@rse/ase 1.0.7 → 2.0.1

package/dst/ase-config.js

@@ -4,584 +4,16 @@
 **  Licensed under Apache 2.0 <https://spdx.org/licenses/Apache-2.0>
 */
 import path from "node:path";
-import os from "node:os";
 import fs from "node:fs";
 import readline from "node:readline/promises";
-import { Document, parseDocument, isMap, isScalar } from "yaml";
+import { isMap, isScalar } from "yaml";
 import { execaSync } from "execa";
-import * as v from "valibot";
-import writeFileAtomic from "write-file-atomic";
-import lockfile from "proper-lockfile";
 import { z } from "zod";
-import { LRUCache } from "lru-cache";
-import { writeStdout } from "./ase-stdio.js";
-import { renderTable } from "./ase-table.js";
-/*  classification taxonomy  */
-export const projectClassification = {
-    boxing: ["white", "grey", "black"]
-};
-/*  agent classification taxonomy  */
-export const agentClassification = {
-    persona: ["writer", "engineer", "journalist", "telegrapher", "caveman"],
-    guidance: ["none", "minimal", "normal", "verbose"]
-};
-/*  classification presets  */
-export const projectClassificationPresets = {
-    vibe: {
-        "agent.persona": "writer",
-        "project.id": "example",
-        "project.name": "Example Project",
-        "project.boxing": "black"
-    },
-    pro: {
-        "agent.persona": "engineer",
-        "project.id": "example",
-        "project.name": "Example Project",
-        "project.boxing": "white"
-    },
-    default: {
-        "agent.task": "default",
-        "agent.persona": "engineer",
-        "agent.guidance": "normal",
-        "project.id": "example",
-        "project.name": "Example Project",
-        "project.boxing": "white",
-        "project.artifact.task.basedir": ".ase/task",
-        "project.artifact.task.files": "*.md",
-        "project.artifact.spec.basedir": "docs/specbook",
-        "project.artifact.spec.files": "*.{md,txt,svg,png,jpg}",
-        "project.artifact.spec.schema": "",
-        "project.artifact.code.basedir": "src",
-        "project.artifact.code.files": "** !**/etc/** !**/{.gitignore,.npmignore,package.json}",
-        "project.artifact.docs.basedir": "doc",
-        "project.artifact.docs.files": "** **/{README,LICENSE,CHANGELOG}.{md,txt} !{spec,arch}/**",
-        "project.artifact.infr.basedir": "",
-        "project.artifact.infr.files": "**/{.github,.claude*,etc}/** **/{AGENTS.md,{package,tsconfig*}.json,.{git,npm}ignore}"
-    },
-    industry: {
-        "agent.persona": "engineer",
-        "project.id": "example",
-        "project.name": "Example Project",
-        "project.boxing": "grey"
-    }
-};
-/*  hard-coded map: which scope kinds each variable may be SET on
-    (reads always cascade through the full chain; this restricts writes only);
-    keys absent from this map default to all non-"default" scope kinds  */
-export const configWritableScopes = {
-    "agent.task": ["session"],
-    "agent.skill": ["session"],
-    "project.artifact.task.basedir": ["user", "project"],
-    "project.artifact.task.files": ["user", "project"],
-    "project.artifact.spec.basedir": ["user", "project"],
-    "project.artifact.spec.files": ["user", "project"],
-    "project.artifact.spec.schema": ["user", "project"],
-    "project.artifact.code.basedir": ["user", "project"],
-    "project.artifact.code.files": ["user", "project"],
-    "project.artifact.docs.basedir": ["user", "project"],
-    "project.artifact.docs.files": ["user", "project"],
-    "project.artifact.infr.basedir": ["user", "project"],
-    "project.artifact.infr.files": ["user", "project"]
-};
-/*  default set of scope kinds writable for any unrestricted key  */
-const configWritableScopesDefault = ["user", "project", "task", "session"];
-/*  canonical ordering rank of a scope kind  */
-const scopeRank = (kind) => ({ default: -1, user: 0, project: 1, task: 2, session: 3 })[kind];
-/*  parse a single scope term  */
-const parseScopeTerm = (value) => {
-    if (value === "user")
-        return { kind: "user" };
-    else if (value === "project")
-        return { kind: "project" };
-    const m = /^(session|task):([A-Za-z0-9._-]+)$/.exec(value);
-    if (m !== null) {
-        if (m[2] === "." || m[2] === "..")
-            throw new Error(`invalid --scope term "${value}": id must not be "." or ".."`);
-        return { kind: m[1], id: m[2] };
-    }
-    throw new Error(`invalid --scope term "${value}" ` +
-        "(expected: \"user\", \"project\", \"task:<id>\", or \"session:<id>\")");
-};
-/*  determine the Git top-level directory, if inside a Git repository;
-    cached per working directory ("" ≡ not inside a Git working tree), as
-    each determination spawns a Git subprocess and the Git context can
-    change over the lifetime of the long-running ASE service  */
-const gitToplevelCache = new LRUCache({ max: 4, ttl: 2 * 1000 });
-const gitToplevel = () => {
-    const cwd = process.cwd();
-    const cached = gitToplevelCache.get(cwd);
-    if (cached !== undefined)
-        return cached === "" ? null : cached;
-    let top = "";
-    try {
-        top = execaSync("git", ["rev-parse", "--show-toplevel"], { stderr: "ignore" }).stdout.trim();
-    }
-    catch {
-        /*  not inside a Git working tree  */
-    }
-    gitToplevelCache.set(cwd, top);
-    return top === "" ? null : top;
-};
-/*  determine the project root directory, i.e. either the top-level
-    directory of the Git working tree or the nearest directory at or
-    above cwd which carries a ".ase" directory  */
-const projectRoot = () => {
-    const top = gitToplevel();
-    if (top !== null)
-        return top;
-    let dir = fs.realpathSync(process.cwd());
-    for (;;) {
-        if (fs.existsSync(path.join(dir, ".ase")))
-            return dir;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-};
-/*  detect whether a project context exists, i.e. either we are inside
-    a Git working tree or a ".ase" directory is present at or above cwd  */
-const hasProjectContext = () => projectRoot() !== null;
-/*  parse a raw "--scope" option value into a canonical Scope chain;
-    accepts a comma-separated list of terms in any order. The "user"
-    term is always implicitly added at the bottom of the chain; the
-    "project" term is implicitly added only when a project context
-    exists (Git repository or ".ase" directory at or above cwd) and it
-    stays weaker than the strongest explicitly requested term, and an
-    explicit "project" term requires that same context  */
-export const parseScope = (value) => {
-    const projectActive = hasProjectContext();
-    const input = (value === undefined || value === "") ?
-        (projectActive ? "project" : "user") :
-        value.trim();
-    if (input === "")
-        throw new Error("invalid --scope: value must not be empty");
-    const terms = input.split(",").map((s) => parseScopeTerm(s.trim()));
-    const seen = new Set();
-    for (const t of terms) {
-        if (seen.has(t.kind))
-            throw new Error(`invalid --scope: duplicate term of kind "${t.kind}"`);
-        seen.add(t.kind);
-    }
-    if (seen.has("project") && !projectActive)
-        throw new Error("invalid --scope: \"project\" requires a project context " +
-            "(a Git repository or a \".ase\" directory at or above the current directory)");
-    /*  the strongest term of the chain is the write target, so an implicitly
-        added "project" term must never outrank the strongest explicitly
-        requested term, as this would silently retarget the caller's request  */
-    const rankMax = Math.max(...terms.map((t) => scopeRank(t.kind)));
-    if (!seen.has("project") && projectActive && rankMax > scopeRank("project"))
-        terms.unshift({ kind: "project" });
-    if (!seen.has("user"))
-        terms.unshift({ kind: "user" });
-    terms.sort((a, b) => scopeRank(a.kind) - scopeRank(b.kind));
-    terms.unshift({ kind: "default" });
-    return terms;
-};
-/*  schema for a single artifact kind's "basedir"/"files" specification  */
-const artifactSchema = v.optional(v.strictObject({
-    basedir: v.optional(v.string()),
-    files: v.optional(v.string())
-}));
-/*  schema for the "spec" artifact kind, additionally carrying the
-    whitespace-separated list of SpecBook YAML "schema" configuration
-    files, with "std" naming the bundled standard one (empty: "std")  */
-const artifactSpecSchema = v.optional(v.strictObject({
-    basedir: v.optional(v.string()),
-    files: v.optional(v.string()),
-    schema: v.optional(v.string())
-}));
-/*  schema for ".ase/config.yaml"  */
-export const configSchema = v.nullish(v.strictObject({
-    project: v.optional(v.strictObject({
-        id: v.optional(v.pipe(v.string(), v.minLength(1))),
-        name: v.optional(v.pipe(v.string(), v.minLength(1))),
-        boxing: v.optional(v.picklist(projectClassification.boxing)),
-        artifact: v.optional(v.strictObject({
-            spec: artifactSpecSchema,
-            code: artifactSchema,
-            docs: artifactSchema,
-            infr: artifactSchema,
-            task: artifactSchema
-        }))
-    })),
-    agent: v.optional(v.strictObject({
-        persona: v.optional(v.picklist(agentClassification.persona)),
-        guidance: v.optional(v.picklist(agentClassification.guidance)),
-        task: v.optional(v.pipe(v.string(), v.minLength(1))),
-        skill: v.optional(v.pipe(v.string(), v.minLength(1)))
-    }))
-}));
-/*  encapsulate read/write access to a stack of "<name>.yaml" configuration files,
-    each associated with a scope term; reads cascade along user < project < task < session,
-    writes are confined to the target (strongest) scope term  */
-export class Config {
-    /*  public state  */
-    filename;
-    /*  private state  */
-    name;
-    scope;
-    schema;
-    log;
-    docs;
-    target;
-    pruned;
-    /*  creation  */
-    constructor(name, schema, log, scope = [{ kind: "user" }, { kind: "project" }]) {
-        if (scope.length === 0)
-            throw new Error("invalid scope: chain must not be empty");
-        this.name = name;
-        this.scope = scope[0].kind === "default" ? scope : [{ kind: "default" }, ...scope];
-        this.schema = schema ?? null;
-        this.log = log;
-        const tgt = this.scope[this.scope.length - 1];
-        this.filename = this.resolveFilename(name, tgt);
-        this.docs = [{ scope: tgt, filename: this.filename, doc: new Document() }];
-        this.target = 0;
-        this.pruned = [];
-    }
-    /*  render a scope term as a short textual label  */
-    static scopeLabel(term) {
-        if (term.kind === "default" || term.kind === "user" || term.kind === "project")
-            return term.kind;
-        return `${term.kind}:${term.id}`;
-    }
-    /*  resolve the per-OS user-scope base directory  */
-    userConfigDir() {
-        if (process.platform === "darwin")
-            /*  macOS  */
-            return path.join(os.homedir(), "Library", "Application Support", "ase");
-        else if (process.platform === "win32")
-            /*  Windows  */
-            return path.join(process.env.APPDATA ?? os.homedir(), "ase");
-        else {
-            /*  Linux  */
-            const xdg = process.env.XDG_CONFIG_HOME;
-            const base = xdg !== undefined && xdg !== "" ? xdg : path.join(os.homedir(), ".config");
-            return path.join(base, "ase");
-        }
-    }
-    /*  resolve the configuration filename based on the selected scope term  */
-    resolveFilename(name, term) {
-        if (term.kind === "default")
-            throw new Error("internal error: \"default\" scope has no filename");
-        if (term.kind === "user")
-            return path.join(this.userConfigDir(), `${name}.yaml`);
-        else if (term.kind === "project") {
-            const rel = path.join(".ase", `${name}.yaml`);
-            const root = projectRoot() ?? process.cwd();
-            const found = this.findUpward(process.cwd(), root, rel);
-            return found ?? path.join(root, rel);
-        }
-        else if (term.kind === "task") {
-            const root = projectRoot() ?? process.cwd();
-            return path.join(root, ".ase", "task", term.id, `${name}.yaml`);
-        }
-        else
-            return path.join(os.homedir(), ".ase", "session", term.id, `${name}.yaml`);
-    }
-    /*  upward-walk on filesystem for a file path relative to a start directory,
-        bounded above (inclusive) by a stop directory  */
-    findUpward(start, stop, rel) {
-        let dir = fs.realpathSync(start);
-        const end = fs.realpathSync(stop);
-        const steps = dir.split(path.sep).length - end.split(path.sep).length;
-        if (steps < 0)
-            return null;
-        for (let i = 0; i <= steps; i++) {
-            const candidate = path.join(dir, rel);
-            if (fs.existsSync(candidate))
-                return candidate;
-            const parent = path.dirname(dir);
-            if (parent === dir)
-                return null;
-            dir = parent;
-        }
-        return null;
-    }
-    /*  read the full scope chain into memory; the requested mode applies
-        to the target scope only, inherited scopes are always lenient  */
-    read(mode = "lenient") {
-        const chain = this.scope;
-        const docs = [];
-        this.pruned = [];
-        for (let i = 0; i < chain.length; i++) {
-            const sc = chain[i];
-            if (sc.kind === "default") {
-                const doc = new Document();
-                doc.contents = doc.createNode({});
-                if (this.name === "config") {
-                    const preset = projectClassificationPresets.default;
-                    for (const [k, val] of Object.entries(preset)) {
-                        const segments = k.split(".");
-                        for (let j = 1; j < segments.length; j++) {
-                            const prefix = segments.slice(0, j);
-                            const node = doc.getIn(prefix, true);
-                            if (node === undefined)
-                                doc.setIn(prefix, doc.createNode({}));
-                        }
-                        doc.setIn(segments, doc.createNode(val));
-                    }
-                }
-                docs.push({ scope: sc, filename: "", doc });
-                continue;
-            }
-            const filename = this.resolveFilename(this.name, sc);
-            const isTarget = (i === chain.length - 1);
-            const perDocMode = isTarget ? mode : "lenient";
-            const text = fs.existsSync(filename) ? fs.readFileSync(filename, "utf8") : "";
-            let doc = parseDocument(text);
-            if (doc.errors.length > 0) {
-                const msg = `invalid YAML in ${filename}: ${doc.errors[0].message}`;
-                if (perDocMode === "strict")
-                    throw new Error(msg);
-                this.log.write("warning", msg);
-                if (isTarget)
-                    this.pruned.push(`unparsable YAML (${doc.errors[0].message.split("\n")[0]})`);
-                doc = new Document();
-            }
-            docs.push({ scope: sc, filename, doc });
-        }
-        this.docs = docs;
-        this.target = docs.length - 1;
-        for (let i = 0; i < docs.length; i++) {
-            const isTarget = (i === this.target);
-            const perDocMode = isTarget ? mode : "lenient";
-            const removed = this.validateDoc(docs[i].doc, docs[i].filename, perDocMode);
-            if (isTarget)
-                this.pruned.push(...removed);
-        }
-    }
-    /*  acquire a cross-process advisory lock on the target scope's file,
-        execute the callback, then release the lock  */
-    lock(cb) {
-        const td = this.docs[this.target];
-        if (td.scope.kind === "default")
-            throw new Error("internal error: \"default\" scope is not lockable");
-        fs.mkdirSync(path.dirname(td.filename), { recursive: true });
-        if (!fs.existsSync(td.filename))
-            fs.writeFileSync(td.filename, "", "utf8");
-        const release = lockfile.lockSync(td.filename);
-        try {
-            cb();
-        }
-        finally {
-            release();
-        }
-    }
-    /*  write in-memory configuration back to the target scope's file  */
-    write() {
-        const td = this.docs[this.target];
-        if (td.scope.kind === "default")
-            throw new Error("internal error: \"default\" scope is not writable");
-        /*  a lenient read physically removes the invalid content from the in-memory
-            target document, so writing that document back would silently erase the
-            very same content from the file on disk  */
-        if (this.pruned.length > 0)
-            throw new Error(`refusing to overwrite ${td.filename}: it carries invalid content ` +
-                `(${this.pruned.join(", ")}) which was skipped on reading and hence would be ` +
-                "lost on writing -- repair the file first");
-        this.validateDoc(td.doc, td.filename, "strict");
-        fs.mkdirSync(path.dirname(td.filename), { recursive: true });
-        writeFileAtomic.sync(td.filename, td.doc.toString({ indent: 4 }), { encoding: "utf8" });
-    }
-    /*  validate a single YAML document against the optional schema; in "strict"
-        mode all invalid entries are reported as a thrown error, in "lenient" mode
-        they are removed from the document and their dotted paths are returned  */
-    validateDoc(doc, filename, mode = "strict") {
-        if (this.schema === null)
-            return [];
-        const removed = [];
-        for (;;) {
-            const result = v.safeParse(this.schema, doc.toJS());
-            if (result.success)
-                return removed;
-            if (mode === "strict") {
-                const issues = result.issues.map((i) => {
-                    const dotPath = (i.path ?? []).map((p) => String(p.key)).join(".");
-                    return dotPath ? `${dotPath}: ${i.message}` : i.message;
-                }).join("; ");
-                throw new Error(`invalid configuration in ${filename}: ${issues}`);
-            }
-            const before = removed.length;
-            for (const i of result.issues) {
-                const segs = (i.path ?? []).map((p) => String(p.key));
-                const dotPath = segs.join(".");
-                this.log.write("warning", `invalid entry in ${filename}: ${dotPath ? `${dotPath}: ` : ""}${i.message}`);
-                if (segs.length > 0 && doc.deleteIn(segs))
-                    removed.push(dotPath);
-                /*  issues at the document root and issues whose stringified path does not
-                    address a deletable node (e.g. a non-string YAML key like "404:", which
-                    "toJS" stringifies) cannot be removed; processing continues with the
-                    remaining issues  */
-            }
-            if (removed.length === before)
-                return removed;
-        }
-    }
-    /*  enumerate all full dotted leaf paths from the attached valibot schema  */
-    schemaLeafPaths() {
-        const unwrap = (s) => {
-            let cur = s;
-            while (cur !== undefined && cur !== null && (cur.type === "optional" || cur.type === "nullish"
-                || cur.type === "nullable" || cur.type === "undefinedable"))
-                cur = cur.wrapped;
-            return cur ?? null;
-        };
-        const walk = (s, prefix) => {
-            const u = unwrap(s);
-            if (u !== null
-                && (u.type === "object" || u.type === "strict_object" || u.type === "loose_object")
-                && u.entries !== undefined) {
-                const paths = [];
-                for (const [k, sub] of Object.entries(u.entries))
-                    paths.push(...walk(sub, [...prefix, k]));
-                return paths;
-            }
-            return [prefix];
-        };
-        return walk(this.schema, []);
-    }
-    /*  resolve a (possibly trailing-segment) dotted key to its full schema path  */
-    resolveKey(key) {
-        if (this.schema === null)
-            return key;
-        const segs = key.split(".");
-        const matches = this.schemaLeafPaths().filter((p) => {
-            if (p.length < segs.length)
-                return false;
-            for (let i = 0; i < segs.length; i++)
-                if (p[p.length - segs.length + i] !== segs[i])
-                    return false;
-            return true;
-        });
-        if (matches.length === 0)
-            return key;
-        if (matches.length > 1)
-            throw new Error(`ambiguous key "${key}" matches: ${matches.map((m) => m.join(".")).join(", ")}`);
-        return matches[0].join(".");
-    }
-    /*  retrieve the effective value at a dotted key (strongest scope wins),
-        or the target scope's root contents if no key is given  */
-    get(key) {
-        if (key === undefined)
-            return this.docs[this.target].doc.contents;
-        const segs = this.resolveKey(key).split(".");
-        for (let i = this.docs.length - 1; i >= 0; i--) {
-            const node = this.docs[i].doc.getIn(segs);
-            if (node !== undefined)
-                return node;
-        }
-        return undefined;
-    }
-    /*  retrieve the explicitly configured value at a dotted key, i.e. the same
-        cascade as "get", but skipping the built-in "default" scope layer, so
-        callers can distinguish a deliberately configured value from a merely
-        preset one  */
-    getExplicit(key) {
-        const segs = this.resolveKey(key).split(".");
-        for (let i = this.docs.length - 1; i >= 0; i--) {
-            if (this.docs[i].scope.kind === "default")
-                continue;
-            const node = this.docs[i].doc.getIn(segs);
-            if (node !== undefined)
-                return node;
-        }
-        return undefined;
-    }
-    /*  enumerate the effective leaf entries across the full scope chain;
-        each returned entry identifies the originating scope  */
-    entries() {
-        const keys = new Set();
-        const walk = (node, prefix) => {
-            if (isMap(node))
-                for (const item of node.items) {
-                    const k = [...prefix, String(item.key)];
-                    if (isMap(item.value))
-                        walk(item.value, k);
-                    else if (isScalar(item.value))
-                        keys.add(k.join("."));
-                    else
-                        throw new Error(`key "${k.join(".")}" has unsupported node type`);
-                }
-        };
-        for (const d of this.docs)
-            walk(d.doc.contents, []);
-        const result = [];
-        for (const k of keys) {
-            const segs = k.split(".");
-            for (let i = this.docs.length - 1; i >= 0; i--) {
-                const node = this.docs[i].doc.getIn(segs);
-                if (node !== undefined) {
-                    result.push({ key: k, value: node, scope: this.docs[i].scope });
-                    break;
-                }
-            }
-        }
-        result.sort((a, b) => a.key.localeCompare(b.key));
-        return result;
-    }
-    /*  determine whether a key is writable on a given scope kind  */
-    isWritableOn(key, kind) {
-        if (kind === "default")
-            return false;
-        const resolved = this.resolveKey(key);
-        const allowed = configWritableScopes[resolved] ?? configWritableScopesDefault;
-        return allowed.includes(kind);
-    }
-    /*  enforce write-scope policy for the current target scope  */
-    assertWritable(key) {
-        const td = this.docs[this.target];
-        const resolved = this.resolveKey(key);
-        const allowed = configWritableScopes[resolved] ?? configWritableScopesDefault;
-        if (!allowed.includes(td.scope.kind))
-            throw new Error(`cannot set "${resolved}" on scope "${Config.scopeLabel(td.scope)}": ` +
-                `this key is only writable on scope(s): ${allowed.join(", ")}`);
-    }
-    /*  set a value at a dotted key in the target scope, creating intermediate maps as needed  */
-    set(key, value) {
-        this.assertWritable(key);
-        const segments = this.resolveKey(key).split(".");
-        const td = this.docs[this.target];
-        const next = td.doc.clone();
-        for (let i = 1; i < segments.length; i++) {
-            const prefix = segments.slice(0, i);
-            const node = next.getIn(prefix, true);
-            if (node !== undefined && !isMap(node))
-                throw new Error(`cannot set "${key}": intermediate path "${prefix.join(".")}" is not a map`);
-            if (node === undefined)
-                next.setIn(prefix, next.createNode({}));
-        }
-        next.setIn(segments, value);
-        const saved = td.doc;
-        td.doc = next;
-        try {
-            this.validateDoc(td.doc, td.filename, "strict");
-        }
-        catch (err) {
-            td.doc = saved;
-            throw err;
-        }
-    }
-    /*  delete a value at a dotted key from the target scope  */
-    delete(key) {
-        this.assertWritable(key);
-        const td = this.docs[this.target];
-        if (td.doc.contents === null || td.doc.contents === undefined)
-            return;
-        const next = td.doc.clone();
-        next.deleteIn(this.resolveKey(key).split("."));
-        const saved = td.doc;
-        td.doc = next;
-        try {
-            this.validateDoc(td.doc, td.filename, "strict");
-        }
-        catch (err) {
-            td.doc = saved;
-            throw err;
-        }
-    }
-}
+import { writeStdout } from "./ase-lib-stdio.js";
+import { renderTable } from "./ase-lib-table.js";
+import { parseScope } from "./ase-config-scope.js";
+import { projectClassificationPresets, configSecretKeys, configSchema } from "./ase-config-schema.js";
+import { Config } from "./ase-config-core.js";
 /*  CLI command "ase config"  */
 export default class ConfigCommand {
     log;
@@ -628,17 +60,20 @@ export default class ConfigCommand {
         /*  register CLI sub-command "ase config list"  */
         configCmd
             .command("list")
-            .description("list all configured values as flat dotted keys")
+            .description("list all available configuration keys and their effective values")
             .action(async (_opts, cmd) => {
             const scope = parseScope(cmd.optsWithGlobals().scope);
             const cfg = new Config("config", configSchema, this.log, scope);
             cfg.read();
-            const rows = [];
+            const rows = new Map();
+            for (const key of cfg.keys())
+                rows.set(key, [key, "", "-"]);
             for (const e of cfg.entries()) {
                 const val = isScalar(e.value) ? e.value.value : e.value;
-                rows.push([e.key, String(val), Config.scopeLabel(e.scope)]);
+                rows.set(e.key, [e.key, configSecretKeys.includes(e.key) ? "***" : String(val), Config.scopeLabel(e.scope)]);
             }
-            await writeStdout(renderTable(["KEY", "VALUE", "SCOPE"], rows));
+            const sorted = [...rows.values()].sort((a, b) => a[0].localeCompare(b[0]));
+            await writeStdout(renderTable(["KEY", "VALUE", "SCOPE"], sorted));
         });
         /*  register CLI sub-command "ase config edit"  */
         configCmd
@@ -646,15 +81,20 @@ export default class ConfigCommand {
             .description("edit configuration file with $EDITOR")
             .action(async (_opts, cmd) => {
             const scope = parseScope(cmd.optsWithGlobals().scope);
-            const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
+            const editor = [process.env.VISUAL, process.env.EDITOR]
+                .find((e) => e !== undefined && e.trim() !== "") ?? "vi";
+            const [editorCmd, ...editorArgs] = editor.trim().split(/\s+/);
             const cfg = new Config("config", configSchema, this.log, scope);
             fs.mkdirSync(path.dirname(cfg.filename), { recursive: true });
             if (!fs.existsSync(cfg.filename))
-                fs.writeFileSync(cfg.filename, "", "utf8");
+                fs.writeFileSync(cfg.filename, "", {
+                    encoding: "utf8",
+                    mode: scope[scope.length - 1].kind === "user" ? 0o600 : undefined
+                });
             const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
             try {
                 for (;;) {
-                    execaSync(editor, [cfg.filename], { stdio: "inherit" });
+                    execaSync(editorCmd, [...editorArgs, cfg.filename], { stdio: "inherit" });
                     try {
                         cfg.read("strict");
                         break;
@@ -741,7 +181,7 @@ export class ConfigMCP {
                 "returns an empty string if no value is set.",
             inputSchema: {
                 key: z.string()
-                    .describe("dotted configuration key (e.g. \"agent.skill\")"),
+                    .describe("dotted configuration key (e.g. \"agent.persona\")"),
                 scope: z.string()
                     .describe("scope chain (e.g. \"session:<id>\", \"task:<id>\", \"project\", \"user\")")
             }
@@ -766,7 +206,7 @@ export class ConfigMCP {
                 "the configuration schema before being persisted.",
             inputSchema: {
                 key: z.string()
-                    .describe("dotted configuration key (e.g. \"agent.skill\")"),
+                    .describe("dotted configuration key (e.g. \"agent.persona\")"),
                 val: z.union([z.string(), z.number(), z.boolean(), z.null(), z.array(z.any()), z.record(z.string(), z.any())])
                     .describe("value to store under `key`"),
                 scope: z.string()
@@ -794,7 +234,7 @@ export class ConfigMCP {
                 "(the strongest scope term in the chain). No-op if the key is not present.",
             inputSchema: {
                 key: z.string()
-                    .describe("dotted configuration key (e.g. \"agent.skill\")"),
+                    .describe("dotted configuration key (e.g. \"agent.persona\")"),
                 scope: z.string()
                     .describe("scope chain (e.g. \"session:<id>\", \"task:<id>\", \"project\", \"user\")")
             }
@@ -841,7 +281,7 @@ export class ConfigMCP {
                 cfg.read();
                 const entries = cfg.entries().map((e) => ({
                     key: e.key,
-                    value: String(isScalar(e.value) ? e.value.value : e.value),
+                    value: configSecretKeys.includes(e.key) ? "***" : String(isScalar(e.value) ? e.value.value : e.value),
                     scope: Config.scopeLabel(e.scope)
                 }));
                 const result = { entries };