@opengsd/gsd-core 1.20.0 → 1.21.0

package/gsd-core/bin/lib/config.cjs

@@ -172,22 +172,66 @@ function resolveSchemaDefault(cwd, kp) {
     return { found: false, value: undefined };
 }
 /**
- * Emit a schema-resolved default (#2256), applying the same secret-masking
- * invariant the found-key path applies. getCapabilityConfigSchema is a
- * federated, third-party-extensible surface (ADR-1244) — a future key-name
- * collision with a secret key must not leak a declared default in plaintext.
- * Centralizing emission here means masking can't be missed at a call site.
+ * A decimal number literal as a person types it: optional sign, digits with an optional
+ * fraction (`5`, `5.`, `.5`, `5.0`, `007`), optional exponent. No surrounding whitespace and
+ * no `0x`/`0b`/`0o` prefix, so `' '`, `' 5'` and `'0x10'` stay strings (#6029, owner ruling
+ * 2026-11-08). `Number()` alone accepted all three.
  */
-function emitResolvedDefault(kp, value, raw) {
-    const resolvedValue = kp === 'planner.stall_detection_enabled'
+const DECIMAL_LITERAL = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+/**
+ * #6029 (ADR-1411 Decision 3): the single argv value parser at the config CLI
+ * boundary, shared by `config-set` and `config-get --default`. Type-directed
+ * only: per-key setter policy (project_code verbatim, validators) and the
+ * setter's `null` = unset action (#2046) stay in cmdConfigSet. The numeric
+ * branch is the DECIMAL_LITERAL rule above (the one deliberate change from the
+ * pre-#6029 setter parser).
+ */
+function parseConfigArgValue(val) {
+    if (val === 'true')
+        return true;
+    if (val === 'false')
+        return false;
+    if (val === 'null')
+        return null;
+    // #1581: Number.isFinite (not !isNaN) so 'Infinity' and an overflowing literal such as
+    // '1e400' are NOT coerced to non-finite numbers that JSON.stringify later renders as
+    // `null` (disk=null while the CLI echoed 'Infinity'). They stay strings, and in
+    // config-set the per-key validators then reject them with a non-zero exit.
+    if (DECIMAL_LITERAL.test(val) && Number.isFinite(Number(val)))
+        return Number(val);
+    if (val.startsWith('[') || val.startsWith('{')) {
+        try {
+            return JSON.parse(val);
+        }
+        catch { /* keep as string */ }
+    }
+    return val;
+}
+/**
+ * #6029 (ADR-1411 Decisions 3-4): the single emission projection for every
+ * `cmdConfigGet` arm. Order: the #4570 planner-watchdog resolver, then secret
+ * masking (the encoder never sees plaintext; getCapabilityConfigSchema is a
+ * federated, third-party-extensible surface (ADR-1244), so centralizing the
+ * masking here means it cannot be missed at a call site), then encoding.
+ * `json` is what JSON mode emits; `text` is what `--raw` emits. Raw is frozen:
+ * it is `sourceText` (the verbatim argv of `--default`) when the value reached
+ * here untransformed, else `String(value)`.
+ */
+function encodeConfigValue(kp, value, sourceText) {
+    const resolved = kp === 'planner.stall_detection_enabled'
         ? resolvePlannerStallDetectionEnabled(value)
         : value;
     if ((0, secrets_cjs_1.isSecretKey)(kp)) {
-        const masked = (0, secrets_cjs_1.maskSecret)(resolvedValue);
-        output(masked, raw, masked);
-        return;
+        const masked = (0, secrets_cjs_1.maskSecret)(resolved);
+        return { json: masked, text: masked };
     }
-    output(resolvedValue, raw, String(resolvedValue));
+    const transformed = resolved !== value;
+    const text = sourceText !== undefined && !transformed ? sourceText : String(resolved);
+    return { json: resolved, text };
+}
+function emitConfigValue(kp, value, raw, sourceText) {
+    const { json, text } = encodeConfigValue(kp, value, sourceText);
+    output(json, raw, text);
 }
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
@@ -812,8 +856,10 @@ function loadConfigJson(cwd) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     let config = {};
     try {
-        if (node_fs_1.default.existsSync(configPath)) {
-            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        // Bounded read (#5759): null is an absent file; a FIFO/device/oversized file throws.
+        const raw = configLoader.readConfigFileBounded(configPath);
+        if (raw !== null) {
+            config = JSON.parse(raw);
         }
     }
     catch (err) {
@@ -949,27 +995,8 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
     const kp = keyPath;
     const val = value;
     assertKnownConfigKey(cwd, kp);
-    // Parse value (handle booleans, numbers, and JSON arrays/objects)
-    let parsedValue = val;
-    if (val === 'true')
-        parsedValue = true;
-    else if (val === 'false')
-        parsedValue = false;
-    else if (val === 'null')
-        parsedValue = null;
-    // #1581: Number.isFinite (not !isNaN) so 'Infinity'/'-Infinity' are NOT
-    // coerced to non-finite numbers that JSON.stringify later renders as `null`
-    // (disk=null while the CLI echoed 'Infinity'). They fall through to the
-    // JSON branch (which rejects them) and stay strings, then per-key validators
-    // reject them with a non-zero exit.
-    else if (Number.isFinite(Number(val)) && val !== '')
-        parsedValue = Number(val);
-    else if (typeof val === 'string' && (val.startsWith('[') || val.startsWith('{'))) {
-        try {
-            parsedValue = JSON.parse(val);
-        }
-        catch { /* keep as string */ }
-    }
+    // Parse value (handle booleans, numbers, and JSON arrays/objects) — #6029: shared with config-get --default.
+    let parsedValue = parseConfigArgValue(val);
     // #2046: a bare `null` unsets (deletes) the key — the documented "Clear" action.
     // Short-circuits before every typed per-key validator so clearing a typed key
     // (enum/boolean/number) removes it rather than being rejected. Deleting (not
@@ -1040,6 +1067,33 @@ function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
     }
     output(setConfigValueResult, raw, `${kp}=${String(parsedValue)}`);
 }
+/**
+ * #4432: one `hooks.secret_read_exempt` entry as a POSIX repo-relative file
+ * path, or null when it is not one. The secret-read guard
+ * (hooks/lib/secret-read-exemptions.js `normalizeExemptEntry`) applies the SAME
+ * rules when it reads the list, and is standalone because an installed hook
+ * cannot require `src/`. The duplication is deliberate and pinned: a parity test
+ * (tests/secret-read-exemptions.test.cjs) drives one corpus and a seeded
+ * property through both, so a value accepted here is a value the hook honors.
+ */
+function normalizeSecretReadExemptEntry(entry) {
+    if (typeof entry !== 'string')
+        return null;
+    let s = entry.replace(/\\/g, '/');
+    while (s.startsWith('./'))
+        s = s.slice(2);
+    if (s === '' || s === '.')
+        return null;
+    if (s.startsWith('/') || s.endsWith('/'))
+        return null;
+    if (/^[A-Za-z]:/.test(s))
+        return null;
+    if (s.includes('\0'))
+        return null;
+    if (s.split('/').includes('..'))
+        return null;
+    return s;
+}
 /**
  * The per-key VALUE rules, shared by `config-set` and `config-new-project`
  * (#5268). They were inline in `cmdConfigSet`, so `config-new-project` had no
@@ -1220,6 +1274,15 @@ function validateConfigValue(cwd, kp, parsedValue, val) {
                 + `35/25 defaults. Use a value below 100.`);
         }
     }
+    // #4432: files the secret-read guard may let agents read. Every entry must be
+    // a repo-relative file path; the guard drops anything else when it reads the
+    // list, so storing it would be accept-then-discard.
+    if (kp === 'hooks.secret_read_exempt') {
+        if (!Array.isArray(parsedValue) || parsedValue.some((entry) => normalizeSecretReadExemptEntry(entry) === null)) {
+            error(`Invalid hooks.secret_read_exempt '${val}'. Must be an array of repo-relative file paths `
+                + `(no leading '/', drive prefix, '..' segment or trailing '/'), e.g. [".env.production"].`);
+        }
+    }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
     if (kp === 'code_quality.fallow.scope')
@@ -1310,38 +1373,44 @@ function validateConfigValue(cwd, kp, parsedValue, val) {
 }
 function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
-    const hasDefault = defaultValue !== undefined;
     if (!keyPath) {
         error('Usage: config-get <key.path> [--default <value>]');
     }
     // After the error() guard, keyPath is narrowed to string.
     const kp = keyPath;
+    /**
+     * #2702 / #1893 / #2256: an absent key resolves root config first (a present root key wins
+     * over --default), then --default (parsed by the config-set parser, raw bytes kept), then the
+     * schema default. With none of them, fail with the caller's reason.
+     */
+    const emitAbsentKey = (message, reason) => {
+        const rootVal = resolveFromRootConfig(cwd, kp);
+        if (rootVal.found) {
+            emitConfigValue(kp, rootVal.value, raw);
+            return;
+        }
+        if (defaultValue !== undefined) {
+            emitConfigValue(kp, parseConfigArgValue(defaultValue), raw, defaultValue);
+            return;
+        }
+        const sd = resolveSchemaDefault(cwd, kp);
+        if (sd.found) {
+            emitConfigValue(kp, sd.value, raw);
+            return;
+        }
+        error(message, reason);
+    };
     let config = {};
     try {
-        if (node_fs_1.default.existsSync(configPath)) {
-            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        // Bounded read (#5759): null is an absent file; a FIFO/device/oversized file throws and
+        // is reported as an unreadable config below, never waited on.
+        const rawConfig = configLoader.readConfigFileBounded(configPath);
+        if (rawConfig !== null) {
+            config = JSON.parse(rawConfig);
         }
         else {
-            // #2702: when a workstream is active and has no config.json of its own, fall
-            // back to the project ROOT config first — a key the user configured at root is
-            // a real, present value and must inherit (per #1893: a present key wins over
-            // --default). Only when root also misses do --default / schema default apply.
-            // (When no workstream is active, resolveFromRootConfig is a no-op: same file.)
-            const rootVal = resolveFromRootConfig(cwd, kp);
-            if (rootVal.found) {
-                emitResolvedDefault(kp, rootVal.value, raw);
-                return;
-            }
-            if (hasDefault) {
-                emitResolvedDefault(kp, defaultValue, raw);
-                return;
-            }
-            const sd = resolveSchemaDefault(cwd, kp);
-            if (sd.found) {
-                emitResolvedDefault(kp, sd.value, raw);
-                return;
-            }
-            error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            emitAbsentKey('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            return;
         }
     }
     catch (err) {
@@ -1364,22 +1433,8 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // #2702: root-config inheritance before --default / schema default (see above).
-            const rootVal = resolveFromRootConfig(cwd, kp);
-            if (rootVal.found) {
-                emitResolvedDefault(kp, rootVal.value, raw);
-                return;
-            }
-            if (hasDefault) {
-                emitResolvedDefault(kp, defaultValue, raw);
-                return;
-            }
-            const sd = resolveSchemaDefault(cwd, kp);
-            if (sd.found) {
-                emitResolvedDefault(kp, sd.value, raw);
-                return;
-            }
-            error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            emitAbsentKey(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            return;
         }
         // Own-property gate: bracket access on a plain object walks the
         // prototype chain, so an unqualified `current[key]` would resolve
@@ -1395,34 +1450,12 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
             : undefined;
     }
     if (current === undefined) {
-        // #2702: root-config inheritance before --default / schema default (see above).
-        const rootVal = resolveFromRootConfig(cwd, kp);
-        if (rootVal.found) {
-            emitResolvedDefault(kp, rootVal.value, raw);
-            return;
-        }
-        if (hasDefault) {
-            emitResolvedDefault(kp, defaultValue, raw);
-            return;
-        }
-        const sd = resolveSchemaDefault(cwd, kp);
-        if (sd.found) {
-            emitResolvedDefault(kp, sd.value, raw);
-            return;
-        }
-        error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
-    }
-    if (kp === 'planner.stall_detection_enabled') {
-        current = resolvePlannerStallDetectionEnabled(current);
-    }
-    // Never echo plaintext for sensitive keys via config-get. Plaintext lives
-    // in config.json on disk; the CLI surface always shows the masked form.
-    if ((0, secrets_cjs_1.isSecretKey)(kp)) {
-        const masked = (0, secrets_cjs_1.maskSecret)(current);
-        output(masked, raw, masked);
+        emitAbsentKey(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
         return;
     }
-    output(current, raw, String(current));
+    // #6029: the present-key arm uses the same projection as every other arm
+    // (planner resolver and secret masking included).
+    emitConfigValue(kp, current, raw);
 }
 /**
  * #2702: resolve a dot-notation key against the project ROOT config
@@ -1450,9 +1483,11 @@ function resolveFromRootConfig(cwd, kp) {
     const rootConfigPath = node_path_1.default.join(root, 'config.json');
     let rootConfig;
     try {
-        if (!node_fs_1.default.existsSync(rootConfigPath))
+        // Bounded read (#5759): null is an absent root config; a FIFO/device/oversized one throws.
+        const rawRoot = configLoader.readConfigFileBounded(rootConfigPath);
+        if (rawRoot === null)
             return { found: false, value: undefined };
-        rootConfig = JSON.parse(node_fs_1.default.readFileSync(rootConfigPath, 'utf-8'));
+        rootConfig = JSON.parse(rawRoot);
     }
     catch {
         // Unparseable root config → don't inherit (do not let a corrupt root file
@@ -1603,6 +1638,8 @@ module.exports = {
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,
+    parseConfigArgValue,
+    encodeConfigValue,
     cmdConfigSetModelProfile,
     cmdConfigNewProject,
     cmdConfigPath,
@@ -1611,4 +1648,5 @@ module.exports = {
     setConfigValue,
     setConfigValues,
     isValidProtectedBranches,
+    normalizeSecretReadExemptEntry,
 };

package/gsd-core/bin/lib/configuration.cjs

@@ -240,6 +240,45 @@ function mergeDefaults(parsed) {
     const defaults = structuredClone(CONFIG_DEFAULTS);
     return deepMergeConfig(defaults, parsed);
 }
+/**
+ * Largest config.json migrateOnDisk will read — the same 1 MiB bound as CONFIG_MAX_BYTES in
+ * config-file-read.cts (#5759). Inlined, not imported: this module may not import a sibling
+ * (the #3571 contract above). A test pins that the two bounds agree.
+ */
+const CONFIG_READ_MAX_BYTES = 1024 * 1024;
+/**
+ * Read a config.json as a bounded regular file (#5759): non-blocking open, fstat on the
+ * descriptor, regular files up to CONFIG_READ_MAX_BYTES only. A FIFO/device would otherwise
+ * block open(2) forever. Throws on anything unreadable (ENOENT included); migrateOnDisk
+ * treats every throw as "nothing to migrate".
+ */
+function readConfigBounded(filePath) {
+    const fd = (0, node_fs_1.openSync)(filePath, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NONBLOCK ?? 0) | (node_fs_1.constants.O_NOCTTY ?? 0));
+    try {
+        const st = (0, node_fs_1.fstatSync)(fd);
+        if (!st.isFile()) {
+            throw Object.assign(new Error(`${filePath} is not a regular file`), { code: st.isDirectory() ? 'EISDIR' : 'ENXIO' });
+        }
+        if (st.size > CONFIG_READ_MAX_BYTES) {
+            throw Object.assign(new Error(`${filePath} exceeds ${CONFIG_READ_MAX_BYTES} bytes`), { code: 'EFBIG' });
+        }
+        const buf = Buffer.allocUnsafe(st.size);
+        let off = 0;
+        while (off < st.size) {
+            const n = (0, node_fs_1.readSync)(fd, buf, off, st.size - off, off);
+            if (n <= 0)
+                break;
+            off += n;
+        }
+        return buf.toString('utf-8', 0, off);
+    }
+    finally {
+        try {
+            (0, node_fs_1.closeSync)(fd);
+        }
+        catch { /* best-effort */ }
+    }
+}
 function migrateOnDisk(cwd, workstream, configPathOverride) {
     // #3749: the caller (cmdMigrateConfig in config.cts) supplies the config
     // path resolved through planning-workspace's PROJECT-aware planningDir.
@@ -250,10 +289,10 @@ function migrateOnDisk(cwd, workstream, configPathOverride) {
     const configPath = configPathOverride ?? (0, node_path_1.join)(planningDir(cwd, workstream), 'config.json');
     let raw;
     try {
-        raw = (0, node_fs_1.readFileSync)(configPath, 'utf-8');
+        raw = readConfigBounded(configPath);
     }
     catch {
-        // File missing — nothing to migrate
+        // File missing, unreadable, non-regular or oversized — nothing to migrate
         return { migrated: false, normalizations: [], wrote: null, skipped: [] };
     }
     const trimmed = raw.trim();