peaks-loop 4.0.0-beta.8 → 4.0.1

package/dist/services/config/config-service.js

@@ -0,0 +1,745 @@
+import { existsSync, mkdirSync } from 'node:fs';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { DEFAULT_CONFIG } from './config-types.js';
+import { stablePath } from '../../shared/path-utils.js';
+import { findProjectRoot, getProjectBootstrapConfigPath, getProjectConfigPath, getUserConfigPath, isInsidePath, readConfigFileSafely, resolveProjectRootForConfig, validateArtifactWorkspaceMarkerPath, validateArtifactWorkspaceRoot, validateProjectBootstrapConfigPathForWrite, validateUserConfigPathForWrite, writeConfigFileSafely, writeProjectConfigFile, writeUserConfigFile } from './config-safety.js';
+import { globalConfigPath, CONFIG_SCHEMA_VERSION_V2 } from './config-migration.js';
+import { isConfigV2 } from './config-types.js';
+import { providersConfigPath, proxyConfigPath, readSidecarJson, sidecarExists, workspacesConfigPath, writeSidecarJson } from './sidecar-store.js';
+import { SIDECAR_SCHEMA_VERSION } from './sidecar-store.js';
+// Re-export resolveProjectRootForConfig and resolveCanonicalProjectRoot for external consumers
+export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
+/**
+ * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
+ * object when the file is at schema 2.0.0; returns null when the
+ * file is absent (fresh install, no global config yet).
+ *
+ * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
+ * schema version — the caller is expected to run
+ * `peaks config migrate --apply` to bring it forward before
+ * continuing. This gate is intentional: a slim 2.0 reader must
+ * not silently pass through a 1.x shape, because every field it
+ * ignores is a field the caller is going to look for elsewhere
+ * (preferences.json, .bak, _state/).
+ */
+export function loadGlobalConfig() {
+    const path = globalConfigPath();
+    if (!existsSync(path))
+        return null;
+    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
+    const raw = JSON.parse(content);
+    if (isConfigV2(raw)) {
+        if (hasLegacyGlobalFields(raw)) {
+            promoteLegacyGlobalFieldsToSidecars(raw);
+            rewriteSlimGlobalConfig();
+        }
+        return readSlimGlobalConfig();
+    }
+    const detected = typeof raw.version === 'string' ? raw.version : 'unknown';
+    throw new Error(`CONFIG_LEGACY_VERSION: ~/.peaks/config.json is at version "${detected}", expected ${CONFIG_SCHEMA_VERSION_V2}. Run \`peaks config migrate --apply\`.`);
+}
+/**
+ * Slim 2.0 schema allows `version` + `ocr`. Any other top-level
+ * field is a legacy artifact that needs to be promoted to a
+ * sidecar file.
+ */
+function hasLegacyGlobalFields(raw) {
+    const allowed = new Set(['version', 'ocr']);
+    return Object.keys(raw).some((k) => !allowed.has(k));
+}
+/**
+ * One-shot promotion of legacy fields into their dedicated sidecar
+ * files. Idempotent: if the sidecar already has the field, the
+ * legacy value is dropped (sidecar is the new source of truth).
+ */
+function promoteLegacyGlobalFieldsToSidecars(raw) {
+    if (isRecord(raw.providers)) {
+        const existing = readSidecarJson(providersConfigPath(), { version: SIDECAR_SCHEMA_VERSION, providers: {} });
+        const mergedProviders = { ...(existing.providers ?? {}), ...raw.providers };
+        writeSidecarJson(providersConfigPath(), { version: SIDECAR_SCHEMA_VERSION, providers: mergedProviders });
+    }
+    if (isRecord(raw.proxy) && typeof raw.proxy.httpProxy === 'string') {
+        const httpProxy = raw.proxy.httpProxy;
+        if (!sidecarExists(proxyConfigPath())) {
+            writeSidecarJson(proxyConfigPath(), { version: SIDECAR_SCHEMA_VERSION, httpProxy });
+        }
+    }
+    if (Array.isArray(raw.workspaces) || typeof raw.currentWorkspace === 'string') {
+        if (!sidecarExists(workspacesConfigPath())) {
+            writeSidecarJson(workspacesConfigPath(), {
+                version: SIDECAR_SCHEMA_VERSION,
+                workspaces: Array.isArray(raw.workspaces) ? raw.workspaces : [],
+                currentWorkspace: typeof raw.currentWorkspace === 'string' ? raw.currentWorkspace : null
+            });
+        }
+    }
+}
+function readSlimGlobalConfig() {
+    const path = globalConfigPath();
+    if (!existsSync(path)) {
+        return { version: CONFIG_SCHEMA_VERSION_V2 };
+    }
+    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
+    return JSON.parse(content);
+}
+function rewriteSlimGlobalConfig() {
+    const path = globalConfigPath();
+    const ocr = readOcrFromRawConfigFile();
+    const slim = { version: CONFIG_SCHEMA_VERSION_V2 };
+    if (ocr !== null)
+        slim['ocr'] = ocr;
+    writeUserConfigFile(path, JSON.stringify(slim, null, 2) + '\n');
+}
+function readOcrFromRawConfigFile() {
+    const path = globalConfigPath();
+    if (!existsSync(path))
+        return null;
+    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
+    const raw = JSON.parse(content);
+    return isRecord(raw.ocr) ? raw.ocr : null;
+}
+function readJsonFile(path, validateBeforeRead, errorMessage = 'Config path must stay inside the config root') {
+    if (!path || !existsSync(path))
+        return null;
+    validateBeforeRead?.();
+    const content = readConfigFileSafely(path, errorMessage);
+    try {
+        return JSON.parse(content);
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+}
+function readExistingJsonFile(path, errorMessage, validateBeforeRead) {
+    if (!existsSync(path))
+        return null;
+    validateBeforeRead?.();
+    try {
+        return JSON.parse(readConfigFileSafely(path, errorMessage));
+    }
+    catch {
+        throw new Error(errorMessage);
+    }
+}
+function readUserJsonFile() {
+    const userPath = getUserConfigPath();
+    return readJsonFile(userPath, () => validateUserConfigPathForWrite(userPath), 'User config path must stay inside the user root');
+}
+function readProjectJsonFile(projectRoot) {
+    const projectPath = getProjectConfigPath(projectRoot);
+    return readJsonFile(projectPath, projectRoot && projectPath ? () => validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath) : undefined, 'Project config path must stay inside the project root');
+}
+function ensureDir(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true });
+    }
+}
+const UNSAFE_NESTED_PATH_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+function getNestedPathParts(path) {
+    return path.replace(/\[(\d+)\]/g, '.$1').split('.').filter(Boolean);
+}
+function hasUnsafeNestedPathSegment(parts) {
+    return parts.some((part) => UNSAFE_NESTED_PATH_SEGMENTS.has(part));
+}
+function getNestedValue(obj, path) {
+    const parts = getNestedPathParts(path);
+    if (parts.length === 0 || hasUnsafeNestedPathSegment(parts)) {
+        return undefined;
+    }
+    let current = obj;
+    for (const part of parts) {
+        if (current === null || current === undefined || typeof current !== 'object' || !Object.prototype.hasOwnProperty.call(current, part)) {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return current;
+}
+function setNestedValue(obj, path, value) {
+    const parts = getNestedPathParts(path);
+    if (parts.length === 0 || hasUnsafeNestedPathSegment(parts)) {
+        throw new Error('Unsafe config path');
+    }
+    let current = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!Object.prototype.hasOwnProperty.call(current, part) || typeof current[part] !== 'object' || current[part] === null || Array.isArray(current[part])) {
+            current[part] = {};
+        }
+        current = current[part];
+    }
+    const last = parts[parts.length - 1];
+    current[last] = value;
+}
+function removeProjectSensitiveConfig(config) {
+    const { providers, proxy, tokens, ...safeConfig } = config;
+    return Object.fromEntries(Object.entries(safeConfig).filter(([key, value]) => !isSecretKey(key) && !containsSensitiveConfigValue(value)));
+}
+export function isConfigLayer(value) {
+    return value === 'user' || value === 'project';
+}
+export function isSensitiveConfigPath(path) {
+    const normalized = path.toLowerCase().replace(/[^a-z0-9]/g, '');
+    return normalized.includes('apikey') || normalized.includes('accesskey') || normalized.includes('privatekey') || normalized.includes('token') || normalized.includes('secret') || normalized.includes('password') || normalized.includes('bearer') || normalized.includes('credential') || normalized.includes('auth');
+}
+/**
+ * 2.0.1 slim-config contract: `~/.peaks/config.json` only stores
+ * `version` + `ocr.llm.*` placeholders. The 1.x → 2.0 migration
+ * moved per-project fields (`language`, `model`, `economyMode`,
+ * `swarmMode`) to `<project>/.peaks/preferences.json` (per spec
+ * §10.4). `setConfig` rejects writes to those keys and points the
+ * user to the preferences path; tokens / providers / proxy still
+ * live in `~/.peaks/config.json` (the loader is tolerant of them
+ * but does not synthesise defaults for them anymore).
+ */
+const LEGACY_CONFIG_KEYS = new Set([
+    'language',
+    'model',
+    'economyMode',
+    'swarmMode'
+]);
+export function isLegacyConfigKey(path) {
+    const topLevel = path.split(/[.[].*/, 1)[0] ?? '';
+    return LEGACY_CONFIG_KEYS.has(topLevel);
+}
+function isProviderConfigPath(path) {
+    return path === 'providers' || path.startsWith('providers.');
+}
+function isSecretKey(key) {
+    return isSensitiveConfigPath(key);
+}
+function sanitizeBaseUrlForDisplay(value) {
+    try {
+        const url = new URL(value);
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        return url.toString();
+    }
+    catch {
+        return '[invalid-url-redacted]';
+    }
+}
+function isProviderBaseUrlPath(path) {
+    return /^providers\.[^.]+\.baseUrl$/.test(path);
+}
+function isValidProviderBaseUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' && url.username.length === 0 && url.password.length === 0 && url.search.length === 0 && url.hash.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function validateProviderBaseUrl(value) {
+    if (value !== undefined && (typeof value !== 'string' || !isValidProviderBaseUrl(value))) {
+        throw new Error('Provider base URL must be HTTPS without embedded credentials, query, or fragment');
+    }
+}
+function getProxyUrlCandidate(key, value) {
+    if (key === 'proxy.httpProxy') {
+        return value;
+    }
+    if (key === 'proxy' && isRecord(value)) {
+        return value.httpProxy;
+    }
+    return undefined;
+}
+function isProxyConfigPath(path) {
+    return path === 'proxy' || path.startsWith('proxy.');
+}
+function validateModelProviderConfig(providers) {
+    for (const [providerId, provider] of Object.entries(providers)) {
+        validateProviderBaseUrl(provider?.baseUrl);
+    }
+}
+function validateProviderConfig(partial) {
+    validateModelProviderConfig(partial.providers ?? {});
+}
+function isValidProxyUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && url.username.length === 0 && url.password.length === 0 && url.pathname === '/' && url.search.length === 0 && url.hash.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function validateProxyUrl(value) {
+    if (value !== undefined && (typeof value !== 'string' || !isValidProxyUrl(value))) {
+        throw new Error('Proxy URL must be an HTTP or HTTPS URL without embedded credentials');
+    }
+}
+function validateProxyConfig(partial) {
+    validateProxyUrl(partial.proxy?.httpProxy);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isSafeConfigSegment(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) && !value.includes('..') && !value.endsWith('.');
+}
+function toArtifactRemoteRepoConfig(value) {
+    if (!isRecord(value) || (value.provider !== 'github' && value.provider !== 'gitlab') || typeof value.owner !== 'string' || typeof value.name !== 'string') {
+        return null;
+    }
+    if (!isSafeConfigSegment(value.owner) || !isSafeConfigSegment(value.name)) {
+        return null;
+    }
+    return { provider: value.provider, owner: value.owner, name: value.name };
+}
+function toArtifactStorageConfig(value) {
+    if (!isRecord(value))
+        return null;
+    const localPath = typeof value.localPath === 'string' ? { localPath: value.localPath } : {};
+    if (value.mode === 'local') {
+        return { mode: 'local', ...localPath };
+    }
+    const remote = toArtifactRemoteRepoConfig(value.remote);
+    if (value.mode === 'local-with-remote-sync' && remote) {
+        return { mode: 'local-with-remote-sync', ...localPath, remote };
+    }
+    return null;
+}
+function toWorkspaceConfig(value) {
+    if (!isRecord(value))
+        return null;
+    const { workspaceId, name, rootPath, installedCapabilityIds } = value;
+    if (typeof workspaceId !== 'string' || !isSafeConfigSegment(workspaceId) || typeof name !== 'string' || typeof rootPath !== 'string' || !Array.isArray(installedCapabilityIds) || !installedCapabilityIds.every((id) => typeof id === 'string')) {
+        return null;
+    }
+    const artifactRepo = toArtifactRemoteRepoConfig(value.artifactRepo);
+    const artifactStorage = toArtifactStorageConfig(value.artifactStorage);
+    return {
+        workspaceId,
+        name,
+        rootPath,
+        installedCapabilityIds,
+        ...(artifactRepo ? { artifactRepo } : {}),
+        ...(artifactStorage ? { artifactStorage } : {})
+    };
+}
+function toWorkspaceConfigs(value) {
+    return Array.isArray(value) ? value.map(toWorkspaceConfig).filter((workspace) => workspace !== null) : [];
+}
+function toProviderModelConfig(value) {
+    if (!isRecord(value))
+        return {};
+    return {
+        ...(typeof value.model === 'string' && value.model.trim().length > 0 ? { model: value.model.trim() } : {}),
+        ...(typeof value.baseUrl === 'string' ? { baseUrl: value.baseUrl } : {}),
+        ...(typeof value.apiKey === 'string' ? { apiKey: value.apiKey } : {})
+    };
+}
+const TOKEN_CONFIG_KEYS = new Set(['AnthropicApiKey', 'OpenAiApiKey', 'GitHubToken', 'GitLabToken']);
+function toTokenRef(value) {
+    if (!isRecord(value))
+        return null;
+    const env = typeof value.env === 'string' ? value.env.trim() : '';
+    const keychain = typeof value.keychain === 'string' ? value.keychain.trim() : '';
+    if (env.length > 0) {
+        return { env };
+    }
+    if (keychain.length > 0) {
+        return { keychain };
+    }
+    if (value.ghCli === true) {
+        return { ghCli: true };
+    }
+    return null;
+}
+function toTokenConfig(value) {
+    if (!isRecord(value))
+        return {};
+    const tokens = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (!TOKEN_CONFIG_KEYS.has(key))
+            continue;
+        const tokenRef = toTokenRef(entry);
+        if (tokenRef) {
+            tokens[key] = tokenRef;
+        }
+    }
+    return tokens;
+}
+function toModelProviderConfig(value) {
+    if (!isRecord(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).map(([providerId, providerConfig]) => [providerId, toProviderModelConfig(providerConfig)]));
+}
+function toProxyConfig(value) {
+    if (!isRecord(value))
+        return null;
+    return typeof value.httpProxy === 'string' && isValidProxyUrl(value.httpProxy) ? { httpProxy: value.httpProxy } : null;
+}
+function getProjectWriteTarget() {
+    const projectRoot = findProjectRoot(process.cwd());
+    const configPath = getProjectConfigPath(projectRoot);
+    if (!projectRoot || !configPath) {
+        throw new Error('Project config not found');
+    }
+    return { projectRoot, configPath };
+}
+export function containsSensitiveConfigValue(value) {
+    if (Array.isArray(value)) {
+        return value.some(containsSensitiveConfigValue);
+    }
+    if (value === null || typeof value !== 'object') {
+        return false;
+    }
+    return Object.entries(value).some(([key, entry]) => isSecretKey(key) || containsSensitiveConfigValue(entry));
+}
+export function redactConfigSecrets(value, path = '') {
+    if (Array.isArray(value)) {
+        return value.map((item, index) => redactConfigSecrets(item, `${path}[${index}]`));
+    }
+    if (value === null || typeof value !== 'object') {
+        if (isProviderBaseUrlPath(path) && typeof value === 'string') {
+            return sanitizeBaseUrlForDisplay(value);
+        }
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
+        const nextPath = path ? `${path}.${key}` : key;
+        if (isSecretKey(key)) {
+            return [key, '***'];
+        }
+        if (isProviderBaseUrlPath(nextPath) && typeof entry === 'string') {
+            return [key, sanitizeBaseUrlForDisplay(entry)];
+        }
+        return [key, redactConfigSecrets(entry, nextPath)];
+    }));
+}
+const OCR_AUTH_HEADERS = new Set(['authorization', 'x-api-key', 'bearer']);
+function toOcrLlmConfig(value) {
+    if (!isRecord(value))
+        return {};
+    const url = typeof value.url === 'string' && value.url.trim().length > 0 ? value.url.trim() : undefined;
+    const authToken = typeof value.authToken === 'string' && value.authToken.length > 0 ? value.authToken : undefined;
+    const model = typeof value.model === 'string' && value.model.trim().length > 0 ? value.model.trim() : undefined;
+    const useAnthropic = typeof value.useAnthropic === 'boolean' ? value.useAnthropic : undefined;
+    const rawAuthHeader = typeof value.authHeader === 'string' ? value.authHeader : undefined;
+    const authHeader = rawAuthHeader !== undefined && OCR_AUTH_HEADERS.has(rawAuthHeader)
+        ? rawAuthHeader
+        : undefined;
+    return {
+        ...(url !== undefined ? { url } : {}),
+        ...(authToken !== undefined ? { authToken } : {}),
+        ...(model !== undefined ? { model } : {}),
+        ...(useAnthropic !== undefined ? { useAnthropic } : {}),
+        ...(authHeader !== undefined ? { authHeader } : {})
+    };
+}
+function toOcrConfig(value) {
+    if (!isRecord(value))
+        return {};
+    return {
+        ...(isRecord(value.llm) ? { llm: toOcrLlmConfig(value.llm) } : {})
+    };
+}
+/**
+ * Read the ocr LLM endpoint config from the user-layer
+ * `~/.peaks/config.json`. The user populates this themselves by
+ * pasting the `peaks code-review config-template` output (or by
+ * running `peaks config set --key ocr.llm.url --value '...'`).
+ * peaks-loop never auto-writes these values.
+ */
+export function getOcrConfig() {
+    const userConfig = readUserJsonFile() ?? {};
+    return toOcrConfig(userConfig.ocr);
+}
+/**
+ * Return the resolved `OcrLlmConfig` block (`peaksConfig.ocr.llm`)
+ * or `null` when the user has not populated the user config. The
+ * 5-state OCR detector uses this as the source of truth; when the
+ * returned block is missing required fields it produces a
+ * `config-missing` state with a templated `nextActions` payload
+ * the user can paste into their config.
+ */
+export function getOcrLlmConfig() {
+    const ocr = getOcrConfig();
+    if (!ocr.llm)
+        return null;
+    return ocr.llm;
+}
+function inferHumanLanguage(value) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error('Language must be non-empty');
+    }
+    if (/^zh(?:-|$)/i.test(normalized) || /[㐀-鿿]/u.test(normalized)) {
+        return 'zh-CN';
+    }
+    if (/^en(?:-|$)/i.test(normalized)) {
+        return 'en';
+    }
+    return 'en';
+}
+function toPeaksConfig(value) {
+    if (!isRecord(value))
+        return {};
+    const proxy = toProxyConfig(value.proxy);
+    return {
+        ...(typeof value.version === 'string' ? { version: value.version } : {}),
+        ...(typeof value.language === 'string' ? { language: value.language } : {}),
+        ...(typeof value.model === 'string' && ['haiku', 'sonnet', 'opus'].includes(value.model) ? { model: value.model } : {}),
+        ...(typeof value.economyMode === 'boolean' ? { economyMode: value.economyMode } : {}),
+        ...(typeof value.swarmMode === 'boolean' ? { swarmMode: value.swarmMode } : {}),
+        ...(isRecord(value.tokens) ? { tokens: toTokenConfig(value.tokens) } : {}),
+        ...(isRecord(value.providers) ? { providers: toModelProviderConfig(value.providers) } : {}),
+        ...(proxy ? { proxy } : {})
+    };
+}
+export function bootstrapProjectLanguageConfig(projectRoot, language) {
+    const inferredLanguage = inferHumanLanguage(language);
+    const projectPath = getProjectBootstrapConfigPath(projectRoot);
+    const existing = readExistingJsonFile(projectPath, 'Project config must contain valid JSON', () => validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath)) ?? {};
+    if (typeof existing.language === 'string' && existing.language.trim().length > 0) {
+        return;
+    }
+    writeProjectConfigFile(projectRoot, projectPath, JSON.stringify({ ...existing, language: inferredLanguage }, null, 2));
+}
+export function readConfig(projectRoot) {
+    const detectedRoot = projectRoot ?? findProjectRoot(process.cwd());
+    const userConfig = toPeaksConfig(readUserJsonFile());
+    const projectConfig = removeProjectSensitiveConfig(toPeaksConfig(readProjectJsonFile(detectedRoot)));
+    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
+    return {
+        ...DEFAULT_CONFIG,
+        ...userConfig,
+        ...projectConfigWithoutProxy
+    };
+}
+function sanitizeWorkspacePartial(partial) {
+    const result = { ...partial };
+    if (Array.isArray(result.workspaces)) {
+        result.workspaces = toWorkspaceConfigs(result.workspaces);
+    }
+    if (typeof result.currentWorkspace !== 'string' && result.currentWorkspace !== null && result.currentWorkspace !== undefined) {
+        delete result.currentWorkspace;
+    }
+    return result;
+}
+export function writeConfig(partial, layer = 'user') {
+    if (!isConfigLayer(layer)) {
+        throw new Error('Invalid config layer');
+    }
+    if (layer === 'project' && (partial.providers !== undefined || partial.proxy !== undefined || containsSensitiveConfigValue(partial))) {
+        throw new Error('Sensitive config keys must be stored in the user config layer');
+    }
+    validateProviderConfig(partial);
+    validateProxyConfig(partial);
+    if (layer === 'project') {
+        const { projectRoot, configPath } = getProjectWriteTarget();
+        ensureDir(dirname(configPath));
+        const existing = readJsonFile(configPath, () => validateProjectBootstrapConfigPathForWrite(projectRoot, configPath)) ?? {};
+        const merged = sanitizeWorkspacePartial({ ...existing, ...partial });
+        writeProjectConfigFile(projectRoot, configPath, JSON.stringify(merged, null, 2));
+        return;
+    }
+    const userPath = getUserConfigPath();
+    ensureDir(dirname(userPath));
+    const existing = readJsonFile(userPath, () => validateUserConfigPathForWrite(userPath)) ?? {};
+    const merged = sanitizeWorkspacePartial({ ...existing, ...partial });
+    writeUserConfigFile(userPath, JSON.stringify(merged, null, 2));
+}
+export function getConfig(options = {}) {
+    const projectRoot = findProjectRoot(process.cwd());
+    const userConfig = readUserJsonFile() ?? {};
+    const projectConfig = removeProjectSensitiveConfig(readProjectJsonFile(projectRoot) ?? {});
+    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
+    const source = options.layer === 'user'
+        ? userConfig
+        : options.layer === 'project'
+            ? projectConfig
+            : {
+                ...userConfig,
+                ...projectConfigWithoutProxy
+            };
+    const config = isRecord(source) ? { ...source, ...(source.tokens !== undefined ? { tokens: toTokenConfig(source.tokens) } : {}) } : source;
+    if (options.key !== undefined) {
+        return getNestedValue(config, options.key);
+    }
+    return config;
+}
+export function setConfig(options) {
+    const layer = options.layer ?? 'user';
+    if (!isConfigLayer(layer)) {
+        throw new Error('Invalid config layer');
+    }
+    if (isLegacyConfigKey(options.key)) {
+        throw new Error(`Legacy config key "${options.key}" is no longer stored in ~/.peaks/config.json. ` +
+            'Set it under <project>/.peaks/preferences.json (e.g. `peaks preferences set --key <key> --value <value>`).');
+    }
+    if (layer === 'project' && (isProviderConfigPath(options.key) || isProxyConfigPath(options.key) || isSensitiveConfigPath(options.key) || containsSensitiveConfigValue(options.value))) {
+        throw new Error('Sensitive config keys must be stored in the user config layer');
+    }
+    if (options.key === 'providers') {
+        validateModelProviderConfig(toModelProviderConfig(options.value));
+    }
+    else if (options.key.startsWith('providers.')) {
+        const providerId = getNestedPathParts(options.key)[1];
+        if (options.key === `providers.${providerId}`) {
+            validateModelProviderConfig({ [providerId]: toProviderModelConfig(options.value) });
+        }
+        else if (isProviderBaseUrlPath(options.key)) {
+            validateProviderBaseUrl(options.value);
+        }
+    }
+    validateProxyUrl(getProxyUrlCandidate(options.key, options.value));
+    const projectTarget = layer === 'project' ? getProjectWriteTarget() : null;
+    const targetPath = projectTarget?.configPath ?? getUserConfigPath();
+    ensureDir(dirname(targetPath));
+    const existing = projectTarget
+        ? readJsonFile(targetPath, () => validateProjectBootstrapConfigPathForWrite(projectTarget.projectRoot, targetPath)) ?? {}
+        : readJsonFile(targetPath, () => validateUserConfigPathForWrite(targetPath)) ?? {};
+    const updated = { ...existing };
+    setNestedValue(updated, options.key, options.value);
+    const content = JSON.stringify(updated, null, 2);
+    if (projectTarget) {
+        writeProjectConfigFile(projectTarget.projectRoot, targetPath, content);
+    }
+    else {
+        writeUserConfigFile(targetPath, content);
+    }
+}
+function readRawWorkspaceData(layer) {
+    const config = getConfig({ layer });
+    return isRecord(config)
+        ? {
+            currentWorkspace: typeof config.currentWorkspace === 'string' ? config.currentWorkspace : null,
+            workspaces: toWorkspaceConfigs(config.workspaces)
+        }
+        : { currentWorkspace: null, workspaces: [] };
+}
+function writeRawWorkspaceData(data, layer) {
+    const projectTarget = layer === 'project' ? getProjectWriteTarget() : null;
+    const targetPath = projectTarget?.configPath ?? getUserConfigPath();
+    ensureDir(dirname(targetPath));
+    const existing = projectTarget
+        ? readJsonFile(targetPath, () => validateProjectBootstrapConfigPathForWrite(projectTarget.projectRoot, targetPath)) ?? {}
+        : readJsonFile(targetPath, () => validateUserConfigPathForWrite(targetPath)) ?? {};
+    const merged = { ...existing, ...data };
+    const content = JSON.stringify(merged, null, 2);
+    if (projectTarget) {
+        writeProjectConfigFile(projectTarget.projectRoot, targetPath, content);
+    }
+    else {
+        writeUserConfigFile(targetPath, content);
+    }
+}
+function readAllWorkspaces() {
+    const userData = readRawWorkspaceData('user');
+    const projectData = readRawWorkspaceData('project');
+    const mergedWorkspaces = new Map();
+    for (const w of userData.workspaces)
+        mergedWorkspaces.set(w.workspaceId, w);
+    for (const w of projectData.workspaces)
+        mergedWorkspaces.set(w.workspaceId, w);
+    return {
+        currentWorkspace: projectData.currentWorkspace ?? userData.currentWorkspace,
+        workspaces: [...mergedWorkspaces.values()]
+    };
+}
+export function getWorkspaceConfig(workspaceId, _projectRoot) {
+    const { workspaces } = readAllWorkspaces();
+    return workspaces.find((w) => w.workspaceId === workspaceId) ?? null;
+}
+function readLayerConfig(layer) {
+    return readRawWorkspaceData(layer);
+}
+export function addWorkspace(workspace, layer = 'user') {
+    if (!isSafeConfigSegment(workspace.workspaceId)) {
+        throw new Error('Workspace id must only contain letters, numbers, dots, underscores, or hyphens and must not contain path traversal');
+    }
+    const config = readRawWorkspaceData(layer);
+    const workspaces = config.workspaces;
+    const existing = workspaces.findIndex((w) => w.workspaceId === workspace.workspaceId);
+    const updatedWorkspaces = existing >= 0
+        ? workspaces.map((existingWorkspace) => existingWorkspace.workspaceId === workspace.workspaceId ? workspace : existingWorkspace)
+        : [...workspaces, workspace];
+    writeRawWorkspaceData({ workspaces: updatedWorkspaces }, layer);
+}
+export function removeWorkspace(workspaceId, layer = 'user') {
+    if (!isSafeConfigSegment(workspaceId))
+        return false;
+    const config = readRawWorkspaceData(layer);
+    const workspaces = config.workspaces;
+    const idx = workspaces.findIndex((w) => w.workspaceId === workspaceId);
+    if (idx < 0)
+        return false;
+    const updatedWorkspaces = workspaces.filter((w) => w.workspaceId !== workspaceId);
+    const currentWorkspace = config.currentWorkspace === workspaceId ? updatedWorkspaces[0]?.workspaceId ?? null : config.currentWorkspace ?? null;
+    writeRawWorkspaceData({ workspaces: updatedWorkspaces, currentWorkspace }, layer);
+    return true;
+}
+export function setCurrentWorkspace(workspaceId, layer = 'user') {
+    if (!isSafeConfigSegment(workspaceId))
+        return false;
+    const config = readRawWorkspaceData(layer);
+    const workspaces = config.workspaces;
+    const exists = workspaces.some((w) => w.workspaceId === workspaceId);
+    if (!exists)
+        return false;
+    writeRawWorkspaceData({ currentWorkspace: workspaceId }, layer);
+    return true;
+}
+export function getCurrentWorkspaceConfig() {
+    const { currentWorkspace, workspaces } = readAllWorkspaces();
+    if (!currentWorkspace)
+        return null;
+    return workspaces.find((w) => w.workspaceId === currentWorkspace) ?? null;
+}
+export function getWorkspaceConfigForPath(path = process.cwd()) {
+    const { workspaces } = readAllWorkspaces();
+    return findWorkspaceForPath(workspaces, path);
+}
+function findWorkspaceForPath(workspaces, path) {
+    const targetPath = stablePath(path);
+    const matches = workspaces.flatMap((workspace) => {
+        if (!isAbsolute(workspace.rootPath) || !existsSync(workspace.rootPath))
+            return [];
+        const rootPath = stablePath(workspace.rootPath);
+        return isInsidePath(targetPath, rootPath) ? [{ workspace, rootPath }] : [];
+    });
+    if (matches.length === 0)
+        return null;
+    return matches.reduce((best, match) => match.rootPath.length > best.rootPath.length ? match : best).workspace;
+}
+function getWorkspaceArtifactRoot(workspace) {
+    return workspace.artifactStorage?.localPath ? resolve(workspace.artifactStorage.localPath) : resolve(workspace.rootPath, '.peaks', 'artifacts');
+}
+function ensureArtifactWorkspaceMarker(workspace) {
+    const artifactRoot = getWorkspaceArtifactRoot(workspace);
+    const peaksPath = resolve(artifactRoot, '.peaks');
+    const markerPath = resolve(peaksPath, 'config.json');
+    ensureDir(artifactRoot);
+    validateArtifactWorkspaceRoot(artifactRoot, workspace.rootPath);
+    ensureDir(peaksPath);
+    validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath);
+    if (!existsSync(markerPath)) {
+        writeConfigFileSafely(markerPath, '{}\n', () => validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath), 'Artifact workspace marker must stay inside the artifact workspace');
+    }
+}
+export function ensureWorkspaceConfigForPath(path = process.cwd()) {
+    const projectRoot = resolveProjectRootForConfig(path);
+    if (!isAbsolute(projectRoot) || !existsSync(projectRoot))
+        return null;
+    const config = readLayerConfig('user');
+    const existingWorkspace = findWorkspaceForPath(config.workspaces, path);
+    if (existingWorkspace) {
+        ensureArtifactWorkspaceMarker(existingWorkspace);
+        return existingWorkspace;
+    }
+    return null;
+}
+export function getWorkspaceConfigForCurrentPath() {
+    return getWorkspaceConfigForPath(process.cwd());
+}
+export function ensureWorkspaceConfigForCurrentPath() {
+    return ensureWorkspaceConfigForPath(process.cwd());
+}
+export { getUserConfigPath } from './config-safety.js';
+export { globalConfigPath } from './config-migration.js';