peaks-loop 4.1.2 → 4.1.4

package/dist/services/config/config-service.js

@@ -1,199 +1,19 @@
-import { existsSync, mkdirSync } from 'node:fs';
-import { dirname, isAbsolute, resolve } from 'node:path';
-import { DEFAULT_CONFIG, isConfigV2 } from './config-types.js';
-import { stablePath } from '../../shared/path-utils.js';
-import { findProjectRoot, getProjectBootstrapConfigPath, getProjectConfigPath, getUserConfigPath, isInsidePath, readConfigFileSafely, resolveProjectRootForConfig, validateArtifactWorkspaceMarkerPath, validateArtifactWorkspaceRoot, validateProjectBootstrapConfigPathForWrite, validateUserConfigPathForWrite, writeConfigFileSafely, writeProjectConfigFile, writeUserConfigFile } from './config-safety.js';
-import { globalConfigPath, CONFIG_SCHEMA_VERSION_V2 } from './config-migration.js';
-import { SIDECAR_SCHEMA_VERSION, providersConfigPath, proxyConfigPath, readSidecarJson, sidecarExists, workspacesConfigPath, writeSidecarJson } from './sidecar-store.js';
+import { dirname } from 'node:path';
+import { DEFAULT_CONFIG } from './config-types.js';
+import { findProjectRoot, getProjectBootstrapConfigPath, getUserConfigPath, validateProjectBootstrapConfigPathForWrite, validateUserConfigPathForWrite, writeProjectConfigFile, writeUserConfigFile } from './config-safety.js';
+import { getNestedPathParts, getNestedValue, setNestedValue } from './config-nested-path.js';
+import { isRecord, omitProxy } from './config-primitives.js';
+import { inferHumanLanguage, toModelProviderConfig, toPeaksConfig, toProviderModelConfig, toWorkspaceConfigs } from './config-coercion.js';
+import { containsSensitiveConfigValue, getProxyUrlCandidate, isLegacyConfigKey, isProviderBaseUrlPath, isProviderConfigPath, isProxyConfigPath, isSensitiveConfigPath, redactConfigSecrets, validateModelProviderConfig, validateProviderBaseUrl, validateProviderConfig, validateProxyUrl, validateProxyConfig } from './config-validation.js';
+import { ensureDir, getProjectWriteTarget, readExistingJsonFile, readJsonFile, readProjectJsonFile, readUserJsonFile, removeProjectSensitiveConfig } from './config-file-io.js';
 // Re-export resolveProjectRootForConfig and resolveCanonicalProjectRoot for external consumers
 export { resolveProjectRootForConfig, resolveCanonicalProjectRoot } from './config-safety.js';
-/**
- * Load the slim 2.0 `~/.peaks/config.json` file. Returns the parsed
- * object when the file is at schema 2.0.0; returns null when the
- * file is absent (fresh install, no global config yet).
- *
- * Throws `CONFIG_LEGACY_VERSION` when the file exists at a 1.x
- * schema version — the caller is expected to run
- * `peaks config migrate --apply` to bring it forward before
- * continuing. This gate is intentional: a slim 2.0 reader must
- * not silently pass through a 1.x shape, because every field it
- * ignores is a field the caller is going to look for elsewhere
- * (preferences.json, .bak, _state/).
- */
-export function loadGlobalConfig() {
-    const path = globalConfigPath();
-    if (!existsSync(path))
-        return null;
-    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
-    const raw = JSON.parse(content);
-    if (isConfigV2(raw)) {
-        if (hasLegacyGlobalFields(raw)) {
-            promoteLegacyGlobalFieldsToSidecars(raw);
-            rewriteSlimGlobalConfig();
-        }
-        return readSlimGlobalConfig();
-    }
-    const detected = typeof raw.version === 'string' ? raw.version : 'unknown';
-    throw new Error(`CONFIG_LEGACY_VERSION: ~/.peaks/config.json is at version "${detected}", expected ${CONFIG_SCHEMA_VERSION_V2}. Run \`peaks config migrate --apply\`.`);
-}
-/**
- * Slim 2.0 schema allows `version` + `ocr`. Any other top-level
- * field is a legacy artifact that needs to be promoted to a
- * sidecar file.
- */
-function hasLegacyGlobalFields(raw) {
-    const allowed = new Set(['version', 'ocr']);
-    return Object.keys(raw).some((k) => !allowed.has(k));
-}
-/**
- * One-shot promotion of legacy fields into their dedicated sidecar
- * files. Idempotent: if the sidecar already has the field, the
- * legacy value is dropped (sidecar is the new source of truth).
- */
-function promoteLegacyGlobalFieldsToSidecars(raw) {
-    if (isRecord(raw.providers)) {
-        const existing = readSidecarJson(providersConfigPath(), {
-            version: SIDECAR_SCHEMA_VERSION,
-            providers: {}
-        });
-        const mergedProviders = {
-            ...(existing.providers ?? {}),
-            ...raw.providers
-        };
-        writeSidecarJson(providersConfigPath(), {
-            version: SIDECAR_SCHEMA_VERSION,
-            providers: mergedProviders
-        });
-    }
-    if (isRecord(raw.proxy) && typeof raw.proxy.httpProxy === 'string') {
-        const httpProxy = raw.proxy.httpProxy;
-        if (!sidecarExists(proxyConfigPath())) {
-            writeSidecarJson(proxyConfigPath(), { version: SIDECAR_SCHEMA_VERSION, httpProxy });
-        }
-    }
-    if (Array.isArray(raw.workspaces) || typeof raw.currentWorkspace === 'string') {
-        if (!sidecarExists(workspacesConfigPath())) {
-            writeSidecarJson(workspacesConfigPath(), {
-                version: SIDECAR_SCHEMA_VERSION,
-                workspaces: Array.isArray(raw.workspaces) ? raw.workspaces : [],
-                currentWorkspace: typeof raw.currentWorkspace === 'string' ? raw.currentWorkspace : null
-            });
-        }
-    }
-}
-function readSlimGlobalConfig() {
-    const path = globalConfigPath();
-    if (!existsSync(path)) {
-        return { version: CONFIG_SCHEMA_VERSION_V2 };
-    }
-    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
-    return JSON.parse(content);
-}
-function rewriteSlimGlobalConfig() {
-    const path = globalConfigPath();
-    const ocr = readOcrFromRawConfigFile();
-    const slim = { version: CONFIG_SCHEMA_VERSION_V2 };
-    if (ocr !== null)
-        slim['ocr'] = ocr;
-    writeUserConfigFile(path, JSON.stringify(slim, null, 2) + '\n');
-}
-function readOcrFromRawConfigFile() {
-    const path = globalConfigPath();
-    if (!existsSync(path))
-        return null;
-    const content = readConfigFileSafely(path, 'Global config path must stay inside the user root');
-    const raw = JSON.parse(content);
-    return isRecord(raw.ocr) ? raw.ocr : null;
-}
-function readJsonFile(path, validateBeforeRead, errorMessage = 'Config path must stay inside the config root') {
-    if (!path || !existsSync(path))
-        return null;
-    validateBeforeRead?.();
-    const content = readConfigFileSafely(path, errorMessage);
-    try {
-        return JSON.parse(content);
-    }
-    catch {
-        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        return null;
-    }
-}
-function readExistingJsonFile(path, errorMessage, validateBeforeRead) {
-    if (!existsSync(path))
-        return null;
-    validateBeforeRead?.();
-    try {
-        return JSON.parse(readConfigFileSafely(path, errorMessage));
-    }
-    catch {
-        throw new Error(errorMessage);
-    }
-}
-function readUserJsonFile() {
-    const userPath = getUserConfigPath();
-    return readJsonFile(userPath, () => validateUserConfigPathForWrite(userPath), 'User config path must stay inside the user root');
-}
-function readProjectJsonFile(projectRoot) {
-    const projectPath = getProjectConfigPath(projectRoot);
-    return readJsonFile(projectPath, projectRoot && projectPath
-        ? () => validateProjectBootstrapConfigPathForWrite(projectRoot, projectPath)
-        : undefined, 'Project config path must stay inside the project root');
-}
-function ensureDir(dirPath) {
-    if (!existsSync(dirPath)) {
-        mkdirSync(dirPath, { recursive: true });
-    }
-}
-const UNSAFE_NESTED_PATH_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
-function getNestedPathParts(path) {
-    return path
-        .replace(/\[(\d+)\]/g, '.$1')
-        .split('.')
-        .filter(Boolean);
-}
-function hasUnsafeNestedPathSegment(parts) {
-    return parts.some((part) => UNSAFE_NESTED_PATH_SEGMENTS.has(part));
-}
-function getNestedValue(obj, path) {
-    const parts = getNestedPathParts(path);
-    if (parts.length === 0 || hasUnsafeNestedPathSegment(parts)) {
-        return undefined;
-    }
-    let current = obj;
-    for (const part of parts) {
-        if (current === null ||
-            current === undefined ||
-            typeof current !== 'object' ||
-            !Object.prototype.hasOwnProperty.call(current, part)) {
-            return undefined;
-        }
-        current = current[part];
-    }
-    return current;
-}
-function setNestedValue(obj, path, value) {
-    const parts = getNestedPathParts(path);
-    if (parts.length === 0 || hasUnsafeNestedPathSegment(parts)) {
-        throw new Error('Unsafe config path');
-    }
-    let current = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-        const part = parts[i];
-        if (!Object.prototype.hasOwnProperty.call(current, part) ||
-            typeof current[part] !== 'object' ||
-            current[part] === null ||
-            Array.isArray(current[part])) {
-            current[part] = {};
-        }
-        current = current[part];
-    }
-    const last = parts[parts.length - 1];
-    current[last] = value;
-}
-function removeProjectSensitiveConfig(config) {
-    const { providers, proxy, tokens, ...safeConfig } = config;
-    return Object.fromEntries(Object.entries(safeConfig).filter(([key, value]) => !isSecretKey(key) && !containsSensitiveConfigValue(value)));
-}
+// Every name below moved into a sibling module for the file-size cap; the
+// declarations are unchanged, so importers of this path are unaffected.
+export { getConfig } from './config-get.js';
+export { loadGlobalConfig } from './config-global-loader.js';
+export { addWorkspace, ensureWorkspaceConfigForCurrentPath, ensureWorkspaceConfigForPath, getCurrentWorkspaceConfig, getWorkspaceConfig, getWorkspaceConfigForCurrentPath, getWorkspaceConfigForPath, removeWorkspace, setCurrentWorkspace } from './config-workspace.js';
+export { containsSensitiveConfigValue, isLegacyConfigKey, isSensitiveConfigPath, redactConfigSecrets };
 export function isConfigLayer(value) {
     return value === 'user' || value === 'project';
 }
@@ -231,311 +51,6 @@ export function readContextWindowTokensOverride(projectRoot) {
         return undefined;
     }
 }
-export function isSensitiveConfigPath(path) {
-    const normalized = path.toLowerCase().replace(/[^a-z0-9]/g, '');
-    return (normalized.includes('apikey') ||
-        normalized.includes('accesskey') ||
-        normalized.includes('privatekey') ||
-        normalized.includes('token') ||
-        normalized.includes('secret') ||
-        normalized.includes('password') ||
-        normalized.includes('bearer') ||
-        normalized.includes('credential') ||
-        normalized.includes('auth'));
-}
-/**
- * 2.0.1 slim-config contract: `~/.peaks/config.json` only stores
- * `version` + `ocr.llm.*` placeholders. The 1.x → 2.0 migration
- * moved per-project fields (`language`, `model`, `economyMode`,
- * `swarmMode`) to `<project>/.peaks/preferences.json` (per spec
- * §10.4). `setConfig` rejects writes to those keys and points the
- * user to the preferences path; tokens / providers / proxy still
- * live in `~/.peaks/config.json` (the loader is tolerant of them
- * but does not synthesise defaults for them anymore).
- */
-const LEGACY_CONFIG_KEYS = new Set([
-    'language',
-    'model',
-    'economyMode',
-    'swarmMode'
-]);
-export function isLegacyConfigKey(path) {
-    const topLevel = path.split(/[.[].*/, 1)[0] ?? '';
-    return LEGACY_CONFIG_KEYS.has(topLevel);
-}
-function isProviderConfigPath(path) {
-    return path === 'providers' || path.startsWith('providers.');
-}
-function isSecretKey(key) {
-    return isSensitiveConfigPath(key);
-}
-function sanitizeBaseUrlForDisplay(value) {
-    try {
-        const url = new URL(value);
-        url.username = '';
-        url.password = '';
-        url.search = '';
-        url.hash = '';
-        return url.toString();
-    }
-    catch {
-        return '[invalid-url-redacted]';
-    }
-}
-function isProviderBaseUrlPath(path) {
-    return /^providers\.[^.]+\.baseUrl$/.test(path);
-}
-function isValidProviderBaseUrl(value) {
-    try {
-        const url = new URL(value);
-        return (url.protocol === 'https:' &&
-            url.username.length === 0 &&
-            url.password.length === 0 &&
-            url.search.length === 0 &&
-            url.hash.length === 0);
-    }
-    catch {
-        return false;
-    }
-}
-function validateProviderBaseUrl(value) {
-    if (value !== undefined && (typeof value !== 'string' || !isValidProviderBaseUrl(value))) {
-        throw new Error('Provider base URL must be HTTPS without embedded credentials, query, or fragment');
-    }
-}
-function getProxyUrlCandidate(key, value) {
-    if (key === 'proxy.httpProxy') {
-        return value;
-    }
-    if (key === 'proxy' && isRecord(value)) {
-        return value.httpProxy;
-    }
-    return undefined;
-}
-function isProxyConfigPath(path) {
-    return path === 'proxy' || path.startsWith('proxy.');
-}
-function validateModelProviderConfig(providers) {
-    for (const [providerId, provider] of Object.entries(providers)) {
-        validateProviderBaseUrl(provider?.baseUrl);
-    }
-}
-function validateProviderConfig(partial) {
-    validateModelProviderConfig(partial.providers ?? {});
-}
-function isValidProxyUrl(value) {
-    try {
-        const url = new URL(value);
-        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
-            url.username.length === 0 &&
-            url.password.length === 0 &&
-            url.pathname === '/' &&
-            url.search.length === 0 &&
-            url.hash.length === 0);
-    }
-    catch {
-        return false;
-    }
-}
-function validateProxyUrl(value) {
-    if (value !== undefined && (typeof value !== 'string' || !isValidProxyUrl(value))) {
-        throw new Error('Proxy URL must be an HTTP or HTTPS URL without embedded credentials');
-    }
-}
-function validateProxyConfig(partial) {
-    validateProxyUrl(partial.proxy?.httpProxy);
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function isSafeConfigSegment(value) {
-    return (/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) && !value.includes('..') && !value.endsWith('.'));
-}
-function toArtifactRemoteRepoConfig(value) {
-    if (!isRecord(value) ||
-        (value.provider !== 'github' && value.provider !== 'gitlab') ||
-        typeof value.owner !== 'string' ||
-        typeof value.name !== 'string') {
-        return null;
-    }
-    if (!isSafeConfigSegment(value.owner) || !isSafeConfigSegment(value.name)) {
-        return null;
-    }
-    return { provider: value.provider, owner: value.owner, name: value.name };
-}
-function toArtifactStorageConfig(value) {
-    if (!isRecord(value))
-        return null;
-    const localPath = typeof value.localPath === 'string' ? { localPath: value.localPath } : {};
-    if (value.mode === 'local') {
-        return { mode: 'local', ...localPath };
-    }
-    const remote = toArtifactRemoteRepoConfig(value.remote);
-    if (value.mode === 'local-with-remote-sync' && remote) {
-        return { mode: 'local-with-remote-sync', ...localPath, remote };
-    }
-    return null;
-}
-function toWorkspaceConfig(value) {
-    if (!isRecord(value))
-        return null;
-    const { workspaceId, name, rootPath, installedCapabilityIds } = value;
-    if (typeof workspaceId !== 'string' ||
-        !isSafeConfigSegment(workspaceId) ||
-        typeof name !== 'string' ||
-        typeof rootPath !== 'string' ||
-        !Array.isArray(installedCapabilityIds) ||
-        !installedCapabilityIds.every((id) => typeof id === 'string')) {
-        return null;
-    }
-    const artifactRepo = toArtifactRemoteRepoConfig(value.artifactRepo);
-    const artifactStorage = toArtifactStorageConfig(value.artifactStorage);
-    return {
-        workspaceId,
-        name,
-        rootPath,
-        installedCapabilityIds,
-        ...(artifactRepo ? { artifactRepo } : {}),
-        ...(artifactStorage ? { artifactStorage } : {})
-    };
-}
-function toWorkspaceConfigs(value) {
-    return Array.isArray(value)
-        ? value
-            .map(toWorkspaceConfig)
-            .filter((workspace) => workspace !== null)
-        : [];
-}
-function toProviderModelConfig(value) {
-    if (!isRecord(value))
-        return {};
-    return {
-        ...(typeof value.model === 'string' && value.model.trim().length > 0
-            ? { model: value.model.trim() }
-            : {}),
-        ...(typeof value.baseUrl === 'string' ? { baseUrl: value.baseUrl } : {}),
-        ...(typeof value.apiKey === 'string' ? { apiKey: value.apiKey } : {})
-    };
-}
-const TOKEN_CONFIG_KEYS = new Set([
-    'AnthropicApiKey',
-    'OpenAiApiKey',
-    'GitHubToken',
-    'GitLabToken'
-]);
-function toTokenRef(value) {
-    if (!isRecord(value))
-        return null;
-    const env = typeof value.env === 'string' ? value.env.trim() : '';
-    const keychain = typeof value.keychain === 'string' ? value.keychain.trim() : '';
-    if (env.length > 0) {
-        return { env };
-    }
-    if (keychain.length > 0) {
-        return { keychain };
-    }
-    if (value.ghCli === true) {
-        return { ghCli: true };
-    }
-    return null;
-}
-function toTokenConfig(value) {
-    if (!isRecord(value))
-        return {};
-    const tokens = {};
-    for (const [key, entry] of Object.entries(value)) {
-        if (!TOKEN_CONFIG_KEYS.has(key))
-            continue;
-        const tokenRef = toTokenRef(entry);
-        if (tokenRef) {
-            tokens[key] = tokenRef;
-        }
-    }
-    return tokens;
-}
-function toModelProviderConfig(value) {
-    if (!isRecord(value))
-        return {};
-    return Object.fromEntries(Object.entries(value).map(([providerId, providerConfig]) => [
-        providerId,
-        toProviderModelConfig(providerConfig)
-    ]));
-}
-function toProxyConfig(value) {
-    if (!isRecord(value))
-        return null;
-    return typeof value.httpProxy === 'string' && isValidProxyUrl(value.httpProxy)
-        ? { httpProxy: value.httpProxy }
-        : null;
-}
-function getProjectWriteTarget() {
-    const projectRoot = findProjectRoot(process.cwd());
-    const configPath = getProjectConfigPath(projectRoot);
-    if (!projectRoot || !configPath) {
-        throw new Error('Project config not found');
-    }
-    return { projectRoot, configPath };
-}
-export function containsSensitiveConfigValue(value) {
-    if (Array.isArray(value)) {
-        return value.some(containsSensitiveConfigValue);
-    }
-    if (value === null || typeof value !== 'object') {
-        return false;
-    }
-    return Object.entries(value).some(([key, entry]) => isSecretKey(key) || containsSensitiveConfigValue(entry));
-}
-export function redactConfigSecrets(value, path = '') {
-    if (Array.isArray(value)) {
-        return value.map((item, index) => redactConfigSecrets(item, `${path}[${index}]`));
-    }
-    if (value === null || typeof value !== 'object') {
-        if (isProviderBaseUrlPath(path) && typeof value === 'string') {
-            return sanitizeBaseUrlForDisplay(value);
-        }
-        return value;
-    }
-    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
-        const nextPath = path ? `${path}.${key}` : key;
-        if (isSecretKey(key)) {
-            return [key, '***'];
-        }
-        if (isProviderBaseUrlPath(nextPath) && typeof entry === 'string') {
-            return [key, sanitizeBaseUrlForDisplay(entry)];
-        }
-        return [key, redactConfigSecrets(entry, nextPath)];
-    }));
-}
-function inferHumanLanguage(value) {
-    const normalized = value.trim();
-    if (!normalized) {
-        throw new Error('Language must be non-empty');
-    }
-    if (/^zh(?:-|$)/i.test(normalized) || /[㐀-鿿]/u.test(normalized)) {
-        return 'zh-CN';
-    }
-    if (/^en(?:-|$)/i.test(normalized)) {
-        return 'en';
-    }
-    return 'en';
-}
-function toPeaksConfig(value) {
-    if (!isRecord(value))
-        return {};
-    const proxy = toProxyConfig(value.proxy);
-    return {
-        ...(typeof value.version === 'string' ? { version: value.version } : {}),
-        ...(typeof value.language === 'string' ? { language: value.language } : {}),
-        ...(typeof value.model === 'string' && ['haiku', 'sonnet', 'opus'].includes(value.model)
-            ? { model: value.model }
-            : {}),
-        ...(typeof value.economyMode === 'boolean' ? { economyMode: value.economyMode } : {}),
-        ...(typeof value.swarmMode === 'boolean' ? { swarmMode: value.swarmMode } : {}),
-        ...(isRecord(value.tokens) ? { tokens: toTokenConfig(value.tokens) } : {}),
-        ...(isRecord(value.providers) ? { providers: toModelProviderConfig(value.providers) } : {}),
-        ...(proxy ? { proxy } : {})
-    };
-}
 export function bootstrapProjectLanguageConfig(projectRoot, language) {
     const inferredLanguage = inferHumanLanguage(language);
     const projectPath = getProjectBootstrapConfigPath(projectRoot);
@@ -549,7 +64,7 @@ export function readConfig(projectRoot) {
     const detectedRoot = projectRoot ?? findProjectRoot(process.cwd());
     const userConfig = toPeaksConfig(readUserJsonFile());
     const projectConfig = removeProjectSensitiveConfig(toPeaksConfig(readProjectJsonFile(detectedRoot)));
-    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
+    const projectConfigWithoutProxy = omitProxy(projectConfig);
     return {
         ...DEFAULT_CONFIG,
         ...userConfig,
@@ -594,30 +109,6 @@ export function writeConfig(partial, layer = 'user') {
     const merged = sanitizeWorkspacePartial({ ...existing, ...partial });
     writeUserConfigFile(userPath, JSON.stringify(merged, null, 2));
 }
-export function getConfig(options = {}) {
-    const projectRoot = findProjectRoot(process.cwd());
-    const userConfig = readUserJsonFile() ?? {};
-    const projectConfig = removeProjectSensitiveConfig(readProjectJsonFile(projectRoot) ?? {});
-    const { proxy: projectProxy, ...projectConfigWithoutProxy } = projectConfig;
-    const source = options.layer === 'user'
-        ? userConfig
-        : options.layer === 'project'
-            ? projectConfig
-            : {
-                ...userConfig,
-                ...projectConfigWithoutProxy
-            };
-    const config = isRecord(source)
-        ? {
-            ...source,
-            ...(source.tokens !== undefined ? { tokens: toTokenConfig(source.tokens) } : {})
-        }
-        : source;
-    if (options.key !== undefined) {
-        return getNestedValue(config, options.key);
-    }
-    return config;
-}
 export function setConfig(options) {
     const layer = options.layer ?? 'user';
     if (!isConfigLayer(layer)) {
@@ -663,145 +154,5 @@ export function setConfig(options) {
         writeUserConfigFile(targetPath, content);
     }
 }
-function readRawWorkspaceData(layer) {
-    const config = getConfig({ layer });
-    return isRecord(config)
-        ? {
-            currentWorkspace: typeof config.currentWorkspace === 'string' ? config.currentWorkspace : null,
-            workspaces: toWorkspaceConfigs(config.workspaces)
-        }
-        : { currentWorkspace: null, workspaces: [] };
-}
-function writeRawWorkspaceData(data, layer) {
-    const projectTarget = layer === 'project' ? getProjectWriteTarget() : null;
-    const targetPath = projectTarget?.configPath ?? getUserConfigPath();
-    ensureDir(dirname(targetPath));
-    const existing = projectTarget
-        ? (readJsonFile(targetPath, () => validateProjectBootstrapConfigPathForWrite(projectTarget.projectRoot, targetPath)) ?? {})
-        : (readJsonFile(targetPath, () => validateUserConfigPathForWrite(targetPath)) ?? {});
-    const merged = { ...existing, ...data };
-    const content = JSON.stringify(merged, null, 2);
-    if (projectTarget) {
-        writeProjectConfigFile(projectTarget.projectRoot, targetPath, content);
-    }
-    else {
-        writeUserConfigFile(targetPath, content);
-    }
-}
-function readAllWorkspaces() {
-    const userData = readRawWorkspaceData('user');
-    const projectData = readRawWorkspaceData('project');
-    const mergedWorkspaces = new Map();
-    for (const w of userData.workspaces)
-        mergedWorkspaces.set(w.workspaceId, w);
-    for (const w of projectData.workspaces)
-        mergedWorkspaces.set(w.workspaceId, w);
-    return {
-        currentWorkspace: projectData.currentWorkspace ?? userData.currentWorkspace,
-        workspaces: [...mergedWorkspaces.values()]
-    };
-}
-export function getWorkspaceConfig(workspaceId, _projectRoot) {
-    const { workspaces } = readAllWorkspaces();
-    return workspaces.find((w) => w.workspaceId === workspaceId) ?? null;
-}
-function readLayerConfig(layer) {
-    return readRawWorkspaceData(layer);
-}
-export function addWorkspace(workspace, layer = 'user') {
-    if (!isSafeConfigSegment(workspace.workspaceId)) {
-        throw new Error('Workspace id must only contain letters, numbers, dots, underscores, or hyphens and must not contain path traversal');
-    }
-    const config = readRawWorkspaceData(layer);
-    const workspaces = config.workspaces;
-    const existing = workspaces.findIndex((w) => w.workspaceId === workspace.workspaceId);
-    const updatedWorkspaces = existing >= 0
-        ? workspaces.map((existingWorkspace) => existingWorkspace.workspaceId === workspace.workspaceId ? workspace : existingWorkspace)
-        : [...workspaces, workspace];
-    writeRawWorkspaceData({ workspaces: updatedWorkspaces }, layer);
-}
-export function removeWorkspace(workspaceId, layer = 'user') {
-    if (!isSafeConfigSegment(workspaceId))
-        return false;
-    const config = readRawWorkspaceData(layer);
-    const workspaces = config.workspaces;
-    const idx = workspaces.findIndex((w) => w.workspaceId === workspaceId);
-    if (idx < 0)
-        return false;
-    const updatedWorkspaces = workspaces.filter((w) => w.workspaceId !== workspaceId);
-    const currentWorkspace = config.currentWorkspace === workspaceId
-        ? (updatedWorkspaces[0]?.workspaceId ?? null)
-        : (config.currentWorkspace ?? null);
-    writeRawWorkspaceData({ workspaces: updatedWorkspaces, currentWorkspace }, layer);
-    return true;
-}
-export function setCurrentWorkspace(workspaceId, layer = 'user') {
-    if (!isSafeConfigSegment(workspaceId))
-        return false;
-    const config = readRawWorkspaceData(layer);
-    const workspaces = config.workspaces;
-    const exists = workspaces.some((w) => w.workspaceId === workspaceId);
-    if (!exists)
-        return false;
-    writeRawWorkspaceData({ currentWorkspace: workspaceId }, layer);
-    return true;
-}
-export function getCurrentWorkspaceConfig() {
-    const { currentWorkspace, workspaces } = readAllWorkspaces();
-    if (!currentWorkspace)
-        return null;
-    return workspaces.find((w) => w.workspaceId === currentWorkspace) ?? null;
-}
-export function getWorkspaceConfigForPath(path = process.cwd()) {
-    const { workspaces } = readAllWorkspaces();
-    return findWorkspaceForPath(workspaces, path);
-}
-function findWorkspaceForPath(workspaces, path) {
-    const targetPath = stablePath(path);
-    const matches = workspaces.flatMap((workspace) => {
-        if (!isAbsolute(workspace.rootPath) || !existsSync(workspace.rootPath))
-            return [];
-        const rootPath = stablePath(workspace.rootPath);
-        return isInsidePath(targetPath, rootPath) ? [{ workspace, rootPath }] : [];
-    });
-    if (matches.length === 0)
-        return null;
-    return matches.reduce((best, match) => match.rootPath.length > best.rootPath.length ? match : best).workspace;
-}
-function getWorkspaceArtifactRoot(workspace) {
-    return workspace.artifactStorage?.localPath
-        ? resolve(workspace.artifactStorage.localPath)
-        : resolve(workspace.rootPath, '.peaks', 'artifacts');
-}
-function ensureArtifactWorkspaceMarker(workspace) {
-    const artifactRoot = getWorkspaceArtifactRoot(workspace);
-    const peaksPath = resolve(artifactRoot, '.peaks');
-    const markerPath = resolve(peaksPath, 'config.json');
-    ensureDir(artifactRoot);
-    validateArtifactWorkspaceRoot(artifactRoot, workspace.rootPath);
-    ensureDir(peaksPath);
-    validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath);
-    if (!existsSync(markerPath)) {
-        writeConfigFileSafely(markerPath, '{}\n', () => validateArtifactWorkspaceMarkerPath(artifactRoot, peaksPath, markerPath), 'Artifact workspace marker must stay inside the artifact workspace');
-    }
-}
-export function ensureWorkspaceConfigForPath(path = process.cwd()) {
-    const projectRoot = resolveProjectRootForConfig(path);
-    if (!isAbsolute(projectRoot) || !existsSync(projectRoot))
-        return null;
-    const config = readLayerConfig('user');
-    const existingWorkspace = findWorkspaceForPath(config.workspaces, path);
-    if (existingWorkspace) {
-        ensureArtifactWorkspaceMarker(existingWorkspace);
-        return existingWorkspace;
-    }
-    return null;
-}
-export function getWorkspaceConfigForCurrentPath() {
-    return getWorkspaceConfigForPath(process.cwd());
-}
-export function ensureWorkspaceConfigForCurrentPath() {
-    return ensureWorkspaceConfigForPath(process.cwd());
-}
-export { getUserConfigPath } from './config-safety.js';
+export { getUserConfigPath };
 export { globalConfigPath } from './config-migration.js';