-local-set
+ *   - no regression on pre-existing keys (workflow.research, git.sync_push, unknown keys)
+ */
+'use strict';
+const { test, describe, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const { execSync } = require('child_process');
+const { cmdConfigSet, cmdConfigLocalSet } = require('./config.cjs');
+const { loadConfig } = require('./core.cjs');
+const { resetPaths } = require('./paths.cjs');
+
+// ─── Harness ──────────────────────────────────────────────────────────────────
+
+/**
+ * Intercept process.exit and stderr writes during a cmdConfig* call.
+ * Returns { exitCode, stderr, stdout, threw }.
+ *
+ * process.exit only throws for non-zero codes (to escape error()); for exit(0),
+ * we throw a distinct __EXIT0__ marker that cmdConfigSet's try/catch would
+ * otherwise intercept. To prevent that, we only throw on non-zero; exit(0) sets
+ * the flag and the output() call naturally returns to the caller via the thrown
+ * marker which we then swallow at the outermost try.
+ */
+function interceptExit(fn) {
+  let exitCode = null;
+  let stderr = '';
+  let stdout = '';
+  let threw = null;
+  const origExit = process.exit;
+  const origStderrWrite = process.stderr.write.bind(process.stderr);
+  const origStdoutWrite = process.stdout.write.bind(process.stdout);
+  process.exit = (code) => {
+    exitCode = code;
+    // For success exits (code 0) we return silently so cmdConfigSet's outer
+    // try/catch around _writeJson + output() doesn't mistake our throw for a
+    // write failure. For non-zero exits (triggered by error()), we throw a
+    // sentinel so the error call does not proceed further.
+    if (code === 0) return;
+    const err = new Error('__EXIT__' + code);
+    err.__isExitSentinel = true;
+    throw err;
+  };
+  process.stderr.write = (data) => { stderr += String(data); return true; };
+  process.stdout.write = (data) => { stdout += String(data); return true; };
+  try {
+    fn();
+  } catch (e) {
+    if (!e || !e.__isExitSentinel) {
+      threw = e;
+    }
+  } finally {
+    process.exit = origExit;
+    process.stderr.write = origStderrWrite;
+    process.stdout.write = origStdoutWrite;
+  }
+  return { exitCode, stderr, stdout, threw };
+}
+
+function makeTmpDir() {
+  // mkdtempSync + realpath resolves macOS /private/var -> /var symlinks so
+  // getPlanningRoot's git output matches the dir we're operating in.
+  const d = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'dgs-config-test-')));
+  // getPlanningRoot requires a git repo
+  execSync('git init -q', { cwd: d });
+  execSync('git config user.email "t@t" && git config user.name "t"', { cwd: d });
+  // Reset cached planning root so each test's fresh tmpDir is honoured
+  resetPaths();
+  return d;
+}
+
+function writeMinimalConfig(tmpDir) {
+  fs.writeFileSync(path.join(tmpDir, 'config.json'), JSON.stringify({
+    current_project: 'testproj',
+  }, null, 2));
+}
+
+function readSharedConfig(tmpDir) {
+  const p = path.join(tmpDir, 'config.json');
+  if (!fs.existsSync(p)) return {};
+  return JSON.parse(fs.readFileSync(p, 'utf-8'));
+}
+
+function readLocalConfig(tmpDir) {
+  const p = path.join(tmpDir, 'config.local.json');
+  if (!fs.existsSync(p)) return {};
+  return JSON.parse(fs.readFileSync(p, 'utf-8'));
+}
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe('cmdConfigSet - testing.packages.tool validator (PKG-19)', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('accepts "auto"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', 'auto', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.tool, 'auto');
+  });
+
+  test('accepts "snyk"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', 'snyk', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.tool, 'snyk');
+  });
+
+  test('accepts "osv"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', 'osv', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.tool, 'osv');
+  });
+
+  test('accepts "native"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', 'native', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.tool, 'native');
+  });
+
+  test('rejects "bogus"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', 'bogus', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages tool/);
+    assert.match(r.stderr, /auto, snyk, osv, native/);
+  });
+
+  test('rejects empty string', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.tool', '', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages tool/);
+  });
+});
+
+describe('cmdConfigSet - testing.packages.severity_threshold validator (PKG-19)', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('accepts "critical"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.severity_threshold', 'critical', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.severity_threshold, 'critical');
+  });
+
+  test('accepts "high"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.severity_threshold', 'high', true));
+    assert.strictEqual(r.exitCode, 0);
+  });
+
+  test('accepts "medium"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.severity_threshold', 'medium', true));
+    assert.strictEqual(r.exitCode, 0);
+  });
+
+  test('accepts "low"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.severity_threshold', 'low', true));
+    assert.strictEqual(r.exitCode, 0);
+  });
+
+  test('rejects "wat"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.severity_threshold', 'wat', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages severity/);
+    assert.match(r.stderr, /critical, high, medium, low/);
+  });
+});
+
+describe('cmdConfigSet - testing.packages.include_dev_dependencies (PKG-19)', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('accepts "true" and stores as boolean true', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.include_dev_dependencies', 'true', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.include_dev_dependencies, true);
+  });
+
+  test('accepts "false" and stores as boolean false', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.include_dev_dependencies', 'false', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.include_dev_dependencies, false);
+  });
+});
+
+describe('cmdConfigSet - testing.packages.timeout_seconds range validator (PKG-19)', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('accepts 300 (default)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', '300', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).testing.packages.timeout_seconds, 300);
+  });
+
+  test('accepts 10 (min)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', '10', true));
+    assert.strictEqual(r.exitCode, 0);
+  });
+
+  test('accepts 3600 (max)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', '3600', true));
+    assert.strictEqual(r.exitCode, 0);
+  });
+
+  test('rejects 5 (below min)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', '5', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages timeout/);
+    assert.match(r.stderr, /between 10 and 3600/);
+  });
+
+  test('rejects 7200 (above max)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', '7200', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages timeout/);
+  });
+
+  test('rejects non-integer string (e.g., "abc")', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.timeout_seconds', 'abc', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid packages timeout/);
+  });
+});
+
+describe('cmdConfigSet - LOCAL_ONLY_KEYS guard for snyk_token (PKG-19, success criterion 5)', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('rejects testing.packages.snyk_token with local-only error message', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.snyk_token', 'abc123', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /local-only/);
+    assert.match(r.stderr, /config-local-set/);
+    assert.match(r.stderr, /testing\.packages\.snyk_token/);
+  });
+
+  test('rejection message does NOT contain "Unknown config key" (guard fires BEFORE membership check)', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.snyk_token', 'abc123', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.doesNotMatch(r.stderr, /Unknown config key/);
+  });
+
+  test('rejection happens even when value is empty string', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.packages.snyk_token', '', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /local-only/);
+  });
+});
+
+describe('cmdConfigLocalSet - accepts snyk_token unchanged', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('cmdConfigLocalSet writes snyk_token to config.local.json', () => {
+    const r = interceptExit(() => cmdConfigLocalSet(tmpDir, 'testing.packages.snyk_token', 'abc123', true));
+    assert.strictEqual(r.exitCode, 0);
+    const local = readLocalConfig(tmpDir);
+    assert.strictEqual(local.testing.packages.snyk_token, 'abc123');
+  });
+
+  test('value is readable back from config.local.json on disk', () => {
+    interceptExit(() => cmdConfigLocalSet(tmpDir, 'testing.packages.snyk_token', 'abc123', true));
+    const local = readLocalConfig(tmpDir);
+    assert.strictEqual(local.testing.packages.snyk_token, 'abc123');
+  });
+});
+
+describe('cmdConfigSet - no regression on existing keys', () => {
+  let tmpDir;
+  beforeEach(() => { tmpDir = makeTmpDir(); writeMinimalConfig(tmpDir); });
+  afterEach(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+
+  test('workflow.research still accepts true', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'workflow.research', 'true', true));
+    assert.strictEqual(r.exitCode, 0);
+    assert.strictEqual(readSharedConfig(tmpDir).workflow.research, true);
+  });
+
+  test('git.sync_push still rejects invalid sync mode', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'git.sync_push', 'bogus', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Invalid sync mode/);
+  });
+
+  test('Unknown key (e.g., testing.unknown) still rejects with "Unknown config key"', () => {
+    const r = interceptExit(() => cmdConfigSet(tmpDir, 'testing.unknown', 'x', true));
+    assert.strictEqual(r.exitCode, 1);
+    assert.match(r.stderr, /Unknown config key/);
+  });
+});