@opengsd/gsd-core 1.13.0 → 1.15.0

package/gsd-core/bin/lib/config-loader.cjs

@@ -28,6 +28,9 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// #4717: runtime-identity fill — env rung + per-install marker rung.
+const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
 const { planningDir, planningRoot } = planningWorkspace;
@@ -135,6 +138,7 @@ const CONFIG_DEFAULTS = {
     firecrawl: _getConfigDefault('firecrawl'),
     exa_search: _getConfigDefault('exa_search'),
     text_mode: _getNestedConfigDefault('workflow', 'text_mode'),
+    compact_content: _getNestedConfigDefault('workflow', 'compact_content'),
     sub_repos: _getNestedConfigDefault('planning', 'sub_repos'),
     pr_strict: _getNestedConfigDefault('planning', 'pr_strict'),
     resolve_model_ids: _getConfigDefault('resolve_model_ids'),
@@ -149,8 +153,21 @@ const CONFIG_DEFAULTS = {
     research_before_questions: _getNestedConfigDefault('workflow', 'research_before_questions'), // #3894
     smart_zone_tokens: _getNestedConfigDefault('workflow', 'smart_zone_tokens'),
     inline_plan_threshold: _getNestedConfigDefault('workflow', 'inline_plan_threshold'), // #3801
+    planner_stall_detection_enabled: _getNestedConfigDefault('planner', 'stall_detection_enabled'),
     max_prompt_tokens: _getNestedConfigDefault('review', 'max_prompt_tokens'),
 };
+/**
+ * Resolve the planner watchdog policy from hand-edited configuration.
+ * Only a real JSON boolean may override the default; strings/numbers/null
+ * fail safe to the manifest-owned default-on behavior (#4570).
+ */
+function resolvePlannerStallDetectionEnabled(value) {
+    if (typeof value === 'boolean')
+        return value;
+    // A missing or skewed manifest must never convert an absent override into
+    // permission to disable the watchdog. The documented contract is default-on.
+    return true;
+}
 /**
  * Deep-merge two plain config objects. `overlay` wins on key conflict.
  * Explicit `null` in overlay overrides base (null means "unset this key").
@@ -600,7 +617,7 @@ function _warnUnusableConfig(fault) {
  * cannot dirty the working tree; the ~30 callers that omit it keep persisting, so
  * a legacy config is still migrated exactly once by ordinary use.
  */
-function loadConfigResolved(cwd, options = {}) {
+function loadConfigResolvedInternal(cwd, options = {}) {
     // Opt-OUT, not opt-in: omitting the option must preserve the historical
     // write-back for every existing caller.
     const persist = options['persist'] !== false;
@@ -613,7 +630,7 @@ function loadConfigResolved(cwd, options = {}) {
         : (options['workstreamContext'] && Object.prototype.hasOwnProperty.call(options['workstreamContext'], 'ws'))
             ? options['workstreamContext']['ws']
             : (process.env['GSD_WORKSTREAM'] || null);
-    const ws = typeof activeWorkstream === 'string' ? activeWorkstream : (activeWorkstream === null ? null : null);
+    const ws = typeof activeWorkstream === 'string' ? activeWorkstream.trim() || null : null;
     // wsRequested: true when caller explicitly requested a non-empty workstream.
     // Used for source labeling (Fix 4) and early absent-dir intercept (Fix 2).
     const wsRequested = ws != null && ws !== '';
@@ -857,6 +874,7 @@ function loadConfigResolved(cwd, options = {}) {
             phase_naming: get('phase_naming') ?? defaults.phase_naming,
             project_code: get('project_code') ?? defaults.project_code,
             subagent_timeout: get('subagent_timeout', { section: 'workflow', field: 'subagent_timeout' }) ?? defaults.subagent_timeout,
+            planner_stall_detection_enabled: resolvePlannerStallDetectionEnabled(getNested('planner', 'stall_detection_enabled')),
             model_overrides: (parsed['model_overrides']) || null,
             agent_tools: (parsed['agent_tools']) || null,
             models: (parsed['models']) || null,
@@ -958,7 +976,7 @@ function loadConfigResolved(cwd, options = {}) {
         // `workstream: null` still wins the `hasOwnProperty` check at the top of this
         // function, so spreading cannot let `workstreamContext` reintroduce a workstream.
         if (wsRequested && rootParsed) {
-            const fb = loadConfigResolved(cwd, { ...options, workstream: null });
+            const fb = loadConfigResolvedInternal(cwd, { ...options, workstream: null });
             return fallback({ config: fb.config, source: 'root', degraded: true });
         }
         // Branch B, C, D, E
@@ -966,7 +984,7 @@ function loadConfigResolved(cwd, options = {}) {
             if (rootParsed) {
                 // Branch B: workstream requested but ws config.json absent; root config present.
                 // (Only reached when wsRequested is false — e.g. ws='' with .planning/workstreams//config.json)
-                const fb = loadConfigResolved(cwd, { ...options, workstream: null });
+                const fb = loadConfigResolvedInternal(cwd, { ...options, workstream: null });
                 return fallback({ config: fb.config, source: 'root', degraded: true });
             }
             // Branch C: .planning/ exists but no config.json and no root config — federated/builtin defaults
@@ -1015,6 +1033,7 @@ function loadConfigResolved(cwd, options = {}) {
                 resolve_model_ids: (globalDefaults['resolve_model_ids']) ?? defaults.resolve_model_ids,
                 context_window: (globalDefaults['context_window']) ?? defaults.context_window,
                 subagent_timeout: (globalDefaults['subagent_timeout']) ?? defaults.subagent_timeout,
+                planner_stall_detection_enabled: resolvePlannerStallDetectionEnabled(globalDefaults['planner']?.['stall_detection_enabled']),
                 model_overrides: (globalDefaults['model_overrides']) || null,
                 models: (globalDefaults['models']) || null,
                 granularity: (globalDefaults['granularity']) !== undefined ? globalDefaults['granularity'] : null,
@@ -1053,6 +1072,48 @@ function loadConfigResolved(cwd, options = {}) {
         }
     }
 }
+/**
+ * #4717 — fill an empty `runtime` from the environment, then the per-install
+ * marker. writeNonClaudeDefaults stamps `runtime` into the SHARED
+ * ~/.gsd/defaults.json with whichever non-Claude runtime installed first, so
+ * direct readers of config.runtime saw another runtime's identity (or
+ * nothing) on a multi-runtime machine. Copy-on-write: the builtin-defaults
+ * branch returns a shared object, so never assign into it. An explicit
+ * config.runtime is never overridden.
+ */
+function fillRuntimeIdentity(resolved) {
+    const cfg = resolved?.config;
+    if (!cfg)
+        return resolved;
+    const runtime = (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], (0, runtime_slash_cjs_1.readInstallRuntimeMarker)());
+    // Only a runtime the name policy can canonicalize is an identity. Unknown
+    // tokens pass THROUGH resolveRuntimeNameFromCandidates (future-runtime
+    // tolerance) and must not be materialized into config.runtime, where ~30
+    // consumers would read them — fail safe to no identity (#4717 review).
+    const canonicalRuntime = runtime ? (0, runtime_name_policy_cjs_1.canonicalizeRuntimeName)(runtime) : null;
+    if (!canonicalRuntime)
+        return resolved;
+    // Rung 1 — empty runtime: materialize THIS install's identity (env, then
+    // the per-install marker). An explicit runtime is never overridden.
+    if (!cfg['runtime']) {
+        return { ...resolved, config: { ...cfg, runtime: canonicalRuntime } };
+    }
+    // Rung 2 (#4717 stamped-defaults leg): the global-defaults branch forwards
+    // the SHARED ~/.gsd/defaults.json's runtime verbatim — whichever non-Claude
+    // runtime installed FIRST stamped that machine-wide file, and every other
+    // runtime's resolution inherited its identity (the issue's second failure
+    // shape). When THIS install carries its own identity (GSD_RUNTIME or the
+    // marker), the stamp — not the operator — is speaking: correct it. Project
+    // and workstream configs are explicit operator intent and are never touched;
+    // with no install identity of its own the stamped value stays (status quo).
+    if (resolved.source === 'global-defaults') {
+        return { ...resolved, config: { ...cfg, runtime: canonicalRuntime } };
+    }
+    return resolved;
+}
+function loadConfigResolved(cwd, options = {}) {
+    return fillRuntimeIdentity(loadConfigResolvedInternal(cwd, options));
+}
 /**
  * loadConfig — backwards-compatible config loading, now a thin wrapper over loadConfigResolved.
  * Returns the config object only; for provenance metadata use loadConfigResolved.
@@ -1071,6 +1132,7 @@ module.exports = {
     _getNestedConfigDefault,
     _getConfigValue,
     _getConfigNested,
+    resolvePlannerStallDetectionEnabled,
     _deepMergeConfig,
     _warnedUnknownConfigKeys,
     _warnedShadowedGlobalKeys,

package/gsd-core/bin/lib/config.cjs

@@ -20,11 +20,11 @@ const cliExitMod = require("./cli-exit.cjs");
 const { ExitError } = cliExitMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoader = require("./config-loader.cjs");
-const { CONFIG_DEFAULTS } = configLoader;
+const { CONFIG_DEFAULTS, resolvePlannerStallDetectionEnabled } = configLoader;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningDir, planningRoot, withPlanningLock } = planningWorkspace;
+const { planningDir, planningRoot, resolveEnvWorkstream, withPlanningLock } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
@@ -66,6 +66,14 @@ const SHIP_PR_BODY_TEMPLATE_TOKENS = new Set([
     'padded_phase',
 ]);
 const SHIP_PR_BODY_SOURCE_RE = /^(ROADMAP|PLAN|SUMMARY|VERIFICATION|STATE|REQUIREMENTS|CONTEXT)\.md\s+##\s+[^\r\n#][^\r\n]*$/;
+// ADR-612 PR-5: configuration accepts every convention the runtime can read.
+// Keep this distinct from roadmap-upgrade's supported target set: sequential
+// is valid project configuration but is not a migration destination.
+const VALID_PHASE_ID_CONVENTIONS = Object.freeze([
+    'sequential',
+    'milestone-prefixed',
+    'bracket',
+]);
 /**
  * Schema-level defaults for well-known config keys.
  * When a key is absent from config.json and no --default flag was supplied,
@@ -75,12 +83,18 @@ const SCHEMA_DEFAULTS = {
     'context_window': 200000,
     'executor.stall_detect_interval_minutes': 5,
     'executor.stall_threshold_minutes': 10,
+    'planner.stall_detection_enabled': CONFIG_DEFAULTS.planner_stall_detection_enabled,
     'planner.stall_detect_interval_minutes': 5,
     'planner.stall_threshold_minutes': 10,
     'git.create_tag': true,
     // #1689: per-plan agent_hint executor routing — default-on. A no-op for plans
     // without an agent_hint field, so existing dispatch is byte-identical.
     'workflow.agent_hint_routing': true,
+    // #4401: Compact Content mode gate — derived from the defaults manifest via
+    // CONFIG_DEFAULTS (added in config-loader.cts) so the manifest stays the
+    // single source of truth, matching workflow.smart_zone_tokens /
+    // planning.pr_strict / workflow.inline_plan_threshold below.
+    'workflow.compact_content': CONFIG_DEFAULTS.compact_content,
     // Derived from the defaults manifest rather than restated, so the manifest
     // stays the single source of truth for the smart-zone budget (#2630).
     'workflow.smart_zone_tokens': CONFIG_DEFAULTS.smart_zone_tokens,
@@ -93,6 +107,27 @@ const SCHEMA_DEFAULTS = {
     // effective default existed only as the workflow's shell fallback and the
     // docs disagreed (settings-advanced said 3). Manifest stays the one owner.
     'workflow.inline_plan_threshold': CONFIG_DEFAULTS.inline_plan_threshold,
+    // #4285 review: an absent threshold resolved to "Key not found" while the
+    // hook silently used 35/25 — the query surface disagreeing with the reader.
+    //
+    // Restated here rather than derived: `CONFIG_DEFAULTS` is re-exported with a
+    // FLATTENED shape that drops the manifest's nested blocks, so
+    // `CONFIG_DEFAULTS.hooks` is undefined at runtime and the manifest cannot
+    // feed these two rows the way `workflow.smart_zone_tokens` above is fed.
+    //
+    // Not added to `buildNewProjectConfig` either, and that one is deliberate
+    // rather than incidental: it writes a `hooks` object into every NEW project's
+    // config.json, which would freeze today's fire-points as an explicit
+    // per-project override everywhere — the opposite of this PR's premise that an
+    // absent key tracks the shipped default. (The manifest alone would NOT have
+    // that effect; `buildNewProjectConfig` builds its own literal. Correcting an
+    // earlier version of this comment that ran the two together.)
+    //
+    // That leaves ONE copy of 35/25 outside the hook — these two rows — and
+    // `tests/config.test.cjs` pins them against the hook's exported
+    // WARNING_THRESHOLD/CRITICAL_THRESHOLD so the copies cannot drift.
+    'hooks.context_warning_threshold': 35,
+    'hooks.context_critical_threshold': 25,
 };
 /**
  * Resolve a schema-level default for an absent key (#2256). Checks the legacy
@@ -126,12 +161,15 @@ function resolveSchemaDefault(cwd, kp) {
  * Centralizing emission here means masking can't be missed at a call site.
  */
 function emitResolvedDefault(kp, value, raw) {
+    const resolvedValue = kp === 'planner.stall_detection_enabled'
+        ? resolvePlannerStallDetectionEnabled(value)
+        : value;
     if ((0, secrets_cjs_1.isSecretKey)(kp)) {
-        const masked = (0, secrets_cjs_1.maskSecret)(value);
+        const masked = (0, secrets_cjs_1.maskSecret)(resolvedValue);
         output(masked, raw, masked);
         return;
     }
-    output(value, raw, String(value));
+    output(resolvedValue, raw, String(resolvedValue));
 }
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
@@ -308,6 +346,7 @@ function buildNewProjectConfig(userChoices) {
             human_verify_mode: 'end-of-phase',
             context_guard_mode: 'warn',
             text_mode: false,
+            compact_content: false,
             research_before_questions: false,
             discuss_mode: 'discuss',
             skip_discuss: false,
@@ -515,7 +554,7 @@ function _setNestedValue(config, keyPath, parsedValue) {
 }
 /**
  * Deletes a value from the config object, allowing nested values via dot
- * notation (e.g., "review.models.gemini"). Mirrors `_setNestedValue`'s
+ * notation (e.g., "review.models.codex"). Mirrors `_setNestedValue`'s
  * prototype-pollution guard on every path segment (including intermediates).
  *
  * Unlike `_setNestedValue`, this NEVER creates missing intermediate objects —
@@ -564,19 +603,35 @@ function _unsetNestedValue(config, keyPath) {
  * Does not call `output()`, so can be used as one step in a command without triggering `exit(0)` in
  * the happy path. But note that `error()` will still `exit(1)` out of the process.
  */
+/**
+ * Loads `.planning/config.json` as a plain object, or `{}` if the file does
+ * not exist. A parse failure calls `error()` (process-exiting) rather than
+ * throwing, matching every caller's existing behavior.
+ *
+ * Single source for this load+parse step — `setConfigValue`,
+ * `unsetConfigValue`, `setConfigValues`, `previewConfigValue`, and
+ * `previewUnsetConfigValue` all delegate here instead of each repeating the
+ * same try/catch (CLAUDE.md's "Generative Fix Divergence" known-defect
+ * pattern: independently-guessed copies of the same logic can silently
+ * drift apart).
+ */
+function loadConfigJson(cwd) {
+    const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
+    let config = {};
+    try {
+        if (node_fs_1.default.existsSync(configPath)) {
+            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        }
+    }
+    catch (err) {
+        error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
+    }
+    return config;
+}
 function unsetConfigValue(cwd, keyPath) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const { previousValue, existed } = _unsetNestedValue(config, keyPath);
         // Write back
         try {
@@ -598,16 +653,7 @@ function unsetConfigValue(cwd, keyPath) {
 function setConfigValue(cwd, keyPath, parsedValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const previousValue = _setNestedValue(config, keyPath, parsedValue);
         // Write back
         try {
@@ -619,6 +665,29 @@ function setConfigValue(cwd, keyPath, parsedValue) {
         }
     });
 }
+/**
+ * #4444: read-only preview counterpart to `setConfigValue` — loads config
+ * exactly like the real setter and reuses `_setNestedValue` (the SAME
+ * traversal/creation logic, including its prototype-pollution guards) on a
+ * throwaway in-memory copy that is NEVER written back to disk. This is what
+ * makes the dry-run preview provably identical to what the real write would
+ * compute, rather than a second, hand-maintained traversal that could drift
+ * from the real one.
+ */
+function previewConfigValue(cwd, keyPath, parsedValue) {
+    const config = loadConfigJson(cwd);
+    const previousValue = _setNestedValue(config, keyPath, parsedValue);
+    return { key: keyPath, value: parsedValue, previousValue };
+}
+/**
+ * #4444: read-only preview counterpart to `unsetConfigValue` — same pattern
+ * as `previewConfigValue`, reusing `_unsetNestedValue` on a throwaway copy.
+ */
+function previewUnsetConfigValue(cwd, keyPath) {
+    const config = loadConfigJson(cwd);
+    const { previousValue, existed } = _unsetNestedValue(config, keyPath);
+    return { key: keyPath, value: null, previousValue, existed };
+}
 /**
  * Batched sibling of setConfigValue: apply multiple key-path writes in a
  * single load → set-all → write cycle inside ONE withPlanningLock call.
@@ -635,16 +704,7 @@ function setConfigValues(cwd, entries) {
     }
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const results = [];
         for (const entry of entries) {
             const previousValue = _setNestedValue(config, entry.keyPath, entry.value);
@@ -676,14 +736,8 @@ function assertEnumValue(parsedValue, rawVal, allowed, label) {
         error(`Invalid ${label} '${rawVal}'. Valid values: ${allowed.join(', ')}`);
     }
 }
-/**
- * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
- * "workflow.research").
- *
- * Note that this exits the process (via `output()`) even in the happy path; use `setConfigValue()`
- * directly if you need to avoid this.
- */
-function cmdConfigSet(cwd, keyPath, value, raw) {
+function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
+    const dryRun = options.dryRun === true;
     if (!keyPath) {
         error('Usage: config-set <key.path> <value>', ERROR_REASON.USAGE);
     }
@@ -733,6 +787,18 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // present, truthy-adjacent value that consumers must special-case — worst for
     // secret keys where a leftover value can be passed as a real credential.
     if (parsedValue === null) {
+        if (dryRun) {
+            const preview = previewUnsetConfigValue(cwd, kp);
+            if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+                const maskedPrev = preview.previousValue === undefined
+                    ? undefined
+                    : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+                output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: maskedPrev, masked: true }, raw, `${kp} unset (dry run)`);
+                return;
+            }
+            output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: preview.previousValue }, raw, `${kp} unset (dry run)`);
+            return;
+        }
         const unsetResult = unsetConfigValue(cwd, kp);
         if ((0, secrets_cjs_1.isSecretKey)(kp)) {
             const maskedPrev = unsetResult.previousValue === undefined
@@ -752,6 +818,9 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
     if (kp === 'context')
         assertEnumValue(parsedValue, val, VALID_CONTEXT_VALUES, 'context value');
+    if (kp === 'phase_id_convention') {
+        assertEnumValue(parsedValue, val, VALID_PHASE_ID_CONVENTIONS, 'phase_id_convention');
+    }
     // Codebase drift detector (#2003)
     const VALID_DRIFT_ACTIONS = ['warn', 'auto-remap'];
     if (kp === 'workflow.drift_action')
@@ -787,12 +856,25 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Compact Content mode gate (#4139)
+    if (kp === 'workflow.compact_content') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid workflow.compact_content '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // Per-plan executor routing via agent_hint frontmatter (#1689)
     if (kp === 'workflow.agent_hint_routing') {
         if (typeof parsedValue !== 'boolean') {
             error(`Invalid workflow.agent_hint_routing '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Planner watchdog opt-out (#4570) — only a real boolean may change the
+    // default-on policy. In particular, string "false" must not disable it.
+    if (kp === 'planner.stall_detection_enabled') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid planner.stall_detection_enabled '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // #3086 — git.create_tag: boolean only
     if (kp === 'git.create_tag') {
         if (typeof parsedValue !== 'boolean') {
@@ -835,6 +917,48 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid statusline.show_git '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Context-monitor fire-points (#4285) — a percentage of the context window
+    // REMAINING, so the domain is 0-100 and the hook compares them against
+    // `remaining_percentage`. Rejecting an out-of-domain value here keeps accept
+    // and honour in agreement ON THE DOMAIN: the hook falls back to its default
+    // for a value outside it, so reporting success would be a lie. That agreement
+    // is per-key and no wider — a value accepted here can still be superseded at
+    // read time by the hook's pair check, and a scoped write (GSD_PROJECT /
+    // GSD_WORKSTREAM) lands in a config the hook does not read at all. The PAIR
+    // (critical < warning) is deliberately NOT enforced here: config-set writes
+    // one key per call, so a two-step retune can be transiently inconsistent on
+    // disk and a check here would reject that intermediate write.
+    if (kp === 'hooks.context_warning_threshold' || kp === 'hooks.context_critical_threshold') {
+        if (typeof parsedValue !== 'number' || !Number.isFinite(parsedValue) || parsedValue < 0 || parsedValue > 100) {
+            error(`Invalid ${kp} '${val}'. Must be a number between 0 and 100 (percent of context window remaining).`);
+        }
+        // The two ENDPOINTS that are in range but can never form a valid pair are
+        // refused here rather than stored (#4285 review). `critical < warning` must
+        // hold at read time and BOTH sides are clamped to 0-100, so `warning: 0`
+        // has no legal partner (nothing is below 0) and `critical: 100` has none
+        // either (nothing above 100). Either one is silently discarded by the hook
+        // for EVERY value of the other key — verified: both resolve to the 35/25
+        // defaults against a present, absent, or extreme partner, while 0.001 and
+        // 99.999 are honoured.
+        //
+        // Storing a value the reader can never honour is exactly the
+        // accept-then-discard shape this codebase refuses elsewhere, so this fails
+        // at write time where the operator can see it. The pair itself is still NOT
+        // checked here — config-set writes one key per call, so a two-step retune
+        // is legitimately inconsistent on disk in between.
+        if (kp === 'hooks.context_warning_threshold' && parsedValue === 0) {
+            error(`Invalid ${kp} '${val}'. 0 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `critical value is below 0, so a warning of 0 would always fall back to the 35/25 `
+                + `defaults. Use a value above 0.`);
+        }
+        if (kp === 'hooks.context_critical_threshold' && parsedValue === 100) {
+            error(`Invalid ${kp} '${val}'. 100 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `warning value is above 100, so a critical of 100 would always fall back to the `
+                + `35/25 defaults. Use a value below 100.`);
+        }
+    }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
     if (kp === 'code_quality.fallow.scope')
@@ -921,6 +1045,19 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             }
         }
     }
+    if (dryRun) {
+        const preview = previewConfigValue(cwd, kp, parsedValue);
+        if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+            const masked = (0, secrets_cjs_1.maskSecret)(parsedValue);
+            const maskedPrev = preview.previousValue === undefined
+                ? undefined
+                : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+            output({ dry_run: true, would_update: true, key: kp, value: masked, previousValue: maskedPrev, masked: true }, raw, `${kp}=${masked} (dry run)`);
+            return;
+        }
+        output({ dry_run: true, would_update: true, key: kp, value: parsedValue, previousValue: preview.previousValue }, raw, `${kp}=${String(parsedValue)} (dry run)`);
+        return;
+    }
     const setConfigValueResult = setConfigValue(cwd, kp, parsedValue);
     // Mask secrets in both JSON and text output. The plaintext is written
     // to config.json (that's where secrets live on disk); the CLI output
@@ -1046,6 +1183,9 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         }
         error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
     }
+    if (kp === 'planner.stall_detection_enabled') {
+        current = resolvePlannerStallDetectionEnabled(current);
+    }
     // Never echo plaintext for sensitive keys via config-get. Plaintext lives
     // in config.json on disk; the CLI surface always shows the masked form.
     if ((0, secrets_cjs_1.isSecretKey)(kp)) {
@@ -1075,7 +1215,7 @@ function resolveFromRootConfig(cwd, kp) {
     // diverges from planningRoot without a workstream and loadConfigResolved does NOT
     // inherit root — matching the runtime's own `if (ws)` gate keeps the two surfaces
     // from diverging on the project-scoped (non-workstream) case.
-    if (!process.env['GSD_WORKSTREAM'])
+    if (!resolveEnvWorkstream())
         return { found: false, value: undefined };
     const root = planningRoot(cwd);
     const rootConfigPath = node_path_1.default.join(root, 'config.json');
@@ -1182,7 +1322,7 @@ function cmdConfigPath(cwd, _raw, workstreamContext = null) {
  * (caller uses `await` which is safe on a sync return value).
  */
 function cmdMigrateConfig(cwd, raw) {
-    const ws = process.env['GSD_WORKSTREAM'] || null;
+    const ws = resolveEnvWorkstream();
     // #3749: resolve the migration target through the project-aware resolver so
     // GSD_PROJECT scopes the write; migrateOnDisk itself cannot (see its
     // configPathOverride note).
@@ -1230,6 +1370,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    VALID_PHASE_ID_CONVENTIONS,
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,

package/gsd-core/bin/lib/coverage.cjs

@@ -435,7 +435,7 @@ function cmdClassify(cwd, options = {}, raw) {
     }
     let resolvedPath;
     try {
-        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', { allowAbsolute: true });
+        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
     }
     catch (e) {
         // Emit a structured command error instead of leaking a raw stack trace.