@opengsd/gsd-core 1.7.0 → 1.9.0

package/gsd-core/bin/lib/config-loader.cjs

@@ -18,7 +18,7 @@
  *   - ./planning-workspace.cjs (planningDir, planningRoot)
  *   - ./shell-command-projection.cjs (execGit, platformWriteSync, platformReadSync)
  *   - ./core-utils.cjs       (detectSubRepos)
- *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS)
+ *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS, ADAPTIVE_TIER_VALUES)
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -120,6 +120,7 @@ const CONFIG_DEFAULTS = {
     security_asvs_level: _getNestedConfigDefault('workflow', 'security_asvs_level'),
     security_block_on: _getNestedConfigDefault('workflow', 'security_block_on'),
     post_planning_gaps: _getNestedConfigDefault('workflow', 'post_planning_gaps'),
+    smart_zone_tokens: _getNestedConfigDefault('workflow', 'smart_zone_tokens'),
 };
 /**
  * Deep-merge two plain config objects. `overlay` wins on key conflict.
@@ -172,7 +173,11 @@ function isGitIgnored(cwd, targetPath) {
     return ignored;
 }
 // ─── Model alias resolution ───────────────────────────────────────────────────
-const RUNTIME_OVERRIDE_TIERS = new Set(['opus', 'sonnet', 'haiku']);
+// Catalog-derived (model-catalog.cts) so this vocabulary can never drift from
+// VALID_TIERS in verify.cts — see #2070 "Generative Fix Divergence". Excludes
+// 'inherit' (unlike VALID_TIERS): runtime overrides always resolve to a
+// concrete tier, never the adaptive sentinel.
+const RUNTIME_OVERRIDE_TIERS = model_catalog_cjs_1.ADAPTIVE_TIER_VALUES;
 const _warnedConfigKeys = new Set();
 function _warnUnknownProfileOverrides(parsed, configLabel) {
     if (!parsed || typeof parsed !== 'object')
@@ -276,8 +281,15 @@ function _warnUnknownProfileOverrides(parsed, configLabel) {
 }
 // Internal helper exposed for tests so per-process warning state can be reset
 // between cases that intentionally exercise the warning path repeatedly.
+// Clears BOTH dedup sets: _warnedConfigKeys (runtime/model-policy/tier warnings)
+// and _warnedUnknownConfigKeys (unknown top-level keys). Omitting the latter made
+// this a silent no-op for the suite that exists to test it — the leaked state
+// suppressed any later case reusing a key, and the existing cases only passed
+// because each picked a key name no other case reused (#2674).
 function _resetRuntimeWarningCacheForTests() {
     _warnedConfigKeys.clear();
+    _warnedUnknownConfigKeys.clear();
+    _warnedUnusableConfig.clear();
 }
 // ─── FIX 2: Federated overlay helpers ────────────────────────────────────────
 /**
@@ -380,6 +392,102 @@ function _applyFederatedOverlay(baseConfig, userConfig, cwd) {
     _applyFederatedValues(cloned, _fedOverlay.values, _fedOverlay.validKeys);
     return cloned;
 }
+/**
+ * Result of loadConfigResolved — wraps the config object with provenance metadata.
+ * - source: which layer supplied the config
+ * - degraded: true when the resolution did not deliver the configuration it
+ *             should have — either a workstream was requested but its
+ *             config.json was absent (fell back to root), or a file on the
+ *             resolution path exists but is unusable (#1880). `reason` says which.
+ */
+/**
+ * Machine-readable outcome of a config resolution (#1880, ADR-1411 amendment
+ * "corrupt is not absent"). `Resolution<T>`'s four documented values all
+ * describe a resolution *miss*; the two `config_un*` values below are the
+ * unusable-input class that amendment introduced, and they are what makes a
+ * corrupt file distinguishable from an absent one.
+ *
+ * Frozen enum rather than bare strings so tests assert on the typed surface
+ * instead of diagnostic prose (CONTRIBUTING.md — Prohibited: Raw Text Matching
+ * on Test Outputs).
+ */
+const CONFIG_REASON = Object.freeze({
+    /** A config file was found, parsed, and supplied at least one setting. */
+    RESOLVED: 'resolved',
+    /** No config file exists at the resolved path. Genuine absence — NOT degraded. */
+    NOT_CONFIGURED: 'not_configured',
+    /** A config file exists and parsed, but carried no settings (`{}`). */
+    CONFIGURED_EMPTY: 'configured_empty',
+    /** A workstream was requested but had no config; fell back to root. */
+    WORKSTREAM_FALLBACK: 'workstream_fallback',
+    /** The file exists but is not valid JSON — settings were NOT applied. */
+    CONFIG_UNPARSEABLE: 'config_unparseable',
+    /** The file exists but could not be read (EACCES/EIO/…) — NOT applied. */
+    CONFIG_UNREADABLE: 'config_unreadable',
+});
+/**
+ * Read + JSON-parse a config file, keeping *absent* distinguishable from
+ * *unusable*. `platformReadSync` returns null on ENOENT and re-throws every
+ * other errno, which is the seam that makes this separable at all.
+ */
+function _readConfigFile(filePath) {
+    let raw;
+    try {
+        raw = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
+    }
+    catch (err) {
+        const code = err.code ?? 'EUNKNOWN';
+        return { kind: 'fault', fault: { reason: CONFIG_REASON.CONFIG_UNREADABLE, path: filePath, code } };
+    }
+    if (raw === null)
+        return { kind: 'absent' };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { kind: 'fault', fault: { reason: CONFIG_REASON.CONFIG_UNPARSEABLE, path: filePath, code: '' } };
+    }
+    // Shape, not just parseability (ADR-227). `0`, `"x"`, `[]` and `null` are all
+    // valid JSON but are not a config object. Accepting them let a PRESENT file
+    // parse "ok", then throw downstream, and be reported not_configured by the
+    // outer catch — a corrupt file indistinguishable from an absent one, which is
+    // the exact defect this change closes. Caught by the fast-check property.
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { kind: 'fault', fault: { reason: CONFIG_REASON.CONFIG_UNPARSEABLE, path: filePath, code: '' } };
+    }
+    return { kind: 'ok', data: parsed };
+}
+/**
+ * Dedup set for the unusable-config diagnostic. Keyed on resolved path + errno
+ * per the ADR-1411 amendment — never on message text, which would couple the
+ * guard to wording, and never on the errno alone, which would suppress a
+ * genuine second failure in a different file.
+ */
+const _warnedUnusableConfig = new Set();
+/**
+ * The wiring clause (ADR-1411 amendment). `reason` lives on `ConfigResolution`,
+ * but `loadConfig` — the wrapper roughly fifty call sites use — returns
+ * `.config` alone and would never surface it. Without this diagnostic the field
+ * is unreachable to almost every consumer, and the user whose config was
+ * silently discarded still gets no signal. That was the whole defect in #1880.
+ */
+function _warnUnusableConfig(fault) {
+    // The NUL separators are load-bearing: without them `path`+`reason`+`code` is bare
+    // concatenation and two distinct faults can key alike. They are written as escapes rather
+    // than literal 0x00 bytes because a literal NUL makes the whole file binary to file(1) and
+    // grep(1), which silently skipped it — RULESET.AUDIT.search-source-not-generated tells
+    // agents to search this exact source to confirm an invariant exists, and it was returning
+    // nothing. Same runtime string, still greppable.
+    const key = `${fault.path}\u0000${fault.reason}\u0000${fault.code}`;
+    if (_warnedUnusableConfig.has(key))
+        return;
+    _warnedUnusableConfig.add(key);
+    const what = fault.reason === CONFIG_REASON.CONFIG_UNPARSEABLE
+        ? 'is not valid JSON'
+        : `could not be read (${fault.code})`;
+    process.stderr.write(`gsd-tools: warning: ${fault.path} ${what} — its settings were NOT applied; using defaults instead\n`);
+}
 /**
  * loadConfigResolved — provenance-aware config loading (#1415, ADR-1411 P2).
  *
@@ -387,13 +495,21 @@ function _applyFederatedOverlay(baseConfig, userConfig, cwd) {
  * { config, source, degraded } instead of just the config object.
  * loadConfig now delegates to this function (byte-identical back-compat).
  *
- * Branch → source/degraded mapping:
- *   A1: ws set + ws config.json found → source:'workstream', degraded:false
- *   A2: ws null + config.json found   → source:'root',       degraded:false
- *   B:  catch + .planning/ + rootParsed set (ws fallback) → source:'root', degraded:true
- *   C:  catch + .planning/ + rootParsed null (federated defaults) → source:'builtin-defaults', degraded:false
- *   D:  catch + no .planning/ + ~/.gsd/defaults.json readable → source:'global-defaults', degraded:false
- *   E:  catch + no .planning/ + no global → source:'builtin-defaults', degraded:false
+ * Branch → source/degraded/reason mapping:
+ *   A1: ws set + ws config.json found → source:'workstream', degraded:false, reason:'resolved'|'configured_empty'
+ *   A2: ws null + config.json found   → source:'root',       degraded:false, reason:'resolved'|'configured_empty'
+ *   B:  catch + .planning/ + rootParsed set (ws fallback) → source:'root', degraded:true, reason:'workstream_fallback'
+ *   C:  catch + .planning/ + rootParsed null (federated defaults) → source:'builtin-defaults', degraded:false, reason:'not_configured'
+ *   D:  catch + no .planning/ + ~/.gsd/defaults.json readable → source:'global-defaults', degraded:false, reason:'not_configured'
+ *   E:  catch + no .planning/ + no global → source:'builtin-defaults', degraded:false, reason:'not_configured'
+ *
+ * ORTHOGONAL to all of the above (#1880, ADR-1411 "corrupt is not absent"): if
+ * any config file on the resolution path exists but is UNUSABLE — invalid JSON,
+ * or an errno such as EACCES — every branch instead returns degraded:true with
+ * reason:'config_unparseable'|'config_unreadable', and a deduplicated stderr
+ * diagnostic names the file. Before this, a trailing comma in config.json was
+ * byte-identical to the file not existing: builtin defaults, degraded:false,
+ * and the user's entire configuration silently discarded.
  */
 function loadConfigResolved(cwd, options = {}) {
     // NOTE: loadConfigResolved resolves from cwd AS-IS (no walk-up).
@@ -415,14 +531,39 @@ function loadConfigResolved(cwd, options = {}) {
             cachedSubRepos = detectSubRepos(cwd);
         return cachedSubRepos.slice();
     };
+    // Faults are captured, not thrown: the existing control flow (one broad catch
+    // that falls back to defaults) is preserved exactly — see #1880. All that is
+    // added is knowing WHY the fallback fired, which is the whole defect.
+    let configFault = null;
+    /**
+     * Stamp a fallback return with its reason. Every branch below reaches defaults
+     * (or the root config) — what differs is WHY, and before #1880 that was
+     * unrecoverable: a corrupt file and an absent one produced identical objects.
+     *
+     * An unusable file always wins and always sets `degraded:true`; genuine
+     * absence keeps whatever `degraded` the branch already decided, so the
+     * existing #1366 workstream-fallback semantics are untouched.
+     */
+    const fallback = (r) => {
+        if (configFault)
+            return { ...r, degraded: true, reason: configFault.reason };
+        return {
+            ...r,
+            reason: r.degraded ? CONFIG_REASON.WORKSTREAM_FALLBACK : CONFIG_REASON.NOT_CONFIGURED,
+        };
+    };
     let rootParsed = null;
     if (ws) {
         const rootConfigPath = node_path_1.default.join(planningRoot(cwd), 'config.json');
         try {
-            const raw = (0, shell_command_projection_cjs_1.platformReadSync)(rootConfigPath);
-            if (raw === null)
-                throw new Error('missing');
-            rootParsed = JSON.parse(raw);
+            const rootRead = _readConfigFile(rootConfigPath);
+            if (rootRead.kind === 'fault') {
+                configFault = rootRead.fault;
+                _warnUnusableConfig(rootRead.fault);
+            }
+            if (rootRead.kind !== 'ok')
+                throw new Error('root config absent or unusable');
+            rootParsed = rootRead.data;
             const { parsed: rootNormalized, normalizations: rootNorms } = (0, configuration_cjs_1.normalizeLegacyKeys)(rootParsed);
             if (rootNorms.length > 0) {
                 for (const norm of rootNorms) {
@@ -453,10 +594,18 @@ function loadConfigResolved(cwd, options = {}) {
     const configPath = node_path_1.default.join(planningDir(cwd, ws), 'config.json');
     const defaults = CONFIG_DEFAULTS;
     try {
-        const raw = (0, shell_command_projection_cjs_1.platformReadSync)(configPath);
-        if (raw === null)
-            throw new Error('missing');
-        const fileData = JSON.parse(raw);
+        const read = _readConfigFile(configPath);
+        if (read.kind === 'fault') {
+            // The workstream/root config that ACTUALLY governs this resolution is
+            // unusable. This outranks any earlier root-config fault for reporting.
+            configFault = read.fault;
+            _warnUnusableConfig(read.fault);
+        }
+        if (read.kind !== 'ok')
+            throw new Error('config absent or unusable');
+        const fileData = read.data;
+        // Snapshot BEFORE normalizeLegacyKeys mutates fileData in place.
+        const fileHadKeys = Object.keys(read.data).length > 0;
         let configDirty = false;
         {
             const { parsed: normalized, normalizations } = (0, configuration_cjs_1.normalizeLegacyKeys)(fileData);
@@ -627,7 +776,24 @@ function loadConfigResolved(cwd, options = {}) {
         // A1 vs A2: disambiguate by whether a real workstream was requested.
         // Fix 4: empty-string ws ('') resolves the root path → source:'root'.
         const source = wsRequested ? 'workstream' : 'root';
-        return { config: _baseConfig, source, degraded: false };
+        // This config parsed — but a DIFFERENT file on the resolution path may not
+        // have. A workstream config that loads cleanly while the root config it
+        // inherits from is corrupt is still a degraded resolution: the root's
+        // settings were silently dropped. Reporting `resolved` here would reopen
+        // the exact hole this change closes, for the common case of a project that
+        // uses workstreams at all.
+        if (configFault) {
+            return { config: _baseConfig, source, degraded: true, reason: configFault.reason };
+        }
+        // Emptiness is judged on the FILE THAT WAS READ, not on `parsed` (the
+        // root+workstream merge). An empty workstream file inheriting a non-empty
+        // root would otherwise report `resolved` while carrying no settings of its
+        // own — the opposite of the not-configured/configured-empty distinction
+        // ADR-1411 rule 3 requires.
+        const reason = fileHadKeys
+            ? CONFIG_REASON.RESOLVED
+            : CONFIG_REASON.CONFIGURED_EMPTY;
+        return { config: _baseConfig, source, degraded: false, reason };
     }
     catch {
         // Fix 2: Early intercept — workstream requested but ws config.json absent (or dir absent)
@@ -635,7 +801,7 @@ function loadConfigResolved(cwd, options = {}) {
         // This delivers the #1366 acceptance criterion: nonexistent GSD_WORKSTREAM yields root, degraded.
         if (wsRequested && rootParsed) {
             const fb = loadConfigResolved(cwd, { workstream: null });
-            return { config: fb.config, source: 'root', degraded: true };
+            return fallback({ config: fb.config, source: 'root', degraded: true });
         }
         // Branch B, C, D, E
         if (node_fs_1.default.existsSync(planningDir(cwd, ws))) {
@@ -643,24 +809,32 @@ function loadConfigResolved(cwd, options = {}) {
                 // Branch B: workstream requested but ws config.json absent; root config present.
                 // (Only reached when wsRequested is false — e.g. ws='' with .planning/workstreams//config.json)
                 const fb = loadConfigResolved(cwd, { workstream: null });
-                return { config: fb.config, source: 'root', degraded: true };
+                return fallback({ config: fb.config, source: 'root', degraded: true });
             }
             // Branch C: .planning/ exists but no config.json and no root config — federated/builtin defaults
             try {
-                return { config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false };
+                return fallback({ config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false });
             }
             catch {
-                return { config: defaults, source: 'builtin-defaults', degraded: false };
+                return fallback({ config: defaults, source: 'builtin-defaults', degraded: false });
             }
         }
         // Branch D or E: no .planning/
         try {
             const home = process.env['GSD_HOME'] || node_os_1.default.homedir();
             const globalDefaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
-            const raw = (0, shell_command_projection_cjs_1.platformReadSync)(globalDefaultsPath);
-            if (raw === null)
-                throw new Error('missing');
-            const globalDefaults = JSON.parse(raw);
+            const globalRead = _readConfigFile(globalDefaultsPath);
+            if (globalRead.kind === 'fault') {
+                // ~/.gsd/defaults.json is present but unusable. Only report it when the
+                // project config did not already fail — the nearer file is the one the
+                // user is most likely to be able to act on.
+                if (!configFault)
+                    configFault = globalRead.fault;
+                _warnUnusableConfig(globalRead.fault);
+            }
+            if (globalRead.kind !== 'ok')
+                throw new Error('global defaults absent or unusable');
+            const globalDefaults = globalRead.data;
             const _globalBaseCfg = {
                 ...defaults,
                 model_profile: (globalDefaults['model_profile']) ?? defaults.model_profile,
@@ -687,22 +861,30 @@ function loadConfigResolved(cwd, options = {}) {
                 fast_mode: (globalDefaults['fast_mode']) || null,
                 agent_skills: (globalDefaults['agent_skills']) || {},
                 response_language: (globalDefaults['response_language']) || null,
+                // #2069: forward model_policy / model_profile_overrides / runtime so the global-defaults
+                // path is at parity with the project-config path (which forwards these three from
+                // parsed['…'] at the top of this function). Without these entries, ~/.gsd/defaults.json
+                // silently drops them — model_policy/provider/budget etc. are honored when set in a
+                // project but ignored when set globally.
+                runtime: (globalDefaults['runtime']) || null,
+                model_profile_overrides: (globalDefaults['model_profile_overrides']) || null,
+                model_policy: (globalDefaults['model_policy']) || null,
             };
             // Branch D: global-defaults
             try {
-                return { config: _applyFederatedOverlay(_globalBaseCfg, globalDefaults, cwd), source: 'global-defaults', degraded: false };
+                return fallback({ config: _applyFederatedOverlay(_globalBaseCfg, globalDefaults, cwd), source: 'global-defaults', degraded: false });
             }
             catch {
-                return { config: _globalBaseCfg, source: 'global-defaults', degraded: false };
+                return fallback({ config: _globalBaseCfg, source: 'global-defaults', degraded: false });
             }
         }
         catch {
             // Branch E: no global defaults
             try {
-                return { config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false };
+                return fallback({ config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false });
             }
             catch {
-                return { config: defaults, source: 'builtin-defaults', degraded: false };
+                return fallback({ config: defaults, source: 'builtin-defaults', degraded: false });
             }
         }
     }
@@ -717,6 +899,8 @@ function loadConfig(cwd, options = {}) {
 module.exports = {
     loadConfig,
     loadConfigResolved,
+    CONFIG_REASON,
+    _warnedUnusableConfig,
     isGitIgnored,
     CONFIG_DEFAULTS,
     _getConfigDefault,

package/gsd-core/bin/lib/config.cjs

@@ -21,7 +21,7 @@ const { CONFIG_DEFAULTS } = configLoader;
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningDir, withPlanningLock } = planningWorkspace;
+const { planningDir, planningRoot, withPlanningLock } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
@@ -66,7 +66,49 @@ const SCHEMA_DEFAULTS = {
     'executor.stall_detect_interval_minutes': 5,
     'executor.stall_threshold_minutes': 10,
     'git.create_tag': true,
+    // Derived from the defaults manifest rather than restated, so the manifest
+    // stays the single source of truth for the smart-zone budget (#2630).
+    'workflow.smart_zone_tokens': CONFIG_DEFAULTS.smart_zone_tokens,
 };
+/**
+ * Resolve a schema-level default for an absent key (#2256). Checks the legacy
+ * hardcoded SCHEMA_DEFAULTS first, then the capability-registry configSchema
+ * default — the same registry default the runtime's capability-activation
+ * resolver (resolveConfigKey Level 4, capability-activation.cts) already honors,
+ * so `query config-get` can no longer disagree with the runtime about an absent
+ * key's effective value.
+ */
+function resolveSchemaDefault(cwd, kp) {
+    if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
+        return { found: true, value: SCHEMA_DEFAULTS[kp] };
+    }
+    const capSchema = getCapabilityConfigSchema(cwd);
+    if (capSchema && typeof capSchema === 'object'
+        && Object.prototype.hasOwnProperty.call(capSchema, kp)) {
+        const entry = capSchema[kp];
+        if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+            const def = entry['default'];
+            if (def !== undefined)
+                return { found: true, value: def };
+        }
+    }
+    return { found: false, value: undefined };
+}
+/**
+ * Emit a schema-resolved default (#2256), applying the same secret-masking
+ * invariant the found-key path applies. getCapabilityConfigSchema is a
+ * federated, third-party-extensible surface (ADR-1244) — a future key-name
+ * collision with a secret key must not leak a declared default in plaintext.
+ * Centralizing emission here means masking can't be missed at a call site.
+ */
+function emitResolvedDefault(kp, value, raw) {
+    if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+        const masked = (0, secrets_cjs_1.maskSecret)(value);
+        output(masked, raw, masked);
+        return;
+    }
+    output(value, raw, String(value));
+}
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
     const suggested = CONFIG_KEY_SUGGESTIONS[keyPath];
@@ -665,6 +707,18 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid context_window '${val}'. Must be a positive integer (token count).`, ERROR_REASON.USAGE);
         }
     }
+    // Smart-zone token budget (#2630, ADR-2629). Same shape as context_window:
+    // a positive integer token count. A POLICY default, not a benchmark constant.
+    // Number.isSafeInteger, NOT Number.isInteger: the read side
+    // (estimate-cli readSmartZoneBudget) accepts only safe integers, so an
+    // isInteger-only gate would let config-set 'succeed' on a value past 2^53
+    // that estimate-check then silently ignores in favour of the default.
+    // Accept and honour must agree.
+    if (kp === 'workflow.smart_zone_tokens') {
+        if (typeof parsedValue !== 'number' || !Number.isSafeInteger(parsedValue) || parsedValue < 1) {
+            error(`Invalid workflow.smart_zone_tokens '${val}'. Must be a positive integer (token count).`, ERROR_REASON.USAGE);
+        }
+    }
     // Post-planning gap checker (#2493)
     if (kp === 'workflow.post_planning_gaps') {
         if (typeof parsedValue !== 'boolean') {
@@ -698,6 +752,10 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid statusline.show_context_tokens '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Statusline GSD-state format enum validation
+    const VALID_STATE_FORMATS = ['full', 'compact'];
+    if (kp === 'statusline.state_format')
+        assertEnumValue(parsedValue, val, VALID_STATE_FORMATS, 'statusline.state_format');
     // statusline.show_git — boolean only
     if (kp === 'statusline.show_git') {
         if (typeof parsedValue !== 'boolean') {
@@ -824,17 +882,26 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         if (node_fs_1.default.existsSync(configPath)) {
             config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
         }
-        else if (hasDefault) {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
-            output(defaultValue, raw, String(defaultValue));
-            return;
-        }
-        else if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
-            return;
-        }
         else {
+            // #2702: when a workstream is active and has no config.json of its own, fall
+            // back to the project ROOT config first — a key the user configured at root is
+            // a real, present value and must inherit (per #1893: a present key wins over
+            // --default). Only when root also misses do --default / schema default apply.
+            // (When no workstream is active, resolveFromRootConfig is a no-op: same file.)
+            const rootVal = resolveFromRootConfig(cwd, kp);
+            if (rootVal.found) {
+                emitResolvedDefault(kp, rootVal.value, raw);
+                return;
+            }
+            if (hasDefault) {
+                emitResolvedDefault(kp, defaultValue, raw);
+                return;
+            }
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
+                return;
+            }
             error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
         }
     }
@@ -848,29 +915,50 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
+            // #2702: root-config inheritance before --default / schema default (see above).
+            const rootVal = resolveFromRootConfig(cwd, kp);
+            if (rootVal.found) {
+                emitResolvedDefault(kp, rootVal.value, raw);
+                return;
+            }
             if (hasDefault) {
-                output(defaultValue, raw, String(defaultValue));
+                emitResolvedDefault(kp, defaultValue, raw);
                 return;
             }
-            if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-                const def = SCHEMA_DEFAULTS[kp];
-                output(def, raw, String(def));
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
                 return;
             }
             error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
         }
-        current = current[key];
+        // Own-property gate: bracket access on a plain object walks the
+        // prototype chain, so an unqualified `current[key]` would resolve
+        // '__proto__' / 'constructor' / 'hasOwnProperty' (and other
+        // Object.prototype members) to their inherited values instead of
+        // correctly reporting them as absent. hasOwnProperty.call only
+        // returns true for a key JSON.parse actually assigned as data on
+        // this object (including a literal "__proto__" JSON key, which
+        // JSON.parse defines as an own data property, not the accessor) —
+        // never for something inherited from the prototype chain.
+        current = Object.prototype.hasOwnProperty.call(current, key)
+            ? current[key]
+            : undefined;
     }
     if (current === undefined) {
-        // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        // #2702: root-config inheritance before --default / schema default (see above).
+        const rootVal = resolveFromRootConfig(cwd, kp);
+        if (rootVal.found) {
+            emitResolvedDefault(kp, rootVal.value, raw);
+            return;
+        }
         if (hasDefault) {
-            output(defaultValue, raw, String(defaultValue));
+            emitResolvedDefault(kp, defaultValue, raw);
             return;
         }
-        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
+        const sd = resolveSchemaDefault(cwd, kp);
+        if (sd.found) {
+            emitResolvedDefault(kp, sd.value, raw);
             return;
         }
         error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
@@ -884,6 +972,54 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     }
     output(current, raw, String(current));
 }
+/**
+ * #2702: resolve a dot-notation key against the project ROOT config
+ * (`.planning/config.json`), ignoring any active workstream scope. Returns
+ * `{found:false}` when the root config is absent, unparseable, or does not
+ * contain the key. This is the inheritance rung `cmdConfigGet` was missing —
+ * when a workstream's own config doesn't set a key, the project root value
+ * must show through (workstream overrides root; it never fully replaces it),
+ * exactly as `loadConfigResolved`'s root+workstream merge already does for
+ * every other config consumer. No-op (found:false) when no workstream is
+ * active, because `planningDir === planningRoot` and the caller already read
+ * that file directly.
+ */
+function resolveFromRootConfig(cwd, kp) {
+    // Only meaningful when a workstream is active (GSD_WORKSTREAM set) — that is what
+    // redirects planningDir away from root AND what loadConfigResolved gates root-reading
+    // on. Gating on `process.env.GSD_WORKSTREAM` (not on a planningDir !== planningRoot
+    // path inequality) avoids a false trigger under GSD_PROJECT alone, where planningDir
+    // diverges from planningRoot without a workstream and loadConfigResolved does NOT
+    // inherit root — matching the runtime's own `if (ws)` gate keeps the two surfaces
+    // from diverging on the project-scoped (non-workstream) case.
+    if (!process.env['GSD_WORKSTREAM'])
+        return { found: false, value: undefined };
+    const root = planningRoot(cwd);
+    const rootConfigPath = node_path_1.default.join(root, 'config.json');
+    let rootConfig;
+    try {
+        if (!node_fs_1.default.existsSync(rootConfigPath))
+            return { found: false, value: undefined };
+        rootConfig = JSON.parse(node_fs_1.default.readFileSync(rootConfigPath, 'utf-8'));
+    }
+    catch {
+        // Unparseable root config → don't inherit (do not let a corrupt root file
+        // change config-get's verdict). Fall through to schema default / error.
+        return { found: false, value: undefined };
+    }
+    let current = rootConfig;
+    for (const key of kp.split('.')) {
+        if (current === undefined || current === null || typeof current !== 'object') {
+            return { found: false, value: undefined };
+        }
+        current = Object.prototype.hasOwnProperty.call(current, key)
+            ? current[key]
+            : undefined;
+    }
+    if (current === undefined)
+        return { found: false, value: undefined };
+    return { found: true, value: current };
+}
 /**
  * Command to set the model profile in the config file.
  *

package/gsd-core/bin/lib/core-utils.cjs

@@ -186,8 +186,13 @@ function extractCanonicalPlanId(filename) {
     // or a single-digit-plus-letter id ("3A"); a *bare* single digit is a slug word,
     // so "46-6-rs-…" is not paired into a "46-6" id while "3A-01" stays intact.
     const tokenRe = /^(?:\d{2,}[A-Z]?|\d[A-Z])(?:\.\d+)*$/i;
+    // #2232: the PAIRED plan component is a zero-padded continuation segment
+    // (exactly 2 digits), so a ≥3-digit slug word (a year) is not paired into a
+    // bogus "14-2026" id. The leading phase component keeps tokenRe's unbounded
+    // \d{2,} — phase numbers ≥100 are legitimate; only continuations are capped.
+    const planTokenRe = new RegExp(`^(?:${phaseIdModule.PHASE_CONTINUATION_SEGMENT_SOURCE}[A-Z]?|\\d[A-Z])(?:\\.\\d+)*$`, 'i');
     const phaseIdx = parts.findIndex(p => tokenRe.test(p));
-    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && tokenRe.test(parts[phaseIdx + 1])) {
+    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && planTokenRe.test(parts[phaseIdx + 1])) {
         return `${parts[phaseIdx]}-${parts[phaseIdx + 1]}`;
     }
     return base;