@pareto4/pp-core 1.11.0 → 1.12.0

package/pp-core/bin/lib/compose-bindings.cjs

@@ -46,7 +46,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMPOSE_BINDINGS_FLAGS = exports.SEED_VALUE_MAX_LENGTH = void 0;
+exports._resetPlatformTagMemoForTests = _resetPlatformTagMemoForTests;
+exports.resolveCreatedWithFrom = resolveCreatedWithFrom;
 exports.composeBindings = composeBindings;
+exports.redactComposeResultForEmission = redactComposeResultForEmission;
 exports.cmdComposeBindings = cmdComposeBindings;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -336,6 +339,22 @@ function readSeed(cwd, opts) {
     return { values, profile, warnings };
 }
 // ─── resolveLatestPlatformTag (D-04) ─────────────────────────────────────────
+/**
+ * Per-process memo for the D-04 tag lookup, keyed by the resolved URL, holding
+ * the full `{ tag, warnings }` verdict — successes AND failures. One real
+ * `pp-tools init` run calls `composeBindings` twice (the dry-run preview in
+ * `computeCurrentStep`, then the write-mode call after `compose_confirm`), so
+ * without this memo a decline costs a network round-trip for nothing and a
+ * failed lookup would print its bounded warning twice.
+ */
+const platformTagMemo = new Map();
+/** Test-only seam: clear the per-process platform.tag lookup memo so a test
+ * suite that shares a resolved URL across cases sees an empty memo each time
+ * (`init-tag-lookup-raw-git-error`). Mirrors the reset-seam convention at
+ * `src/active-workstream-store.cts`'s controlling-TTY probe cache. */
+function _resetPlatformTagMemoForTests() {
+    platformTagMemo.clear();
+}
 /**
  * Resolve the latest STABLE tag for `repo` over the resolved host, never
  * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array via
@@ -344,6 +363,13 @@ function readSeed(cwd, opts) {
  * else `defaultHostForProvider(provider)` — the host is authoritative and
  * never derived from the repo string (Phase 31 D-09).
  *
+ * The child's stderr is piped into the parent's buffer rather than inherited
+ * — an explicit `stdio: ['ignore', 'pipe', 'pipe']` — and deliberately
+ * discarded rather than logged: the bounded warning this function returns on
+ * failure is the single user-visible surface for a lookup failure. Inheriting
+ * the child's stream let a raw git `fatal:` line reach the terminal during an
+ * otherwise successful first-run experience (`init-tag-lookup-raw-git-error`).
+ *
  * Every candidate ref is filtered with `isStableTripletSemver` and ordered
  * with `compareSemverCore` — the single blessed comparison source, never
  * reimplemented. An empty result degrades to `{ tag: null, warnings: [] }`
@@ -353,13 +379,34 @@ function readSeed(cwd, opts) {
  * platform being unpinned, never a compose failure.
  */
 function resolveLatestPlatformTag(cwd, repo, provider, opts) {
+    let url;
     try {
         const hostRes = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd);
         const host = hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
-        const url = `https://${host}/${repo}`;
+        url = `https://${host}/${repo}`;
+    }
+    catch {
+        return {
+            tag: null,
+            warnings: [
+                bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
+            ],
+        };
+    }
+    const cached = platformTagMemo.get(url);
+    if (cached)
+        return cached;
+    let result;
+    try {
         const lsOutput = typeof opts._lsRemote === 'function'
             ? opts._lsRemote(url)
-            : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', url, 'v*'], { encoding: 'utf-8', timeout: 10_000, maxBuffer: 512 * 1024, windowsHide: true });
+            : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', url, 'v*'], {
+                encoding: 'utf-8',
+                timeout: 10_000,
+                maxBuffer: 512 * 1024,
+                windowsHide: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
         const tags = lsOutput
             .split('\n')
             .map((line) => {
@@ -368,31 +415,57 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
         })
             .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
         if (tags.length === 0) {
-            return { tag: null, warnings: [] };
+            result = { tag: null, warnings: [] };
         }
-        let latest = tags[0];
-        for (const t of tags) {
-            if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
-                latest = t;
+        else {
+            let latest = tags[0];
+            for (const t of tags) {
+                if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
+                    latest = t;
+            }
+            result = { tag: latest, warnings: [] };
         }
-        return { tag: latest, warnings: [] };
     }
     catch {
-        return {
+        result = {
             tag: null,
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
         };
     }
+    platformTagMemo.set(url, result);
+    return result;
 }
 /**
- * Read the first readable, semver-shaped `VERSION` file among the installed
- * `pp-core/VERSION` location and this repo's own root `VERSION`, returning
- * `<binName>@<version>`; when neither is readable, `binName` alone.
+ * Read the first readable, semver-shaped `VERSION` file among the candidate
+ * locations resolved against `baseDir`, returning `<binName>@<version>`.
+ *
+ * The candidate list is `baseDir`-relative rather than `__dirname`-relative so
+ * the layout under test is CHOSEN by the caller instead of inherited from
+ * wherever the compiled module happens to sit — an installed tree and this
+ * repo's own tree put `VERSION` in different places, and a test that cannot
+ * pick a layout cannot tell those two cases apart.
+ *
+ * Three locations are probed, in order: the `VERSION` sitting beside the bin
+ * directory; then the installed `pp-core/VERSION` that the installer writes
+ * into a project's runtime home; then this repo's own root `VERSION`. The
+ * installed location is consulted BEFORE the repo root so an installed tree
+ * reports the version it was actually installed from. In this repo that middle
+ * candidate is absent, so resolution falls through to the root file.
+ *
+ * @param baseDir - directory the candidates are resolved against. Production
+ *   passes this module's own `__dirname`; a test passes a fixture directory
+ *   shaped like `pp-core/bin/lib`.
+ * @returns `<binName>@<version>` for the first readable, semver-shaped
+ *   candidate; when no candidate is readable, `binName` alone.
  */
-function resolveCreatedWith() {
-    const candidates = [node_path_1.default.join(__dirname, '..', 'VERSION'), node_path_1.default.join(__dirname, '..', '..', '..', 'VERSION')];
+function resolveCreatedWithFrom(baseDir) {
+    const candidates = [
+        node_path_1.default.join(baseDir, '..', 'VERSION'),
+        node_path_1.default.join(baseDir, '..', '..', 'VERSION'),
+        node_path_1.default.join(baseDir, '..', '..', '..', 'VERSION'),
+    ];
     for (const candidate of candidates) {
         try {
             const raw = node_fs_1.default.readFileSync(candidate, 'utf-8').trim();
@@ -406,6 +479,13 @@ function resolveCreatedWith() {
     }
     return package_identity_cjs_1.binName;
 }
+/**
+ * Resolve `project.createdWith` for the running installation by probing the
+ * candidate layout against this module's own directory.
+ */
+function resolveCreatedWith() {
+    return resolveCreatedWithFrom(__dirname);
+}
 /**
  * Build the composed candidate object from the seed, the project answers
  * `/pp-init` already captured, the resolved platform host, the D-04 tag pin,
@@ -723,6 +803,39 @@ function composeBindings(cwd, opts = {}) {
  * does, then calls `composeBindings` and emits the result as data — a
  * verdict is never a process error.
  */
+/**
+ * Pack 6 D-07: the display-safe copy of a compose result, for EMISSION only.
+ * Every remote coordinate field (`platform.repo`, `client.vaultRepo`) in
+ * `composed`, `seed`, `provenance` and `drift` goes through the one owner
+ * (`redactCloneTarget`, src/vault.cts); warnings go through the prose
+ * redactor. `composeBindings` itself, its drift/action comparison and every
+ * write keep the RAW values — never write or compare the result of this.
+ */
+function redactComposeResultForEmission(result) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const v = require('./vault.cjs');
+    const COORD = new Set(['platform.repo', 'client.vaultRepo']);
+    const safe = (x) => (typeof x === 'string' ? v.redactCloneTarget(x) : x);
+    const out = JSON.parse(JSON.stringify(result));
+    if (out.composed && typeof out.composed === 'object') {
+        for (const field of COORD) {
+            const [ns, key] = field.split('.');
+            const parent = out.composed[ns];
+            if (parent && typeof parent === 'object' && typeof parent[key] === 'string')
+                parent[key] = safe(parent[key]);
+        }
+    }
+    if (out.seed) {
+        if (typeof out.seed.platformRepo === 'string')
+            out.seed.platformRepo = safe(out.seed.platformRepo);
+        if (typeof out.seed.clientVaultRepo === 'string')
+            out.seed.clientVaultRepo = safe(out.seed.clientVaultRepo);
+    }
+    out.provenance = (out.provenance ?? []).map((p) => (COORD.has(p.field) ? { ...p, value: safe(p.value) } : p));
+    out.drift = (out.drift ?? []).map((d) => COORD.has(d.key) ? { ...d, profileValue: safe(d.profileValue), effectiveValue: safe(d.effectiveValue) } : d);
+    out.warnings = (out.warnings ?? []).map((w) => (typeof w === 'string' ? v.redactRemoteText(w) : w));
+    return out;
+}
 function cmdComposeBindings(cwd, options, raw) {
     let root;
     try {
@@ -732,5 +845,5 @@ function cmdComposeBindings(cwd, options, raw) {
         root = cwd;
     }
     const result = composeBindings(root, { write: options.write === true, offline: options.offline === true });
-    output(result, raw);
+    output(redactComposeResultForEmission(result), raw);
 }

package/pp-core/bin/lib/config-schema.cjs

@@ -26,6 +26,21 @@ function isCapabilityConfigKey(keyPath) {
         return false;
     return Object.prototype.hasOwnProperty.call(schema, keyPath);
 }
+/**
+ * The declared `values` of a capability `type: "enum"` config key, or `null`
+ * when the key is not a capability key, is not an enum, or carries no value
+ * list. 13-05 / D-07: this is the ONE lookup of enum values —
+ * `config-set` asks it rather than restating any list, so the registry stays
+ * the single source of what an enum key may hold.
+ */
+function capabilityEnumValues(keyPath) {
+    if (!isCapabilityConfigKey(keyPath))
+        return null;
+    const entry = capabilityRegistry.configSchema[keyPath];
+    if (!entry || typeof entry !== 'object')
+        return null;
+    return entry.type === 'enum' && Array.isArray(entry.values) ? entry.values : null;
+}
 /**
  * Returns true for keys owned by the central schema adapter rather than a
  * federated Capability config slice.
@@ -53,6 +68,7 @@ module.exports = {
     RUNTIME_STATE_KEYS: configuration_cjs_1.RUNTIME_STATE_KEYS,
     DYNAMIC_KEY_PATTERNS: configuration_cjs_1.DYNAMIC_KEY_PATTERNS,
     isCapabilityConfigKey,
+    capabilityEnumValues,
     isCentralConfigKey,
     isValidConfigKey,
 };

package/pp-core/bin/lib/config.cjs

@@ -27,10 +27,11 @@ const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configSchema = require("./config-schema.cjs");
-const { VALID_CONFIG_KEYS, isValidConfigKey } = configSchema;
+const { VALID_CONFIG_KEYS, isValidConfigKey, capabilityEnumValues } = configSchema;
 const secrets_cjs_1 = require("./secrets.cjs");
 const review_reviewer_selection_cjs_1 = require("./review-reviewer-selection.cjs");
 const configuration_cjs_1 = require("./configuration.cjs");
+const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CONFIG_KEY_SUGGESTIONS = {
     'workflow.nyquist_validation_enabled': 'workflow.nyquist_validation',
@@ -464,6 +465,53 @@ function setConfigValues(cwd, entries) {
         }
     });
 }
+/**
+ * The ONE membership test every enum guard in `cmdConfigSet` asks (13-REVIEW
+ * CR-01). The raw value is parsed before the guards — `true`/`false`/numbers
+ * coerced, and a value starting with `[` or `{` JSON-parsed — and
+ * `String(['dev']) === 'dev'`, so a membership test on `String(parsedValue)`
+ * let a one-element array through and wrote it. Every value list here is
+ * strings, so only a plain string can be a member.
+ */
+function isStringMember(list, value) {
+    return typeof value === 'string' && list.includes(value);
+}
+/**
+ * Config keys `pp-tools config-set` accepts ONLY a real JSON boolean for
+ * (07-14 / REV-CR-01).
+ *
+ * The parse above coerces exactly the two lowercase words `true` and `false`;
+ * every other spelling an operator plausibly types becomes a truthy string
+ * (`"FALSE"`, `"no"`, `"off"`) or a number. `capability-activation`'s
+ * `_resolveActivationValue` ends in `Boolean(r.value)`, so those strings read as
+ * ON — an operator typing `config-set vault.enabled FALSE` to switch the vault
+ * off instead ARMED every step `capabilities/vault` hangs on that key, against
+ * the constraint that a `vault.enabled=false` project stays completely inert.
+ *
+ * The list, not ten copies of the same `if`: the first seven are capability
+ * activation keys read through that `Boolean()` (the vault switches plus every
+ * key that gates a blocking hook in the shipped registry). The last three were already guarded individually and are folded in here
+ * unchanged, message included, so there is one mechanism in this file rather
+ * than two.
+ *
+ * REFUSE, do not normalise: `FALSE` plainly means false, but `1`, `enabled` and
+ * `on` are guesses, and a config-set that silently rewrites the operator's word
+ * is the same class of silent-wrong-answer this phase exists to end. A typed
+ * usage error names the two accepted values.
+ */
+const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
+    'vault.enabled',
+    'vault.required',
+    'vault.practices_enabled',
+    'workflow.schema_drift_gate',
+    'workflow.nyquist_validation',
+    'workflow.security_enforcement',
+    'workflow.ui_safety_gate',
+    'pareto.enabled',
+    'git.create_tag',
+    'workflow.post_planning_gaps',
+    'plan_review.source_grounding',
+]);
 /**
  * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
  * "workflow.research").
@@ -508,12 +556,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         catch { /* keep as string */ }
     }
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
-    if (kp === 'context' && !VALID_CONTEXT_VALUES.includes(String(parsedValue))) {
+    if (kp === 'context' && !isStringMember(VALID_CONTEXT_VALUES, parsedValue)) {
         error(`Invalid context value '${val}'. Valid values: ${VALID_CONTEXT_VALUES.join(', ')}`);
     }
     // Codebase drift detector (#2003)
     const VALID_DRIFT_ACTIONS = ['warn', 'auto-remap'];
-    if (kp === 'workflow.drift_action' && !VALID_DRIFT_ACTIONS.includes(String(parsedValue))) {
+    if (kp === 'workflow.drift_action' && !isStringMember(VALID_DRIFT_ACTIONS, parsedValue)) {
         error(`Invalid workflow.drift_action '${val}'. Valid values: ${VALID_DRIFT_ACTIONS.join(', ')}`);
     }
     if (kp === 'workflow.drift_threshold') {
@@ -521,51 +569,62 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.drift_threshold '${val}'. Must be a positive integer.`);
         }
     }
-    // Post-planning gap checker (#2493)
-    if (kp === 'workflow.post_planning_gaps') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
-        }
-    }
-    // #3086 — git.create_tag: boolean only
-    if (kp === 'git.create_tag') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid git.create_tag '${val}'. Must be a boolean (true or false).`);
-        }
+    // Boolean-only keys, in ONE place (07-14 / REV-CR-01; absorbs the individual
+    // guards #2493 workflow.post_planning_gaps, #3086 git.create_tag and #22
+    // plan_review.source_grounding, whose message this reproduces verbatim).
+    if (BOOLEAN_ONLY_CONFIG_KEYS.includes(kp) && typeof parsedValue !== 'boolean') {
+        error(`Invalid ${kp} '${val}'. Must be a boolean (true or false).`, ERROR_REASON.USAGE);
     }
     if (kp === 'ship.pr_body_sections') {
         validateShipPrBodySections(parsedValue);
     }
+    // Phase ceremony tier (pack 9) — enum, src/phase-tier.cts owns the list
+    if (kp === 'phase.tier' && !isStringMember(phase_tier_cjs_1.PHASE_TIERS, parsedValue)) {
+        error(`Invalid phase.tier '${val}'. Valid values: ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     // Human verification checkpoint mode (#3309)
     const VALID_HUMAN_VERIFY_MODES = ['mid-flight', 'end-of-phase'];
-    if (kp === 'workflow.human_verify_mode' && !VALID_HUMAN_VERIFY_MODES.includes(String(parsedValue))) {
+    if (kp === 'workflow.human_verify_mode' && !isStringMember(VALID_HUMAN_VERIFY_MODES, parsedValue)) {
         error(`Invalid workflow.human_verify_mode '${val}'. Valid values: ${VALID_HUMAN_VERIFY_MODES.join(', ')}`);
     }
     // Context position enum validation (#2937)
     const VALID_CONTEXT_POSITIONS = ['front', 'end'];
-    if (kp === 'statusline.context_position' && !VALID_CONTEXT_POSITIONS.includes(String(parsedValue))) {
+    if (kp === 'statusline.context_position' && !isStringMember(VALID_CONTEXT_POSITIONS, parsedValue)) {
         error(`Invalid statusline.context_position '${val}'. Valid values: ${VALID_CONTEXT_POSITIONS.join(', ')}`);
     }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
-    if (kp === 'code_quality.fallow.scope' && !VALID_FALLOW_SCOPES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.scope' && !isStringMember(VALID_FALLOW_SCOPES, parsedValue)) {
         error(`Invalid code_quality.fallow.scope '${val}'. Valid values: ${VALID_FALLOW_SCOPES.join(', ')}`);
     }
     const VALID_FALLOW_PROFILES = ['minimal', 'standard', 'strict'];
-    if (kp === 'code_quality.fallow.profile' && !VALID_FALLOW_PROFILES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.profile' && !isStringMember(VALID_FALLOW_PROFILES, parsedValue)) {
         error(`Invalid code_quality.fallow.profile '${val}'. Valid values: ${VALID_FALLOW_PROFILES.join(', ')}`);
     }
-    // plan_review.source_grounding (#22) — boolean only
-    if (kp === 'plan_review.source_grounding') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid plan_review.source_grounding '${val}'. Must be a boolean (true or false).`);
-        }
-    }
     // plan_review.source_grounding_authority (#22) — enum
     const VALID_SOURCE_GROUNDING_AUTHORITIES = ['grep', 'intel', 'treesitter', 'lsp', 'scip'];
-    if (kp === 'plan_review.source_grounding_authority' && !VALID_SOURCE_GROUNDING_AUTHORITIES.includes(String(parsedValue))) {
+    if (kp === 'plan_review.source_grounding_authority' && !isStringMember(VALID_SOURCE_GROUNDING_AUTHORITIES, parsedValue)) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
+    // Capability enum keys, in ONE place (13-05, D-07). Measured 2026-10-09:
+    // `config-set workflow.code_review_depth bogus` wrote at exit 0, as did every
+    // other enum key, because no guard consulted the registry's declared `values`. This runs AFTER every
+    // hand-coded guard above, so a key that already has its own guard
+    // (`workflow.drift_action`) keeps its message byte-identical; the
+    // registry, through `capabilityEnumValues`, is the only list consulted
+    // here. The refused value is NOT echoed (T-13-03): it is operator text and
+    // may carry terminal control sequences. Only the WRITE path changes: how an
+    // existing enum key is READ is deliberately unchanged in this phase (D-07).
+    // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
+    // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
+    // so a membership-only test let a one-element array through and wrote it —
+    // which `federated-config` silently reads back as the default for an enum
+    // key. Every declared capability enum value is a string, so a non-string
+    // parse (array, object, number, boolean) can never be a member.
+    const enumValues = capabilityEnumValues(kp);
+    if (enumValues && !isStringMember(enumValues, parsedValue)) {
+        error(`Invalid ${kp}. Valid values: ${enumValues.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     if (kp === 'review.default_reviewers') {
         const normalized = (0, review_reviewer_selection_cjs_1.normalizeConfiguredDefaultReviewers)(parsedValue);
         if (normalized.errors.length > 0) {
@@ -592,7 +651,58 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         output(maskedResult, raw, `${kp}=${masked}`);
         return;
     }
-    output(setConfigValueResult, raw, `${kp}=${String(parsedValue)}`);
+    // Pack 6 D-07: the WRITTEN value stays raw; its echo (and the value it
+    // replaced) is display-safe.
+    const shownValue = redactConfigCoordinates(kp, parsedValue);
+    const shownResult = {
+        ...setConfigValueResult,
+        value: redactConfigCoordinates(kp, setConfigValueResult.value),
+        previousValue: redactConfigCoordinates(kp, setConfigValueResult.previousValue),
+    };
+    output(shownResult, raw, `${kp}=${String(shownValue)}`);
+}
+/**
+ * Pack 6 D-07: the display-safe form of a config value about to be EMITTED,
+ * for the config keys that hold a remote repo coordinate (the shared-tier repo,
+ * `SHARED_REPO_CONFIG_KEY`). `keyPath` is the dotted path the value was read
+ * at (`''` for the whole config): the key itself, or any ancestor object that
+ * carries it, is projected through the one owner (`redactCloneTarget` in
+ * src/vault.cts); every other value is returned untouched (and a
+ * credential-free coordinate is unchanged by the owner). The file on disk and
+ * every in-process reader keep the raw value. Lazily required, so this
+ * module's load graph is unchanged.
+ */
+function redactConfigCoordinates(keyPath, value) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { SHARED_REPO_CONFIG_KEY } = require('./vault-coordinates.cjs');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { redactCloneTarget } = require('./vault.cjs');
+    const safe = (v) => (typeof v === 'string' && v !== '' ? (redactCloneTarget(v) ?? v) : v);
+    const target = SHARED_REPO_CONFIG_KEY.split('.');
+    const at = keyPath === '' ? [] : keyPath.split('.');
+    if (at.length > target.length || at.some((seg, i) => seg !== target[i]))
+        return value;
+    const rest = target.slice(at.length);
+    if (rest.length === 0)
+        return safe(value);
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const copy = JSON.parse(JSON.stringify(value));
+    // The flat form: the whole dotted key written as one top-level property.
+    if (at.length === 0 && typeof copy[SHARED_REPO_CONFIG_KEY] === 'string') {
+        copy[SHARED_REPO_CONFIG_KEY] = safe(copy[SHARED_REPO_CONFIG_KEY]);
+    }
+    let node = copy;
+    for (const seg of rest.slice(0, -1)) {
+        const next = node[seg];
+        if (next === null || typeof next !== 'object' || Array.isArray(next))
+            return copy;
+        node = next;
+    }
+    const leaf = rest[rest.length - 1];
+    if (typeof node[leaf] === 'string')
+        node[leaf] = safe(node[leaf]);
+    return copy;
 }
 function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
@@ -665,7 +775,9 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         output(masked, raw, masked);
         return;
     }
-    output(current, raw, String(current));
+    // Pack 6 D-07: a remote coordinate (or a section carrying one) is emitted display-safe.
+    const shown = redactConfigCoordinates(kp, current);
+    output(shown, raw, String(shown));
 }
 /**
  * Command to set the model profile in the config file.
@@ -768,6 +880,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    BOOLEAN_ONLY_CONFIG_KEYS,
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,
@@ -777,5 +890,7 @@ module.exports = {
     cmdMigrateConfig,
     // Exported for programmatic use by capability-writer and tests
     setConfigValue,
+    // Pack 6 D-07: `state load` emits the whole config through the same projection.
+    redactConfigCoordinates,
     setConfigValues,
 };

package/pp-core/bin/lib/core-utils.cjs

@@ -61,22 +61,58 @@ function detectSubRepos(cwd) {
 // ─── Summary body helpers ─────────────────────────────────────────────────
 /**
  * Extract a one-liner from the summary body when it's not in frontmatter.
+ *
+ * The slot is the one the SUMMARY template defines (`template.cts` summary body,
+ * `templates/summary.md:51` and its `<one_liner_rules>`): the FIRST paragraph
+ * directly after the FIRST `# ` title, written either as a whole bold paragraph
+ * (a wrapped one is joined with single spaces, the outer `**` stripped once and
+ * inner bold spans kept) or as the `**Label:** prose` line bug #2660 pinned.
+ * Anything else — a plain-prose first paragraph, or a bold span under a later
+ * heading — yields null. 261007-rly D-3/D-8: the old pattern took the first bold
+ * span after ANY heading anywhere in the file, which put fragments such as
+ * `Task 1` and `D-08-32 — applied as written.` into 15 of the 34 accomplishment
+ * lines of the v1.1 close (todos/done/milestone-complete-writes-a-poor-milestone-record.md).
+ * Shared by `milestone complete` and `summary-extract`'s `one_liner`.
  */
 function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
     const body = normalized.replace(/^---\n[\s\S]*?\n---\n*/, '');
-    const match = body.match(/^#[^\n]*\n+\*\*([^*\n]+)\*\*([^\n]*)/m);
-    if (!match)
+    const lines = body.split('\n');
+    const title = lines.findIndex((l) => /^# /.test(l));
+    if (title === -1)
+        return null;
+    let i = title + 1;
+    while (i < lines.length && lines[i].trim() === '')
+        i++;
+    const paragraph = [];
+    while (i < lines.length && lines[i].trim() !== '' && !/^#{1,6}\s/.test(lines[i]))
+        paragraph.push(lines[i++]);
+    if (paragraph.length === 0)
         return null;
-    const boldInner = match[1].trim();
-    const afterBold = match[2];
-    if (/:\s*$/.test(boldInner)) {
-        const prose = afterBold.trim();
+    // `**Label:** prose` (bug #2660): the prose after the label, null when empty.
+    const label = paragraph[0].match(/^\*\*([^*\n]+)\*\*([^\n]*)/);
+    if (label && /:\s*$/.test(label[1].trim())) {
+        const prose = label[2].trim();
         return prose.length > 0 ? prose : null;
     }
-    return boldInner.length > 0 ? boldInner : null;
+    // A whole bold paragraph, single-line or wrapped.
+    const first = paragraph[0].trim();
+    const last = paragraph[paragraph.length - 1].trim();
+    if (!first.startsWith('**'))
+        return null;
+    let bold = null;
+    if (last.endsWith('**'))
+        bold = paragraph.map((l) => l.trim()).join(' ');
+    // A bold first line with prose glued under it (no blank line between) — the
+    // shape tests/core-utils.test.cjs pins; the bold line is still the slot.
+    else if (first.length > 4 && first.endsWith('**'))
+        bold = first;
+    if (bold === null)
+        return null;
+    const inner = bold.slice(2, -2).trim();
+    return inner.length > 0 ? inner : null;
 }
 // ─── Misc utilities ───────────────────────────────────────────────────────────
 function pathExistsInternal(cwd, targetPath) {