@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/config-loader.cjs

@@ -135,6 +135,7 @@ const CONFIG_DEFAULTS = {
     firecrawl: _getConfigDefault('firecrawl'),
     exa_search: _getConfigDefault('exa_search'),
     text_mode: _getNestedConfigDefault('workflow', 'text_mode'),
+    compact_content: _getNestedConfigDefault('workflow', 'compact_content'),
     sub_repos: _getNestedConfigDefault('planning', 'sub_repos'),
     pr_strict: _getNestedConfigDefault('planning', 'pr_strict'),
     resolve_model_ids: _getConfigDefault('resolve_model_ids'),
@@ -831,6 +832,7 @@ function loadConfigResolved(cwd, options = {}) {
             branching_strategy: get('branching_strategy', { section: 'git', field: 'branching_strategy' }) ?? defaults.branching_strategy,
             base_branch: get('base_branch', { section: 'git', field: 'base_branch' }),
             protected_branches: getNested('git', 'protected_branches'),
+            allow_default_branch_commits: getNested('git', 'allow_default_branch_commits'),
             phase_branch_template: get('phase_branch_template', { section: 'git', field: 'phase_branch_template' }) ?? defaults.phase_branch_template,
             milestone_branch_template: get('milestone_branch_template', { section: 'git', field: 'milestone_branch_template' }) ?? defaults.milestone_branch_template,
             quick_branch_template: get('quick_branch_template', { section: 'git', field: 'quick_branch_template' }) ?? defaults.quick_branch_template,
@@ -844,6 +846,7 @@ function loadConfigResolved(cwd, options = {}) {
             firecrawl: get('firecrawl') ?? defaults.firecrawl,
             exa_search: get('exa_search') ?? defaults.exa_search,
             mvp_mode: get('mvp_mode', { section: 'workflow', field: 'mvp_mode' }) ?? false,
+            tdd_mode: getNested('workflow', 'tdd_mode') ?? false,
             text_mode: get('text_mode', { section: 'workflow', field: 'text_mode' }) ?? defaults.text_mode,
             auto_advance: get('auto_advance', { section: 'workflow', field: 'auto_advance' }) ?? false,
             _auto_chain_active: get('_auto_chain_active', { section: 'workflow', field: '_auto_chain_active' }) ?? false,
@@ -856,6 +859,7 @@ function loadConfigResolved(cwd, options = {}) {
             project_code: get('project_code') ?? defaults.project_code,
             subagent_timeout: get('subagent_timeout', { section: 'workflow', field: 'subagent_timeout' }) ?? defaults.subagent_timeout,
             model_overrides: (parsed['model_overrides']) || null,
+            agent_tools: (parsed['agent_tools']) || null,
             models: (parsed['models']) || null,
             granularity: parsed['granularity'] !== undefined ? parsed['granularity'] : null,
             granularities: (parsed['granularities']) || null,

package/gsd-core/bin/lib/config.cjs

@@ -81,6 +81,11 @@ const SCHEMA_DEFAULTS = {
     // #1689: per-plan agent_hint executor routing — default-on. A no-op for plans
     // without an agent_hint field, so existing dispatch is byte-identical.
     'workflow.agent_hint_routing': true,
+    // #4401: Compact Content mode gate — derived from the defaults manifest via
+    // CONFIG_DEFAULTS (added in config-loader.cts) so the manifest stays the
+    // single source of truth, matching workflow.smart_zone_tokens /
+    // planning.pr_strict / workflow.inline_plan_threshold below.
+    'workflow.compact_content': CONFIG_DEFAULTS.compact_content,
     // Derived from the defaults manifest rather than restated, so the manifest
     // stays the single source of truth for the smart-zone budget (#2630).
     'workflow.smart_zone_tokens': CONFIG_DEFAULTS.smart_zone_tokens,
@@ -93,6 +98,27 @@ const SCHEMA_DEFAULTS = {
     // effective default existed only as the workflow's shell fallback and the
     // docs disagreed (settings-advanced said 3). Manifest stays the one owner.
     'workflow.inline_plan_threshold': CONFIG_DEFAULTS.inline_plan_threshold,
+    // #4285 review: an absent threshold resolved to "Key not found" while the
+    // hook silently used 35/25 — the query surface disagreeing with the reader.
+    //
+    // Restated here rather than derived: `CONFIG_DEFAULTS` is re-exported with a
+    // FLATTENED shape that drops the manifest's nested blocks, so
+    // `CONFIG_DEFAULTS.hooks` is undefined at runtime and the manifest cannot
+    // feed these two rows the way `workflow.smart_zone_tokens` above is fed.
+    //
+    // Not added to `buildNewProjectConfig` either, and that one is deliberate
+    // rather than incidental: it writes a `hooks` object into every NEW project's
+    // config.json, which would freeze today's fire-points as an explicit
+    // per-project override everywhere — the opposite of this PR's premise that an
+    // absent key tracks the shipped default. (The manifest alone would NOT have
+    // that effect; `buildNewProjectConfig` builds its own literal. Correcting an
+    // earlier version of this comment that ran the two together.)
+    //
+    // That leaves ONE copy of 35/25 outside the hook — these two rows — and
+    // `tests/config.test.cjs` pins them against the hook's exported
+    // WARNING_THRESHOLD/CRITICAL_THRESHOLD so the copies cannot drift.
+    'hooks.context_warning_threshold': 35,
+    'hooks.context_critical_threshold': 25,
 };
 /**
  * Resolve a schema-level default for an absent key (#2256). Checks the legacy
@@ -308,6 +334,7 @@ function buildNewProjectConfig(userChoices) {
             human_verify_mode: 'end-of-phase',
             context_guard_mode: 'warn',
             text_mode: false,
+            compact_content: false,
             research_before_questions: false,
             discuss_mode: 'discuss',
             skip_discuss: false,
@@ -564,19 +591,35 @@ function _unsetNestedValue(config, keyPath) {
  * Does not call `output()`, so can be used as one step in a command without triggering `exit(0)` in
  * the happy path. But note that `error()` will still `exit(1)` out of the process.
  */
+/**
+ * Loads `.planning/config.json` as a plain object, or `{}` if the file does
+ * not exist. A parse failure calls `error()` (process-exiting) rather than
+ * throwing, matching every caller's existing behavior.
+ *
+ * Single source for this load+parse step — `setConfigValue`,
+ * `unsetConfigValue`, `setConfigValues`, `previewConfigValue`, and
+ * `previewUnsetConfigValue` all delegate here instead of each repeating the
+ * same try/catch (CLAUDE.md's "Generative Fix Divergence" known-defect
+ * pattern: independently-guessed copies of the same logic can silently
+ * drift apart).
+ */
+function loadConfigJson(cwd) {
+    const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
+    let config = {};
+    try {
+        if (node_fs_1.default.existsSync(configPath)) {
+            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        }
+    }
+    catch (err) {
+        error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
+    }
+    return config;
+}
 function unsetConfigValue(cwd, keyPath) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const { previousValue, existed } = _unsetNestedValue(config, keyPath);
         // Write back
         try {
@@ -598,16 +641,7 @@ function unsetConfigValue(cwd, keyPath) {
 function setConfigValue(cwd, keyPath, parsedValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const previousValue = _setNestedValue(config, keyPath, parsedValue);
         // Write back
         try {
@@ -619,6 +653,29 @@ function setConfigValue(cwd, keyPath, parsedValue) {
         }
     });
 }
+/**
+ * #4444: read-only preview counterpart to `setConfigValue` — loads config
+ * exactly like the real setter and reuses `_setNestedValue` (the SAME
+ * traversal/creation logic, including its prototype-pollution guards) on a
+ * throwaway in-memory copy that is NEVER written back to disk. This is what
+ * makes the dry-run preview provably identical to what the real write would
+ * compute, rather than a second, hand-maintained traversal that could drift
+ * from the real one.
+ */
+function previewConfigValue(cwd, keyPath, parsedValue) {
+    const config = loadConfigJson(cwd);
+    const previousValue = _setNestedValue(config, keyPath, parsedValue);
+    return { key: keyPath, value: parsedValue, previousValue };
+}
+/**
+ * #4444: read-only preview counterpart to `unsetConfigValue` — same pattern
+ * as `previewConfigValue`, reusing `_unsetNestedValue` on a throwaway copy.
+ */
+function previewUnsetConfigValue(cwd, keyPath) {
+    const config = loadConfigJson(cwd);
+    const { previousValue, existed } = _unsetNestedValue(config, keyPath);
+    return { key: keyPath, value: null, previousValue, existed };
+}
 /**
  * Batched sibling of setConfigValue: apply multiple key-path writes in a
  * single load → set-all → write cycle inside ONE withPlanningLock call.
@@ -635,16 +692,7 @@ function setConfigValues(cwd, entries) {
     }
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const results = [];
         for (const entry of entries) {
             const previousValue = _setNestedValue(config, entry.keyPath, entry.value);
@@ -676,14 +724,8 @@ function assertEnumValue(parsedValue, rawVal, allowed, label) {
         error(`Invalid ${label} '${rawVal}'. Valid values: ${allowed.join(', ')}`);
     }
 }
-/**
- * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
- * "workflow.research").
- *
- * Note that this exits the process (via `output()`) even in the happy path; use `setConfigValue()`
- * directly if you need to avoid this.
- */
-function cmdConfigSet(cwd, keyPath, value, raw) {
+function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
+    const dryRun = options.dryRun === true;
     if (!keyPath) {
         error('Usage: config-set <key.path> <value>', ERROR_REASON.USAGE);
     }
@@ -733,6 +775,18 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // present, truthy-adjacent value that consumers must special-case — worst for
     // secret keys where a leftover value can be passed as a real credential.
     if (parsedValue === null) {
+        if (dryRun) {
+            const preview = previewUnsetConfigValue(cwd, kp);
+            if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+                const maskedPrev = preview.previousValue === undefined
+                    ? undefined
+                    : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+                output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: maskedPrev, masked: true }, raw, `${kp} unset (dry run)`);
+                return;
+            }
+            output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: preview.previousValue }, raw, `${kp} unset (dry run)`);
+            return;
+        }
         const unsetResult = unsetConfigValue(cwd, kp);
         if ((0, secrets_cjs_1.isSecretKey)(kp)) {
             const maskedPrev = unsetResult.previousValue === undefined
@@ -787,6 +841,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Compact Content mode gate (#4139)
+    if (kp === 'workflow.compact_content') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid workflow.compact_content '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // Per-plan executor routing via agent_hint frontmatter (#1689)
     if (kp === 'workflow.agent_hint_routing') {
         if (typeof parsedValue !== 'boolean') {
@@ -835,6 +895,48 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid statusline.show_git '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Context-monitor fire-points (#4285) — a percentage of the context window
+    // REMAINING, so the domain is 0-100 and the hook compares them against
+    // `remaining_percentage`. Rejecting an out-of-domain value here keeps accept
+    // and honour in agreement ON THE DOMAIN: the hook falls back to its default
+    // for a value outside it, so reporting success would be a lie. That agreement
+    // is per-key and no wider — a value accepted here can still be superseded at
+    // read time by the hook's pair check, and a scoped write (GSD_PROJECT /
+    // GSD_WORKSTREAM) lands in a config the hook does not read at all. The PAIR
+    // (critical < warning) is deliberately NOT enforced here: config-set writes
+    // one key per call, so a two-step retune can be transiently inconsistent on
+    // disk and a check here would reject that intermediate write.
+    if (kp === 'hooks.context_warning_threshold' || kp === 'hooks.context_critical_threshold') {
+        if (typeof parsedValue !== 'number' || !Number.isFinite(parsedValue) || parsedValue < 0 || parsedValue > 100) {
+            error(`Invalid ${kp} '${val}'. Must be a number between 0 and 100 (percent of context window remaining).`);
+        }
+        // The two ENDPOINTS that are in range but can never form a valid pair are
+        // refused here rather than stored (#4285 review). `critical < warning` must
+        // hold at read time and BOTH sides are clamped to 0-100, so `warning: 0`
+        // has no legal partner (nothing is below 0) and `critical: 100` has none
+        // either (nothing above 100). Either one is silently discarded by the hook
+        // for EVERY value of the other key — verified: both resolve to the 35/25
+        // defaults against a present, absent, or extreme partner, while 0.001 and
+        // 99.999 are honoured.
+        //
+        // Storing a value the reader can never honour is exactly the
+        // accept-then-discard shape this codebase refuses elsewhere, so this fails
+        // at write time where the operator can see it. The pair itself is still NOT
+        // checked here — config-set writes one key per call, so a two-step retune
+        // is legitimately inconsistent on disk in between.
+        if (kp === 'hooks.context_warning_threshold' && parsedValue === 0) {
+            error(`Invalid ${kp} '${val}'. 0 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `critical value is below 0, so a warning of 0 would always fall back to the 35/25 `
+                + `defaults. Use a value above 0.`);
+        }
+        if (kp === 'hooks.context_critical_threshold' && parsedValue === 100) {
+            error(`Invalid ${kp} '${val}'. 100 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `warning value is above 100, so a critical of 100 would always fall back to the `
+                + `35/25 defaults. Use a value below 100.`);
+        }
+    }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
     if (kp === 'code_quality.fallow.scope')
@@ -921,6 +1023,19 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             }
         }
     }
+    if (dryRun) {
+        const preview = previewConfigValue(cwd, kp, parsedValue);
+        if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+            const masked = (0, secrets_cjs_1.maskSecret)(parsedValue);
+            const maskedPrev = preview.previousValue === undefined
+                ? undefined
+                : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+            output({ dry_run: true, would_update: true, key: kp, value: masked, previousValue: maskedPrev, masked: true }, raw, `${kp}=${masked} (dry run)`);
+            return;
+        }
+        output({ dry_run: true, would_update: true, key: kp, value: parsedValue, previousValue: preview.previousValue }, raw, `${kp}=${String(parsedValue)} (dry run)`);
+        return;
+    }
     const setConfigValueResult = setConfigValue(cwd, kp, parsedValue);
     // Mask secrets in both JSON and text output. The plaintext is written
     // to config.json (that's where secrets live on disk); the CLI output

package/gsd-core/bin/lib/core-utils.cjs

@@ -43,6 +43,11 @@ const phaseIdModule = require("./phase-id.cjs");
 const planningWorkspace = require("./planning-workspace.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const shellCommandProjection = require("./shell-command-projection.cjs");
+// planning-scope.cjs is a leaf module (no imports of its own — see its file
+// header), so importing it here directly cannot introduce a cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningScopeMod = require("./planning-scope.cjs");
+const { SCOPE } = planningScopeMod;
 // ─── Line-ending normalization ─────────────────────────────────────────────────
 /**
  * Normalize every line ending in `content` to a bare `\n`, ONCE — the shared
@@ -271,16 +276,38 @@ function transliterateForSlug(text) {
  * Degrades on an unreadable directory instead of throwing: empty arrays,
  * every flag false, scope UNREADABLE (mirroring scanPhasePlans's own
  * degrade path).
+ *
+ * #4014 (epic #3473 B4-unreadable): this function's OWN readdirSync used to
+ * catch its own failure and then return `scope: scan.scope` — the scope of
+ * the UNRELATED, already-successful scanPhasePlans call — silently dropping
+ * that THIS read failed. The own-readdirSync is now routed through
+ * findContextMdIn's directory-string form (which never throws and reports
+ * its own SCOPE.UNREADABLE), and the two independently-scoped answers are
+ * combined into the worse of the two below — never letting a successful
+ * scan.scope mask this function's own failed read.
+ *
+ * The combination is written out as a two-value comparison rather than
+ * calling planning-snapshot.cts's `worstScope` directly: that module
+ * requires core-utils.cjs (for `findOrphanSummaries`) at its own top level,
+ * so importing it back here would create a tight, direct
+ * core-utils.cjs <-> planning-snapshot.cjs cycle — a materially different
+ * (and riskier) shape than this file's existing, documented lazy-access
+ * cyclic partners (planning-workspace.cjs, phase-id.cjs), which
+ * planning-snapshot.cts sits *above* in the dependency graph, not beside.
+ * `findContextMdIn`'s directory-string form can only ever report
+ * SCOPE.COMPLETE or SCOPE.UNREADABLE (a single readdirSync is binary — see
+ * its own doc comment), so per planning-snapshot.cts's SCOPE_SEVERITY
+ * ordering (UNREADABLE is maximal), `worstScope(scan.scope, ownScope)` is
+ * exactly `ownScope === UNREADABLE ? UNREADABLE : scan.scope` — the
+ * expression below is that identity, not a re-derivation of the ordering.
  */
 function getPhaseFileStats(phaseDir) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const scanPhasePlans = require('./plan-scan.cjs');
     const scan = scanPhasePlans(phaseDir);
-    let files;
-    try {
-        files = node_fs_1.default.readdirSync(phaseDir);
-    }
-    catch {
+    const { files, scope: ownScope } = planningWorkspace.findContextMdIn(phaseDir);
+    const scope = ownScope === SCOPE.UNREADABLE ? SCOPE.UNREADABLE : scan.scope;
+    if (ownScope === SCOPE.UNREADABLE) {
         return {
             plans: scan.planFiles,
             summaries: scan.summaryFiles,
@@ -288,7 +315,7 @@ function getPhaseFileStats(phaseDir) {
             hasContext: false,
             hasVerification: false,
             hasReviews: false,
-            scope: scan.scope,
+            scope,
         };
     }
     const scopedFiles = phaseIdModule.scopeToPhase(files, node_path_1.default.basename(phaseDir));
@@ -299,7 +326,7 @@ function getPhaseFileStats(phaseDir) {
         hasContext: planningWorkspace.findContextMdIn(scopedFiles) !== null,
         hasVerification: scopedFiles.some(f => f.endsWith('-VERIFICATION.md') || f === 'VERIFICATION.md'),
         hasReviews: scopedFiles.some(f => f.endsWith('-REVIEWS.md') || f === 'REVIEWS.md'),
-        scope: scan.scope,
+        scope,
     };
 }
 /**

package/gsd-core/bin/lib/coverage.cjs

@@ -435,7 +435,7 @@ function cmdClassify(cwd, options = {}, raw) {
     }
     let resolvedPath;
     try {
-        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', { allowAbsolute: true });
+        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
     }
     catch (e) {
         // Emit a structured command error instead of leaking a raw stack trace.