@naxodev/apnea 0.2.0 → 0.2.2

package/extension/domain/paths.ts

@@ -21,17 +21,8 @@ export function projectConfigPath(root = cwd()): string {
   return path.join(apneaRoot(root), "config.json")
 }
 
-function homedir(): string {
-  // Env first so an overridden HOME still wins (Bun's os.homedir() reads the
-  // passwd entry and ignores $HOME), then the passwd entry as the floor.
-  // Never "": an empty home makes globalConfigPath() cwd-relative, i.e. the
-  // *project* repo would be read as the trusted global config — the one place
-  // profiles/cmd_interactive are honoured. node:os is a pure read here.
-  return process.env.HOME || process.env.USERPROFILE || os.homedir()
-}
-
-export function globalConfigPath(): string {
-  return path.join(homedir(), ".config", "apnea", "config.json")
+export function globalConfigPath(home = os.homedir()): string {
+  return path.join(home, ".config", "apnea", "config.json")
 }
 
 export function artifactsDir(root = cwd()): string {

package/extension/domain/timeouts.ts

@@ -16,6 +16,10 @@ const STEP_KEY: Record<DispatchKind, string> = {
 
 export const DEFAULT_TIMEOUT_MS = 900_000
 
+export function deadlineAfter(start: number, duration: number): number {
+  return Math.min(Number.MAX_SAFE_INTEGER, start + duration)
+}
+
 export function timeoutMsForKind(
   kind: DispatchKind,
   timeouts: Record<string, number>,

package/extension/domain/types.ts

@@ -12,10 +12,59 @@ export type Role = "orchestrator" | "planner" | "reviewer" | "coder"
 
 export type RoleMode = "oneshot" | "interactive"
 
+export type PendingDelivery = "manual" | "interactive"
+
 export type Verdict = "APPROVED" | "CHANGES_REQUIRED"
 
 export type ReworkTarget = "code" | "phase_package"
 
+export type RequiredReworkTarget = "plan" | ReworkTarget
+
+/** Fields every pending commit carries regardless of backend. */
+export interface PendingCommitCore {
+  /** Transaction id; appears in the commit message as `Apnea-Transaction: <id>`. */
+  id: string
+  /** Phase whose completion this transaction commits. */
+  phase_index: number
+  /** Full commit message including the `Apnea-Transaction:` trailer line. */
+  message: string
+  /** Whether completion advances to finishing instead of the next phase. */
+  no_remaining_phases: boolean
+  /** Repo-relative `.apnea/` path of the verify log for this phase. */
+  verify_log: string
+}
+
+/** Git anchor captured before any ref moves: the exact commit to create. */
+export interface GitPendingCommit extends PendingCommitCore {
+  backend: "git"
+  /** Full ref (e.g. `refs/heads/apnea/slug`) the commit must land on. */
+  branch: string
+  /** Expected HEAD when completion starts; also the created commit's parent. */
+  parent_commit: string
+  /** Prepared tree id (staged with `.apnea` excluded). */
+  tree_id: string
+}
+
+/** jj anchor captured right after describing `@`. */
+export interface JjPendingCommit extends PendingCommitCore {
+  backend: "jj"
+  /** Change id of the described working-copy change. */
+  change_id: string
+  /** Fingerprint of the change's non-.apnea diff at preparation time. */
+  content_fingerprint: string
+}
+
+/**
+ * Durable record of an in-flight commit. Written after VCS preparation and
+ * before completion, so a crash anywhere afterwards can recognize and finish
+ * the transaction exactly once.
+ */
+export type PendingCommit = GitPendingCommit | JjPendingCommit
+
+/** Internal decode marker for ambiguous version-1 planning state. */
+export const LEGACY_PLAN_REWORK = Symbol("apnea.legacy-plan-rework")
+export const LEGACY_CODE_REWORK = Symbol("apnea.legacy-code-rework")
+
 export type VcsBackend = "jj" | "git"
 
 export interface Profile {
@@ -35,7 +84,7 @@ export interface ApneaConfig {
 }
 
 export interface RunState {
-  version: 1
+  version: 2
   slug: string
   step: Step
   phase_index: number
@@ -50,6 +99,8 @@ export interface RunState {
   pending_artifact: string | null
   /** Role for pending dispatch */
   pending_role: Role | null
+  /** Delivery boundary crossed for the pending dispatch, if known. */
+  pending_delivery: PendingDelivery | null
   /** Herdr pane id for the in-flight dispatch */
   pending_pane_id: string | null
   /** Label of that pane (apnea:role:unique) */
@@ -99,8 +150,19 @@ export interface RunState {
   current_phase_package: string | null
   /** Last code-review path for commit gate */
   current_code_review: string | null
-  /** The next phase-package dispatch must consume planner-owned rework. */
-  phase_package_rework: boolean
+  /** The exact dispatch that owns the next review round, if any. */
+  required_rework: RequiredReworkTarget | null
+  /**
+   * In-flight commit transaction, if any. Set after VCS preparation and
+   * cleared only after completion + bookmark succeed; a crash leaves it
+   * durable so the next `workflow_commit_phase` call resumes that
+   * transaction instead of re-running gates and verification.
+   */
+  pending_commit: PendingCommit | null
+  /** Never serialized. An old planning state needs an explicit assertion. */
+  [LEGACY_PLAN_REWORK]?: true
+  /** Never serialized. Ambiguous old coding state needs an explicit assertion. */
+  [LEGACY_CODE_REWORK]?: true
 }
 
 export interface FrontMatter {

package/extension/errors.ts

@@ -2,13 +2,13 @@ import { Schema } from "effect"
 import { err, type ToolErr } from "./result.ts"
 
 /** No `.apnea/state.json` for the current project root. */
-export class NoRunState extends Schema.TaggedErrorClass<NoRunState>()(
+export class NoRunState extends Schema.TaggedError<NoRunState>()(
   "NoRunState",
   {},
 ) {}
 
 /** Tool call refused by the step → legal-tools table. */
-export class IllegalTool extends Schema.TaggedErrorClass<IllegalTool>()(
+export class IllegalTool extends Schema.TaggedError<IllegalTool>()(
   "IllegalTool",
   {
     step: Schema.String,
@@ -18,7 +18,7 @@ export class IllegalTool extends Schema.TaggedErrorClass<IllegalTool>()(
 ) {}
 
 /** Dispatch kind refused at the current step. */
-export class IllegalKind extends Schema.TaggedErrorClass<IllegalKind>()(
+export class IllegalKind extends Schema.TaggedError<IllegalKind>()(
   "IllegalKind",
   {
     step: Schema.String,
@@ -28,7 +28,7 @@ export class IllegalKind extends Schema.TaggedErrorClass<IllegalKind>()(
 ) {}
 
 /** Global or project config missing, invalid, or untrusted. */
-export class ConfigError extends Schema.TaggedErrorClass<ConfigError>()(
+export class ConfigError extends Schema.TaggedError<ConfigError>()(
   "ConfigError",
   {
     message: Schema.String,
@@ -38,7 +38,7 @@ export class ConfigError extends Schema.TaggedErrorClass<ConfigError>()(
 ) {}
 
 /** `state.json` present but not decodable / inconsistent. */
-export class StateCorrupt extends Schema.TaggedErrorClass<StateCorrupt>()(
+export class StateCorrupt extends Schema.TaggedError<StateCorrupt>()(
   "StateCorrupt",
   {
     path: Schema.String,
@@ -47,23 +47,32 @@ export class StateCorrupt extends Schema.TaggedErrorClass<StateCorrupt>()(
 ) {}
 
 /** VCS detect / dirty / commit / bookmark failure. */
-export class VcsError extends Schema.TaggedErrorClass<VcsError>()("VcsError", {
+export class VcsError extends Schema.TaggedError<VcsError>()("VcsError", {
   message: Schema.String,
   command: Schema.optional(Schema.String),
 }) {}
 
-/** Herdr CLI or pane failure. */
-export class HerdrError extends Schema.TaggedErrorClass<HerdrError>()(
-  "HerdrError",
+/** Another live Apnea process owns the repository mutation lock. */
+export class OperationLocked extends Schema.TaggedError<OperationLocked>()(
+  "OperationLocked",
   {
     message: Schema.String,
-    command: Schema.optional(Schema.String),
-    details: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+    repository: Schema.String,
+    lock_path: Schema.String,
+    reason: Schema.String,
+    pid: Schema.Number,
   },
 ) {}
 
+/** Herdr CLI or pane failure. */
+export class HerdrError extends Schema.TaggedError<HerdrError>()("HerdrError", {
+  message: Schema.String,
+  command: Schema.optional(Schema.String),
+  details: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+}) {}
+
 /** Commit/review gate refused (e.g. verdict not APPROVED). */
-export class GateRefused extends Schema.TaggedErrorClass<GateRefused>()(
+export class GateRefused extends Schema.TaggedError<GateRefused>()(
   "GateRefused",
   {
     gate: Schema.String,
@@ -73,7 +82,7 @@ export class GateRefused extends Schema.TaggedErrorClass<GateRefused>()(
 ) {}
 
 /** `workflow_wait` hit its timeout without a complete artifact. */
-export class WaitTimeout extends Schema.TaggedErrorClass<WaitTimeout>()(
+export class WaitTimeout extends Schema.TaggedError<WaitTimeout>()(
   "WaitTimeout",
   {
     artifact: Schema.String,
@@ -83,7 +92,7 @@ export class WaitTimeout extends Schema.TaggedErrorClass<WaitTimeout>()(
 ) {}
 
 /** `workflow_wait` aborted (Esc / cancel signal). */
-export class WaitAborted extends Schema.TaggedErrorClass<WaitAborted>()(
+export class WaitAborted extends Schema.TaggedError<WaitAborted>()(
   "WaitAborted",
   {
     artifact: Schema.String,
@@ -91,8 +100,17 @@ export class WaitAborted extends Schema.TaggedErrorClass<WaitAborted>()(
   },
 ) {}
 
+/** A non-wait operation was interrupted by its host cancellation signal. */
+export class OperationAborted extends Schema.TaggedError<OperationAborted>()(
+  "OperationAborted",
+  {
+    operation: Schema.String,
+    details: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+  },
+) {}
+
 /** Artifact exists but front-matter / shape is invalid. */
-export class ArtifactInvalid extends Schema.TaggedErrorClass<ArtifactInvalid>()(
+export class ArtifactInvalid extends Schema.TaggedError<ArtifactInvalid>()(
   "ArtifactInvalid",
   {
     artifact: Schema.String,
@@ -101,7 +119,7 @@ export class ArtifactInvalid extends Schema.TaggedErrorClass<ArtifactInvalid>()(
 ) {}
 
 /** Phase-package verify commands failed — commit refused. */
-export class VerifyFailed extends Schema.TaggedErrorClass<VerifyFailed>()(
+export class VerifyFailed extends Schema.TaggedError<VerifyFailed>()(
   "VerifyFailed",
   {
     commands: Schema.Array(Schema.String),
@@ -119,10 +137,12 @@ export type AppError =
   | ConfigError
   | StateCorrupt
   | VcsError
+  | OperationLocked
   | HerdrError
   | GateRefused
   | WaitTimeout
   | WaitAborted
+  | OperationAborted
   | ArtifactInvalid
   | VerifyFailed
 
@@ -133,10 +153,12 @@ const APP_ERROR_TAG_LIST = [
   "ConfigError",
   "StateCorrupt",
   "VcsError",
+  "OperationLocked",
   "HerdrError",
   "GateRefused",
   "WaitTimeout",
   "WaitAborted",
+  "OperationAborted",
   "ArtifactInvalid",
   "VerifyFailed",
 ] as const satisfies readonly AppError["_tag"][]
@@ -204,6 +226,15 @@ export function toToolResult(e: AppError): ToolErr {
       return err(e.message, {
         data: e.command !== undefined ? { command: e.command } : undefined,
       })
+    case "OperationLocked":
+      return err(e.message, {
+        data: {
+          repository: e.repository,
+          lock_path: e.lock_path,
+          reason: e.reason,
+          pid: e.pid,
+        },
+      })
     case "HerdrError":
       return err(e.message, {
         data:
@@ -233,6 +264,10 @@ export function toToolResult(e: AppError): ToolErr {
       return err("workflow_wait aborted (Esc / cancel)", {
         data: { artifact: e.artifact, ...(e.details ?? {}) },
       })
+    case "OperationAborted":
+      return err(`${e.operation} aborted (signal / cancel)`, {
+        data: { operation: e.operation, ...(e.details ?? {}) },
+      })
     case "ArtifactInvalid":
       return err(e.message, { data: { artifact: e.artifact } })
     case "VerifyFailed":

package/extension/operation-hooks.ts

@@ -0,0 +1,6 @@
+export type OperationHooks = {
+  readonly signal?: AbortSignal
+  readonly onUpdate?: (partial: {
+    content: Array<{ type: "text"; text: string }>
+  }) => void
+}

package/extension/registry.ts

@@ -18,8 +18,8 @@ import {
   MAX_AUTO_POLL_MS,
   MIN_POLL_MS,
   type WaitParams,
-  type WaitHooks,
 } from "./workflows/wait.ts"
+import type { OperationHooks } from "./operation-hooks.ts"
 
 export type Operation = {
   /** Pi tool name, or null when the operation is not model-facing. */
@@ -46,14 +46,14 @@ export type Operation = {
 type RegisteredOperation = Operation & {
   readonly run: (
     params: Record<string, unknown>,
-    hooks?: WaitHooks,
+    hooks?: OperationHooks,
   ) => Promise<ToolResult>
 }
 
 export type ExecuteOperation = (
   verb: string,
   params: Record<string, unknown>,
-  hooks?: WaitHooks,
+  hooks?: OperationHooks,
 ) => Promise<ToolResult>
 
 // Sourced from domain/state-machine.ts (not hardcoded here) so a new kind
@@ -86,8 +86,8 @@ function createRegisteredOperations(
         force: Type.Optional(Type.Boolean()),
         agents_md: Type.Optional(Type.Boolean()),
       }),
-      run: (p) =>
-        apneaSetup(p as Parameters<typeof apneaSetup>[0], hostAdapter),
+      run: (p, hooks) =>
+        apneaSetup(p as Parameters<typeof apneaSetup>[0], hostAdapter, hooks),
     },
     {
       tool: "workflow_start",
@@ -115,7 +115,7 @@ function createRegisteredOperations(
       // Mirrors the guard in index.ts's execute(): without it, action=start
       // with no goal reaches slugify(undefined) in workflows/start.ts and
       // throws instead of returning a clean refusal.
-      run: (p) => {
+      run: (p, hooks) => {
         const params = p as Parameters<typeof workflowStart>[0]
         const action = params.action ?? "start"
         if (action === "start" && !params.goal?.trim()) {
@@ -132,16 +132,17 @@ function createRegisteredOperations(
             action,
           },
           hostAdapter,
+          hooks,
         )
       },
     },
     {
       tool: "dispatch_role",
       verb: "dispatch",
-      usage: "<kind> [--rework]",
+      usage: "<kind> [--rework] [--redeliver]",
       summary: "Write the task file and launch a role in a Herdr pane.",
       guidance:
-        "One outstanding dispatch at a time. Pass rework=true for plan/code after CHANGES_REQUIRED. Phase-package rework advances its round automatically from review frontmatter.",
+        "One outstanding dispatch at a time. Persisted review state selects rework and advances its round. rework=true is a deprecated assertion through 0.2.x and grants authority only for ambiguous version-1 plan or code migration. Use redeliver=true only to reuse matching pending ownership after proving the prior delivery is dead. A complete pending artifact refuses redelivery; call workflow_wait to ingest it.",
       params: operationParams({
         kind: DispatchKind,
         task_markdown: Type.Optional(
@@ -149,14 +150,22 @@ function createRegisteredOperations(
         ),
         rework: Type.Optional(
           Type.Boolean({
-            description: "Increment round after CHANGES_REQUIRED",
+            description:
+              "Deprecated assertion through 0.2.x; persisted state owns rework",
+          }),
+        ),
+        redeliver: Type.Optional(
+          Type.Boolean({
+            description:
+              "Reuse matching pending ownership after the prior delivery is demonstrably dead",
           }),
         ),
       }),
-      run: (p) =>
+      run: (p, hooks) =>
         workflowDispatch(
           p as Parameters<typeof workflowDispatch>[0],
           hostAdapter,
+          hooks,
         ),
     },
     {
@@ -180,8 +189,9 @@ function createRegisteredOperations(
       // moves, and then the schema promises a budget the runtime refuses.
       params: operationParams({
         poll_ms: Type.Optional(
-          Type.Number({
+          Type.Integer({
             minimum: MIN_POLL_MS,
+            maximum: Number.MAX_SAFE_INTEGER,
             description:
               `Milliseconds between polls. At least ${MIN_POLL_MS} — each poll spawns two herdr subprocesses. ` +
               `Keep it at or under ${MAX_AUTO_POLL_MS} unless you also pass budget_ms: above that, the floor ` +
@@ -189,7 +199,9 @@ function createRegisteredOperations(
           }),
         ),
         budget_ms: Type.Optional(
-          Type.Number({
+          Type.Integer({
+            minimum: 1,
+            maximum: Number.MAX_SAFE_INTEGER,
             description:
               `How long THIS call may block — not the role's deadline, which comes from config. ` +
               `Must be at least ${GRACE_MS} + max(${IDLE_NUDGE_AFTER_MS}, ${DEAD_POLLS_NEEDED} x poll_ms), so the call ` +
@@ -223,10 +235,11 @@ function createRegisteredOperations(
           }),
         ),
       }),
-      run: (p) =>
+      run: (p, hooks) =>
         workflowCommitPhase(
           p as Parameters<typeof workflowCommitPhase>[0],
           hostAdapter,
+          hooks,
         ),
     },
     {
@@ -236,7 +249,7 @@ function createRegisteredOperations(
       summary: "Read-only snapshot of run state and legal next calls.",
       guidance: "Never mutates. Safe to call at any point.",
       params: operationParams({}),
-      run: () => workflowStatus(hostAdapter),
+      run: (_p, hooks) => workflowStatus(hostAdapter, hooks),
     },
     {
       tool: null,
@@ -254,10 +267,11 @@ function createRegisteredOperations(
           description: "Round key, e.g. plan_review or phase-01/code_review",
         }),
       }),
-      run: (p) =>
+      run: (p, hooks) =>
         workflowResetRounds(
           p as Parameters<typeof workflowResetRounds>[0],
           hostAdapter,
+          hooks,
         ),
     },
   ]

package/extension/run-tool.ts

@@ -1,5 +1,5 @@
 import { Cause, Effect, Exit, Layer, Option, Result } from "effect"
-import { isAppError, toToolResult } from "./errors.ts"
+import { isAppError, OperationAborted, toToolResult } from "./errors.ts"
 import type { ToolResult } from "./result.ts"
 
 /**
@@ -12,15 +12,32 @@ export async function runToolResult<E, R>(
   // without the layer would type-check and then die as a service-not-found
   // defect on every invocation. Pass `Layer.empty` explicitly when R is never.
   layer: Layer.Layer<R, never, never>,
+  hooks: {
+    signal?: AbortSignal
+    operation?: string
+    abortDetails?: Record<string, unknown>
+  } = {},
 ): Promise<ToolResult> {
   const provided = Effect.provide(effect, layer) as Effect.Effect<ToolResult, E>
-  const exit = await Effect.runPromiseExit(provided)
+  const exit = await Effect.runPromiseExit(provided, { signal: hooks.signal })
 
   if (Exit.isSuccess(exit)) {
     return exit.value
   }
 
   const error = Exit.findErrorOption(exit)
+  if (
+    hooks.signal?.aborted ||
+    Result.isSuccess(Cause.findInterrupt(exit.cause))
+  ) {
+    return toToolResult(
+      new OperationAborted({
+        operation: hooks.operation ?? "operation",
+        details: hooks.abortDetails,
+      }),
+    )
+  }
+
   if (Option.isSome(error) && isAppError(error.value)) {
     return toToolResult(error.value)
   }

package/extension/schema/config.ts

@@ -20,18 +20,60 @@ const RoleBindingSchema = Schema.Struct({
   profile: Schema.String.check(Schema.isMinLength(1)),
 })
 
+const ReviewRoundCapSchema = Schema.Int.check(
+  Schema.isBetween({ minimum: 1, maximum: 20 }),
+)
+const TimeoutMsSchema = Schema.Int.check(
+  Schema.isBetween({ minimum: 1_000, maximum: Number.MAX_SAFE_INTEGER }),
+)
+
+function validReviewRoundCap(value: number): boolean {
+  return Number.isSafeInteger(value) && value >= 1 && value <= 20
+}
+
+function validTimeout(value: number): boolean {
+  return Number.isSafeInteger(value) && value >= 1_000
+}
+
+function sanitizeConfigNumbers(
+  config: Record<string, unknown>,
+): Record<string, unknown> {
+  const sanitized = { ...config }
+  if (
+    typeof sanitized.review_round_cap === "number" &&
+    !validReviewRoundCap(sanitized.review_round_cap)
+  ) {
+    delete sanitized.review_round_cap
+  }
+  if (
+    sanitized.timeouts_ms &&
+    typeof sanitized.timeouts_ms === "object" &&
+    !Array.isArray(sanitized.timeouts_ms)
+  ) {
+    const timeouts = {
+      ...(sanitized.timeouts_ms as Record<string, unknown>),
+    }
+    for (const [key, value] of Object.entries(timeouts)) {
+      if (typeof value === "number" && !validTimeout(value)) {
+        delete timeouts[key]
+      }
+    }
+    sanitized.timeouts_ms = timeouts
+  }
+  return sanitized
+}
+
 /**
  * Mirrors `schemas/config.schema.json` top-level keys.
  *
- * `review_round_cap` / `timeouts_ms` carry no range `check`: an out-of-range
- * number must fall back to the default (see below), not fail the decode. A
- * hard failure here bricks every tool until the file is hand-edited.
+ * Numeric fields are strict here. The decoders remove only invalid numeric
+ * values before decoding so published 0.2 per-field fallback remains intact.
  */
 export const GlobalConfigSchema = Schema.Struct({
   profiles: Schema.optional(Schema.Record(Schema.String, ProfileSchema)),
   roles: Schema.optional(Schema.Record(Schema.String, RoleBindingSchema)),
-  review_round_cap: Schema.optional(Schema.Number),
-  timeouts_ms: Schema.optional(Schema.Record(Schema.String, Schema.Number)),
+  review_round_cap: Schema.optional(ReviewRoundCapSchema),
+  timeouts_ms: Schema.optional(Schema.Record(Schema.String, TimeoutMsSchema)),
 })
 
 const PROJECT_KNOWN = new Set([
@@ -56,8 +98,8 @@ const PROJECT_FORBIDDEN = new Set([
  */
 export const ProjectConfigSchema = Schema.Struct({
   roles: Schema.optional(Schema.Record(Schema.String, RoleBindingSchema)),
-  review_round_cap: Schema.optional(Schema.Number),
-  timeouts_ms: Schema.optional(Schema.Record(Schema.String, Schema.Number)),
+  review_round_cap: Schema.optional(ReviewRoundCapSchema),
+  timeouts_ms: Schema.optional(Schema.Record(Schema.String, TimeoutMsSchema)),
   isolation: Schema.optional(Schema.Literal("shared_cwd")),
 })
 
@@ -125,7 +167,9 @@ export function decodeGlobalConfig(
   }
 
   const { pane_style: _legacy, ...globalConfig } = obj
-  const decoded = Schema.decodeUnknownResult(GlobalConfigSchema)(globalConfig)
+  const decoded = Schema.decodeUnknownResult(GlobalConfigSchema)(
+    sanitizeConfigNumbers(globalConfig),
+  )
   if (Result.isFailure(decoded)) {
     return configFail(decoded.failure.message)
   }
@@ -152,17 +196,14 @@ export function decodeGlobalConfig(
   const timeouts = { ...DEFAULT_TIMEOUTS }
   if (d.timeouts_ms) {
     for (const [k, v] of Object.entries(d.timeouts_ms)) {
-      if (typeof v === "number" && v >= 1000) timeouts[k] = v
+      if (validTimeout(v)) timeouts[k] = v
     }
   }
 
   return Result.succeed({
     profiles,
     roles,
-    review_round_cap:
-      typeof d.review_round_cap === "number" && d.review_round_cap >= 1
-        ? d.review_round_cap
-        : 3,
+    review_round_cap: d.review_round_cap ?? 3,
     timeouts_ms: timeouts,
   })
 }
@@ -228,7 +269,7 @@ export function decodeProjectConfig(
 
   const { pane_style: _legacy, ...projectConfig } = obj
   const decoded = Schema.decodeUnknownResult(ProjectConfigSchema)(
-    projectConfig,
+    sanitizeConfigNumbers(projectConfig),
     {
       onExcessProperty: "error",
     },
@@ -256,14 +297,15 @@ export function applyProjectConfig(
   const timeouts = { ...cfg.timeouts_ms }
   if (overlay.timeouts_ms) {
     for (const [k, v] of Object.entries(overlay.timeouts_ms)) {
-      if (typeof v === "number" && v >= 1000) timeouts[k] = v
+      if (validTimeout(v)) timeouts[k] = v
     }
   }
   return {
     profiles: cfg.profiles,
     roles,
     review_round_cap:
-      overlay.review_round_cap !== undefined && overlay.review_round_cap >= 1
+      overlay.review_round_cap !== undefined &&
+      validReviewRoundCap(overlay.review_round_cap)
         ? overlay.review_round_cap
         : cfg.review_round_cap,
     timeouts_ms: timeouts,