@pareto4/pp-core 1.11.1 → 1.12.1

package/pp-core/bin/lib/config-loader.cjs

@@ -43,6 +43,9 @@ const model_catalog_cjs_1 = require("./model-catalog.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const federatedConfigModule = require("./federated-config.cjs");
 const { mergeFederatedConfig } = federatedConfigModule;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityActivationModule = require("./capability-activation.cjs");
+const { activationConfigFilesFor } = capabilityActivationModule;
 // The capability-registry.cjs is generated and lives in the same gsd-core/bin/lib/ output dir.
 // Both config-loader.cjs and capability-registry.cjs land in gsd-core/bin/lib/ at build time.
 // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
@@ -341,16 +344,154 @@ function _applyFederatedOverlay(baseConfig, userConfig) {
     _applyFederatedValues(cloned, _fedOverlay.values, _fedOverlay.validKeys);
     return cloned;
 }
-function loadConfig(cwd, options = {}) {
+/**
+ * The workstream `loadConfig` reads for `options`: an explicit `workstream`
+ * option, then `workstreamContext.ws`, then `GSD_WORKSTREAM`. Shared with
+ * `configFilesFor` so the two can never resolve different workstreams.
+ */
+function _activeWorkstreamFor(options) {
     const activeWorkstream = Object.prototype.hasOwnProperty.call(options, 'workstream')
         ? options['workstream']
         : (options['workstreamContext'] && Object.prototype.hasOwnProperty.call(options['workstreamContext'], 'ws'))
             ? options['workstreamContext']['ws']
             : (process.env['GSD_WORKSTREAM'] || null);
+    return typeof activeWorkstream === 'string' ? activeWorkstream : null;
+}
+function _configPathsFor(cwd, ws) {
+    return {
+        rootConfigPath: ws ? node_path_1.default.join(planningRoot(cwd), 'config.json') : null,
+        configPath: node_path_1.default.join(planningDir(cwd, ws), 'config.json'),
+    };
+}
+/** `~/.gsd/defaults.json` (or under `GSD_HOME`): read only in a pre-project context (#1683). */
+function _globalDefaultsPath() {
+    return node_path_1.default.join(process.env['GSD_HOME'] || node_os_1.default.homedir(), '.gsd', 'defaults.json');
+}
+/** The #1683 predicate: the global defaults are consulted only when the active planning dir is absent. */
+function _readsGlobalDefaults(cwd, ws) {
+    return !node_fs_1.default.existsSync(planningDir(cwd, ws));
+}
+/**
+ * Every config file `loadConfig(cwd, options)` reads, as absolute paths in read
+ * order. ONE owner of "which config files does the loader read": `loadConfig`
+ * takes its paths from the same `_configPathsFor`, so a reader that must refuse
+ * an unreadable config (`unreadableConfigFiles` below) parses exactly these
+ * files without restating the workstream ladder.
+ *
+ * Why a caller needs it: `loadConfig` swallows a parse failure in every one of
+ * these files (root → "workstream config stands alone", active → the defaults),
+ * so its RESULT cannot say whether it read the project's config or read
+ * nothing. Files that do not exist are still listed; absence is not a failure
+ * for `loadConfig`, and the caller decides what it means.
+ */
+function configFilesFor(cwd, options = {}) {
+    const ws = _activeWorkstreamFor(options);
+    const { rootConfigPath, configPath } = _configPathsFor(cwd, ws);
+    const files = [];
+    if (rootConfigPath)
+        files.push(rootConfigPath);
+    files.push(configPath);
+    if (_readsGlobalDefaults(cwd, ws))
+        files.push(_globalDefaultsPath());
+    return files;
+}
+/** The error text is bounded; composed text never reaches the cap, but it holds anyway. */
+const UNREADABLE_ERROR_CAP = 200;
+/**
+ * Describe why a config file could not be used WITHOUT echoing it. V8's
+ * `JSON.parse` messages sometimes quote the input (`Unexpected token '}',
+ * "{"a":tru}" is not valid JSON`), so only the position is carried over.
+ */
+function _describeConfigReadFailure(err) {
+    const e = err;
+    if (e && typeof e.code === 'string' && /^[A-Z][A-Z0-9_]*$/.test(e.code))
+        return `cannot be read (${e.code})`;
+    const message = e && typeof e.message === 'string' ? e.message : '';
+    const lineCol = /\(line (\d+) column (\d+)\)/.exec(message);
+    if (lineCol)
+        return `not valid JSON (line ${lineCol[1]}, column ${lineCol[2]})`;
+    const position = /at position (\d+)/.exec(message);
+    if (position)
+        return `not valid JSON (at position ${position[1]})`;
+    if (/Unexpected end of JSON input/.test(message))
+        return 'not valid JSON (the text ends before the JSON does)';
+    return 'not valid JSON';
+}
+/** How a refusal names a config file: never an absolute user path. */
+function _configDisplayPath(cwd, abs) {
+    const under = (base) => {
+        const rel = node_path_1.default.relative(base, abs);
+        return rel !== '' && !rel.startsWith('..') && !node_path_1.default.isAbsolute(rel) ? rel.split(node_path_1.default.sep).join('/') : null;
+    };
+    const inProject = under(cwd);
+    if (inProject !== null)
+        return inProject;
+    const homeOverride = process.env['GSD_HOME'];
+    const inHomeOverride = homeOverride ? under(homeOverride) : null;
+    if (inHomeOverride !== null)
+        return `$GSD_HOME/${inHomeOverride}`;
+    const inHome = under(node_os_1.default.homedir());
+    if (inHome !== null)
+        return `~/${inHome}`;
+    return node_path_1.default.basename(abs);
+}
+/**
+ * Every config file the hook resolver would read that EXISTS but cannot be
+ * used: unreadable, not JSON, or JSON that is not an object (`loadConfig`
+ * reads none of an array's or a null's keys and answers the defaults, the same
+ * silent fallback as a parse failure). Empty when every file is usable or
+ * absent: a MISSING config is a fresh project and reads as the defaults.
+ *
+ * The files are the union, in first-seen order, of the loader's list
+ * (`configFilesFor`) and the activation resolver's raw levels
+ * (`activationConfigFilesFor`, which can name a root config the loader never
+ * opens under `GSD_PROJECT`). Reads go through `platformReadSync`, the reader
+ * `loadConfig` uses, so a file the loader can read is never called unreadable.
+ *
+ * This is the ONE owner of "can the project's config be read". Both swallowing
+ * readers (`loadConfig`, `resolveConfigKey`) stay tolerant for their many
+ * callers; a caller whose answer governs a gate (`loop render-hooks`, the vault
+ * load verdict) asks this first and refuses. Never throws.
+ */
+function unreadableConfigFiles(cwd, options = {}) {
+    const out = [];
+    let files;
+    try {
+        files = [...new Set([...configFilesFor(cwd, options), ...activationConfigFilesFor(cwd)])];
+    }
+    catch (err) {
+        // An invalid GSD_WORKSTREAM / GSD_PROJECT segment: the config cannot be located, so it cannot be read.
+        return [{ file: '.planning/config.json', error: `cannot be located (${err instanceof Error ? err.message : String(err)})`.slice(0, UNREADABLE_ERROR_CAP) }];
+    }
+    for (const file of files) {
+        let error = null;
+        try {
+            const raw = (0, shell_command_projection_cjs_1.platformReadSync)(file);
+            if (raw === null)
+                continue;
+            const parsed = JSON.parse(raw);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                error = 'valid JSON but not an object, so none of its settings can be read';
+            }
+        }
+        catch (err) {
+            error = _describeConfigReadFailure(err);
+        }
+        if (error !== null)
+            out.push({ file: _configDisplayPath(cwd, file), error: error.slice(0, UNREADABLE_ERROR_CAP) });
+    }
+    return out;
+}
+/** One line per unreadable file, `<file>: <error>`, for a refusal message. */
+function describeUnreadableConfig(unreadable) {
+    return unreadable.map((u) => `${u.file}: ${u.error}`).join('; ');
+}
+function loadConfig(cwd, options = {}) {
     // When GSD_WORKSTREAM is set, load root config first so workstream config
     // can inherit from it. This prevents users from duplicating model_overrides,
     // workflow.*, etc. across every workstream config (#2714).
-    const ws = typeof activeWorkstream === 'string' ? activeWorkstream : (activeWorkstream === null ? null : null);
+    const ws = _activeWorkstreamFor(options);
+    const paths = _configPathsFor(cwd, ws);
     // #315 — per-call lazy memo: all three detection sites inside this loadConfig
     // call operate on the same cwd and the subrepo set cannot change mid-call, so
     // a single scan is sufficient. The memo is scoped to THIS call (not module-level)
@@ -364,8 +505,8 @@ function loadConfig(cwd, options = {}) {
         return cachedSubRepos.slice();
     };
     let rootParsed = null;
-    if (ws) {
-        const rootConfigPath = node_path_1.default.join(planningRoot(cwd), 'config.json');
+    if (paths.rootConfigPath) {
+        const rootConfigPath = paths.rootConfigPath;
         try {
             const raw = (0, shell_command_projection_cjs_1.platformReadSync)(rootConfigPath);
             if (raw === null)
@@ -400,7 +541,7 @@ function loadConfig(cwd, options = {}) {
             // Root config missing or unparseable — workstream config stands alone
         }
     }
-    const configPath = node_path_1.default.join(planningDir(cwd, ws), 'config.json');
+    const configPath = paths.configPath;
     const defaults = CONFIG_DEFAULTS;
     try {
         const raw = (0, shell_command_projection_cjs_1.platformReadSync)(configPath);
@@ -625,7 +766,7 @@ function loadConfig(cwd, options = {}) {
     }
     catch {
         // Fall back to ~/.gsd/defaults.json only for truly pre-project contexts (#1683)
-        if (node_fs_1.default.existsSync(planningDir(cwd, ws))) {
+        if (!_readsGlobalDefaults(cwd, ws)) {
             if (rootParsed) {
                 // Workstream has no config.json: re-parse using root config as the sole source.
                 // (FIX 2: overlay is applied recursively in the re-entrant loadConfig call)
@@ -642,8 +783,7 @@ function loadConfig(cwd, options = {}) {
             }
         }
         try {
-            const home = process.env['GSD_HOME'] || node_os_1.default.homedir();
-            const globalDefaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
+            const globalDefaultsPath = _globalDefaultsPath();
             const raw = (0, shell_command_projection_cjs_1.platformReadSync)(globalDefaultsPath);
             if (raw === null)
                 throw new Error('missing');
@@ -698,6 +838,9 @@ function loadConfig(cwd, options = {}) {
 }
 module.exports = {
     loadConfig,
+    configFilesFor,
+    unreadableConfigFiles,
+    describeUnreadableConfig,
     isGitIgnored,
     CONFIG_DEFAULTS,
     _getConfigDefault,

package/pp-core/bin/lib/config-schema.cjs

@@ -26,6 +26,21 @@ function isCapabilityConfigKey(keyPath) {
         return false;
     return Object.prototype.hasOwnProperty.call(schema, keyPath);
 }
+/**
+ * The declared `values` of a capability `type: "enum"` config key, or `null`
+ * when the key is not a capability key, is not an enum, or carries no value
+ * list. 13-05 / D-07: this is the ONE lookup of enum values —
+ * `config-set` asks it rather than restating any list, so the registry stays
+ * the single source of what an enum key may hold.
+ */
+function capabilityEnumValues(keyPath) {
+    if (!isCapabilityConfigKey(keyPath))
+        return null;
+    const entry = capabilityRegistry.configSchema[keyPath];
+    if (!entry || typeof entry !== 'object')
+        return null;
+    return entry.type === 'enum' && Array.isArray(entry.values) ? entry.values : null;
+}
 /**
  * Returns true for keys owned by the central schema adapter rather than a
  * federated Capability config slice.
@@ -53,6 +68,7 @@ module.exports = {
     RUNTIME_STATE_KEYS: configuration_cjs_1.RUNTIME_STATE_KEYS,
     DYNAMIC_KEY_PATTERNS: configuration_cjs_1.DYNAMIC_KEY_PATTERNS,
     isCapabilityConfigKey,
+    capabilityEnumValues,
     isCentralConfigKey,
     isValidConfigKey,
 };

package/pp-core/bin/lib/config.cjs

@@ -27,10 +27,11 @@ const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configSchema = require("./config-schema.cjs");
-const { VALID_CONFIG_KEYS, isValidConfigKey } = configSchema;
+const { VALID_CONFIG_KEYS, isValidConfigKey, capabilityEnumValues } = configSchema;
 const secrets_cjs_1 = require("./secrets.cjs");
 const review_reviewer_selection_cjs_1 = require("./review-reviewer-selection.cjs");
 const configuration_cjs_1 = require("./configuration.cjs");
+const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CONFIG_KEY_SUGGESTIONS = {
     'workflow.nyquist_validation_enabled': 'workflow.nyquist_validation',
@@ -464,6 +465,53 @@ function setConfigValues(cwd, entries) {
         }
     });
 }
+/**
+ * The ONE membership test every enum guard in `cmdConfigSet` asks (13-REVIEW
+ * CR-01). The raw value is parsed before the guards — `true`/`false`/numbers
+ * coerced, and a value starting with `[` or `{` JSON-parsed — and
+ * `String(['dev']) === 'dev'`, so a membership test on `String(parsedValue)`
+ * let a one-element array through and wrote it. Every value list here is
+ * strings, so only a plain string can be a member.
+ */
+function isStringMember(list, value) {
+    return typeof value === 'string' && list.includes(value);
+}
+/**
+ * Config keys `pp-tools config-set` accepts ONLY a real JSON boolean for
+ * (07-14 / REV-CR-01).
+ *
+ * The parse above coerces exactly the two lowercase words `true` and `false`;
+ * every other spelling an operator plausibly types becomes a truthy string
+ * (`"FALSE"`, `"no"`, `"off"`) or a number. `capability-activation`'s
+ * `_resolveActivationValue` ends in `Boolean(r.value)`, so those strings read as
+ * ON — an operator typing `config-set vault.enabled FALSE` to switch the vault
+ * off instead ARMED every step `capabilities/vault` hangs on that key, against
+ * the constraint that a `vault.enabled=false` project stays completely inert.
+ *
+ * The list, not ten copies of the same `if`: the first seven are capability
+ * activation keys read through that `Boolean()` (the vault switches plus every
+ * key that gates a blocking hook in the shipped registry). The last three were already guarded individually and are folded in here
+ * unchanged, message included, so there is one mechanism in this file rather
+ * than two.
+ *
+ * REFUSE, do not normalise: `FALSE` plainly means false, but `1`, `enabled` and
+ * `on` are guesses, and a config-set that silently rewrites the operator's word
+ * is the same class of silent-wrong-answer this phase exists to end. A typed
+ * usage error names the two accepted values.
+ */
+const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
+    'vault.enabled',
+    'vault.required',
+    'vault.practices_enabled',
+    'workflow.schema_drift_gate',
+    'workflow.nyquist_validation',
+    'workflow.security_enforcement',
+    'workflow.ui_safety_gate',
+    'pareto.enabled',
+    'git.create_tag',
+    'workflow.post_planning_gaps',
+    'plan_review.source_grounding',
+]);
 /**
  * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
  * "workflow.research").
@@ -508,12 +556,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         catch { /* keep as string */ }
     }
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
-    if (kp === 'context' && !VALID_CONTEXT_VALUES.includes(String(parsedValue))) {
+    if (kp === 'context' && !isStringMember(VALID_CONTEXT_VALUES, parsedValue)) {
         error(`Invalid context value '${val}'. Valid values: ${VALID_CONTEXT_VALUES.join(', ')}`);
     }
     // Codebase drift detector (#2003)
     const VALID_DRIFT_ACTIONS = ['warn', 'auto-remap'];
-    if (kp === 'workflow.drift_action' && !VALID_DRIFT_ACTIONS.includes(String(parsedValue))) {
+    if (kp === 'workflow.drift_action' && !isStringMember(VALID_DRIFT_ACTIONS, parsedValue)) {
         error(`Invalid workflow.drift_action '${val}'. Valid values: ${VALID_DRIFT_ACTIONS.join(', ')}`);
     }
     if (kp === 'workflow.drift_threshold') {
@@ -521,51 +569,62 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.drift_threshold '${val}'. Must be a positive integer.`);
         }
     }
-    // Post-planning gap checker (#2493)
-    if (kp === 'workflow.post_planning_gaps') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
-        }
-    }
-    // #3086 — git.create_tag: boolean only
-    if (kp === 'git.create_tag') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid git.create_tag '${val}'. Must be a boolean (true or false).`);
-        }
+    // Boolean-only keys, in ONE place (07-14 / REV-CR-01; absorbs the individual
+    // guards #2493 workflow.post_planning_gaps, #3086 git.create_tag and #22
+    // plan_review.source_grounding, whose message this reproduces verbatim).
+    if (BOOLEAN_ONLY_CONFIG_KEYS.includes(kp) && typeof parsedValue !== 'boolean') {
+        error(`Invalid ${kp} '${val}'. Must be a boolean (true or false).`, ERROR_REASON.USAGE);
     }
     if (kp === 'ship.pr_body_sections') {
         validateShipPrBodySections(parsedValue);
     }
+    // Phase ceremony tier (pack 9) — enum, src/phase-tier.cts owns the list
+    if (kp === 'phase.tier' && !isStringMember(phase_tier_cjs_1.PHASE_TIERS, parsedValue)) {
+        error(`Invalid phase.tier '${val}'. Valid values: ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     // Human verification checkpoint mode (#3309)
     const VALID_HUMAN_VERIFY_MODES = ['mid-flight', 'end-of-phase'];
-    if (kp === 'workflow.human_verify_mode' && !VALID_HUMAN_VERIFY_MODES.includes(String(parsedValue))) {
+    if (kp === 'workflow.human_verify_mode' && !isStringMember(VALID_HUMAN_VERIFY_MODES, parsedValue)) {
         error(`Invalid workflow.human_verify_mode '${val}'. Valid values: ${VALID_HUMAN_VERIFY_MODES.join(', ')}`);
     }
     // Context position enum validation (#2937)
     const VALID_CONTEXT_POSITIONS = ['front', 'end'];
-    if (kp === 'statusline.context_position' && !VALID_CONTEXT_POSITIONS.includes(String(parsedValue))) {
+    if (kp === 'statusline.context_position' && !isStringMember(VALID_CONTEXT_POSITIONS, parsedValue)) {
         error(`Invalid statusline.context_position '${val}'. Valid values: ${VALID_CONTEXT_POSITIONS.join(', ')}`);
     }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
-    if (kp === 'code_quality.fallow.scope' && !VALID_FALLOW_SCOPES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.scope' && !isStringMember(VALID_FALLOW_SCOPES, parsedValue)) {
         error(`Invalid code_quality.fallow.scope '${val}'. Valid values: ${VALID_FALLOW_SCOPES.join(', ')}`);
     }
     const VALID_FALLOW_PROFILES = ['minimal', 'standard', 'strict'];
-    if (kp === 'code_quality.fallow.profile' && !VALID_FALLOW_PROFILES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.profile' && !isStringMember(VALID_FALLOW_PROFILES, parsedValue)) {
         error(`Invalid code_quality.fallow.profile '${val}'. Valid values: ${VALID_FALLOW_PROFILES.join(', ')}`);
     }
-    // plan_review.source_grounding (#22) — boolean only
-    if (kp === 'plan_review.source_grounding') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid plan_review.source_grounding '${val}'. Must be a boolean (true or false).`);
-        }
-    }
     // plan_review.source_grounding_authority (#22) — enum
     const VALID_SOURCE_GROUNDING_AUTHORITIES = ['grep', 'intel', 'treesitter', 'lsp', 'scip'];
-    if (kp === 'plan_review.source_grounding_authority' && !VALID_SOURCE_GROUNDING_AUTHORITIES.includes(String(parsedValue))) {
+    if (kp === 'plan_review.source_grounding_authority' && !isStringMember(VALID_SOURCE_GROUNDING_AUTHORITIES, parsedValue)) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
+    // Capability enum keys, in ONE place (13-05, D-07). Measured 2026-10-09:
+    // `config-set workflow.code_review_depth bogus` wrote at exit 0, as did every
+    // other enum key, because no guard consulted the registry's declared `values`. This runs AFTER every
+    // hand-coded guard above, so a key that already has its own guard
+    // (`workflow.drift_action`) keeps its message byte-identical; the
+    // registry, through `capabilityEnumValues`, is the only list consulted
+    // here. The refused value is NOT echoed (T-13-03): it is operator text and
+    // may carry terminal control sequences. Only the WRITE path changes: how an
+    // existing enum key is READ is deliberately unchanged in this phase (D-07).
+    // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
+    // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
+    // so a membership-only test let a one-element array through and wrote it —
+    // which `federated-config` silently reads back as the default for an enum
+    // key. Every declared capability enum value is a string, so a non-string
+    // parse (array, object, number, boolean) can never be a member.
+    const enumValues = capabilityEnumValues(kp);
+    if (enumValues && !isStringMember(enumValues, parsedValue)) {
+        error(`Invalid ${kp}. Valid values: ${enumValues.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     if (kp === 'review.default_reviewers') {
         const normalized = (0, review_reviewer_selection_cjs_1.normalizeConfiguredDefaultReviewers)(parsedValue);
         if (normalized.errors.length > 0) {
@@ -592,7 +651,58 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         output(maskedResult, raw, `${kp}=${masked}`);
         return;
     }
-    output(setConfigValueResult, raw, `${kp}=${String(parsedValue)}`);
+    // Pack 6 D-07: the WRITTEN value stays raw; its echo (and the value it
+    // replaced) is display-safe.
+    const shownValue = redactConfigCoordinates(kp, parsedValue);
+    const shownResult = {
+        ...setConfigValueResult,
+        value: redactConfigCoordinates(kp, setConfigValueResult.value),
+        previousValue: redactConfigCoordinates(kp, setConfigValueResult.previousValue),
+    };
+    output(shownResult, raw, `${kp}=${String(shownValue)}`);
+}
+/**
+ * Pack 6 D-07: the display-safe form of a config value about to be EMITTED,
+ * for the config keys that hold a remote repo coordinate (the shared-tier repo,
+ * `SHARED_REPO_CONFIG_KEY`). `keyPath` is the dotted path the value was read
+ * at (`''` for the whole config): the key itself, or any ancestor object that
+ * carries it, is projected through the one owner (`redactCloneTarget` in
+ * src/vault.cts); every other value is returned untouched (and a
+ * credential-free coordinate is unchanged by the owner). The file on disk and
+ * every in-process reader keep the raw value. Lazily required, so this
+ * module's load graph is unchanged.
+ */
+function redactConfigCoordinates(keyPath, value) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { SHARED_REPO_CONFIG_KEY } = require('./vault-coordinates.cjs');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { redactCloneTarget } = require('./vault.cjs');
+    const safe = (v) => (typeof v === 'string' && v !== '' ? (redactCloneTarget(v) ?? v) : v);
+    const target = SHARED_REPO_CONFIG_KEY.split('.');
+    const at = keyPath === '' ? [] : keyPath.split('.');
+    if (at.length > target.length || at.some((seg, i) => seg !== target[i]))
+        return value;
+    const rest = target.slice(at.length);
+    if (rest.length === 0)
+        return safe(value);
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const copy = JSON.parse(JSON.stringify(value));
+    // The flat form: the whole dotted key written as one top-level property.
+    if (at.length === 0 && typeof copy[SHARED_REPO_CONFIG_KEY] === 'string') {
+        copy[SHARED_REPO_CONFIG_KEY] = safe(copy[SHARED_REPO_CONFIG_KEY]);
+    }
+    let node = copy;
+    for (const seg of rest.slice(0, -1)) {
+        const next = node[seg];
+        if (next === null || typeof next !== 'object' || Array.isArray(next))
+            return copy;
+        node = next;
+    }
+    const leaf = rest[rest.length - 1];
+    if (typeof node[leaf] === 'string')
+        node[leaf] = safe(node[leaf]);
+    return copy;
 }
 function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
@@ -665,7 +775,9 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         output(masked, raw, masked);
         return;
     }
-    output(current, raw, String(current));
+    // Pack 6 D-07: a remote coordinate (or a section carrying one) is emitted display-safe.
+    const shown = redactConfigCoordinates(kp, current);
+    output(shown, raw, String(shown));
 }
 /**
  * Command to set the model profile in the config file.
@@ -768,6 +880,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    BOOLEAN_ONLY_CONFIG_KEYS,
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,
@@ -777,5 +890,7 @@ module.exports = {
     cmdMigrateConfig,
     // Exported for programmatic use by capability-writer and tests
     setConfigValue,
+    // Pack 6 D-07: `state load` emits the whole config through the same projection.
+    redactConfigCoordinates,
     setConfigValues,
 };

package/pp-core/bin/lib/core-utils.cjs

@@ -61,22 +61,58 @@ function detectSubRepos(cwd) {
 // ─── Summary body helpers ─────────────────────────────────────────────────
 /**
  * Extract a one-liner from the summary body when it's not in frontmatter.
+ *
+ * The slot is the one the SUMMARY template defines (`template.cts` summary body,
+ * `templates/summary.md:51` and its `<one_liner_rules>`): the FIRST paragraph
+ * directly after the FIRST `# ` title, written either as a whole bold paragraph
+ * (a wrapped one is joined with single spaces, the outer `**` stripped once and
+ * inner bold spans kept) or as the `**Label:** prose` line bug #2660 pinned.
+ * Anything else — a plain-prose first paragraph, or a bold span under a later
+ * heading — yields null. 261007-rly D-3/D-8: the old pattern took the first bold
+ * span after ANY heading anywhere in the file, which put fragments such as
+ * `Task 1` and `D-08-32 — applied as written.` into 15 of the 34 accomplishment
+ * lines of the v1.1 close (todos/done/milestone-complete-writes-a-poor-milestone-record.md).
+ * Shared by `milestone complete` and `summary-extract`'s `one_liner`.
  */
 function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
     const body = normalized.replace(/^---\n[\s\S]*?\n---\n*/, '');
-    const match = body.match(/^#[^\n]*\n+\*\*([^*\n]+)\*\*([^\n]*)/m);
-    if (!match)
+    const lines = body.split('\n');
+    const title = lines.findIndex((l) => /^# /.test(l));
+    if (title === -1)
+        return null;
+    let i = title + 1;
+    while (i < lines.length && lines[i].trim() === '')
+        i++;
+    const paragraph = [];
+    while (i < lines.length && lines[i].trim() !== '' && !/^#{1,6}\s/.test(lines[i]))
+        paragraph.push(lines[i++]);
+    if (paragraph.length === 0)
         return null;
-    const boldInner = match[1].trim();
-    const afterBold = match[2];
-    if (/:\s*$/.test(boldInner)) {
-        const prose = afterBold.trim();
+    // `**Label:** prose` (bug #2660): the prose after the label, null when empty.
+    const label = paragraph[0].match(/^\*\*([^*\n]+)\*\*([^\n]*)/);
+    if (label && /:\s*$/.test(label[1].trim())) {
+        const prose = label[2].trim();
         return prose.length > 0 ? prose : null;
     }
-    return boldInner.length > 0 ? boldInner : null;
+    // A whole bold paragraph, single-line or wrapped.
+    const first = paragraph[0].trim();
+    const last = paragraph[paragraph.length - 1].trim();
+    if (!first.startsWith('**'))
+        return null;
+    let bold = null;
+    if (last.endsWith('**'))
+        bold = paragraph.map((l) => l.trim()).join(' ');
+    // A bold first line with prose glued under it (no blank line between) — the
+    // shape tests/core-utils.test.cjs pins; the bold line is still the slot.
+    else if (first.length > 4 && first.endsWith('**'))
+        bold = first;
+    if (bold === null)
+        return null;
+    const inner = bold.slice(2, -2).trim();
+    return inner.length > 0 ? inner : null;
 }
 // ─── Misc utilities ───────────────────────────────────────────────────────────
 function pathExistsInternal(cwd, targetPath) {