golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(#2046): config-set <key> null unsets (removes) the key instead of writing "null"

Browse Source 
`gsd-tools config-set <key> null` — the "Clear" action documented in
settings-integrations.md / settings-advanced.md — previously fell through the
value parser as the literal STRING "null" and persisted it. Consequences:
"cleared" keys stayed set (config-get returned truthy "null"), and for secret
keys (brave_search/firecrawl/exa_search) a masked success line hid a truthy
4-char value on disk that integrations could pass along as a real credential.
There was also no unset/delete verb at all.

Fix: parse a bare `null` to JS null and short-circuit to a real UNSET that
DELETES the key from config.json — the semantic the docs already describe
("Remove the stored key" / "remove the key by setting it to null"). Deleting
(not persisting JSON null) is the correct clear: a persisted null is still a
present value consumers must special-case.

- src/config.cts:
  - parse block: `else if (val === 'null') parsedValue = null;`
  - cmdConfigSet: when parsedValue === null, short-circuit BEFORE the typed
    per-key validator gauntlet (so clearing an enum/boolean/number key removes
    it rather than being rejected) and before the project_code special-case;
    mask the previous value for secret keys in the output.
  - new `unsetConfigValue()` + `_unsetNestedValue()` mirroring setConfigValue/
    _setNestedValue: same prototype-pollution guard, but never creates missing
    intermediates and never prunes empty parents; returns { previousValue,
    existed }. Unsetting a never-set key is an idempotent no-op success.
- tests/config.test.cjs: new suite covering non-secret routing key, secret key,
  typed-enum-key bypass (context), idempotent unset, literal-"null"-on-disk
  guard, the unset-path prototype-pollution guard (alert #26 parity), and a
  4-segment deep-nested unset.
- tests/review-model-config.test.cjs: update the stale round-trip test that
  codified the bug (asserted config-set null → config-get returns "null") to the
  fixed contract — the model key is removed; the review workflow's
  `[ -n "$VAR" ] && [ "$VAR" != "null" ]` guard handles the empty read as
  "no override → reviewer default", same as the old "null" sentinel.

The 4 documented "Clear" flows (settings-integrations.md, settings-advanced.md)
were verified — their prose already describes removal, so the fix makes them
accurate rather than aspirational; no doc wording change required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-07-07 09:01:53 -04:00
parent a3b9cbaeb8
commit dd21bb7451
4 changed files with 276 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

125
tests/config.test.cjs
View File

@@ -747,6 +747,131 @@ describe('config-set — no silent coercion (#1581)', () => {
});
});
// ─── config-set <key> null — unset/clear (#2046) ─────────────────────────────
describe('config-set <key> null — unset/clear (#2046)', () => {
let tmpDir;
beforeEach(() => { tmpDir = createTempProject(); });
afterEach(() => { cleanup(tmpDir); });
test('non-secret routing key: config-set <key> null removes the key (not the string "null")', () => {
const setResult = runGsdTools('config-set review.models.gemini foo', tmpDir);
assert.ok(setResult.success, `Command failed: ${setResult.error}`);
assert.strictEqual(readConfig(tmpDir).review.models.gemini, 'foo');
const unsetResult = runGsdTools('config-set review.models.gemini null', tmpDir);
assert.ok(unsetResult.success, `Command failed: ${unsetResult.error}`);
const config = readConfig(tmpDir);
assert.ok(
!config.review || !config.review.models || !Object.prototype.hasOwnProperty.call(config.review.models, 'gemini'),
'review.models.gemini must be absent on disk after unset, not the string "null"'
);
const getResult = runGsdTools('config-get review.models.gemini', tmpDir);
assert.ok(
!getResult.output || !getResult.output.trim() || getResult.output.trim() === 'undefined',
`config-get should return empty/undefined after unset, got: ${getResult.output}`
);
assert.notStrictEqual(getResult.output && getResult.output.trim(), 'null');
});
test('secret key: config-set brave_search null removes the key (never persists "null")', () => {
const setResult = runGsdTools('config-set brave_search sk-test-1234', tmpDir);
assert.ok(setResult.success, `Command failed: ${setResult.error}`);
assert.strictEqual(readConfig(tmpDir).brave_search, 'sk-test-1234');
const unsetResult = runGsdTools('config-set brave_search null', tmpDir);
assert.ok(unsetResult.success, `Command failed: ${unsetResult.error}`);
const configPath = path.join(tmpDir, '.planning', 'config.json');
const rawText = fs.readFileSync(configPath, 'utf-8');
const config = JSON.parse(rawText);
assert.ok(
!Object.prototype.hasOwnProperty.call(config, 'brave_search'),
'brave_search must be absent on disk after unset'
);
assert.doesNotMatch(rawText, /"brave_search":\s*"null"/,
'raw config.json must never contain brave_search mapped to the literal string "null"');
});
test('typed-key bypass: config-set context null clears an enum-typed key without validator rejection', () => {
const setResult = runGsdTools('config-set context dev', tmpDir);
assert.ok(setResult.success, `Command failed: ${setResult.error}`);
assert.strictEqual(readConfig(tmpDir).context, 'dev');
const unsetResult = runGsdTools('config-set context null', tmpDir);
assert.ok(unsetResult.success, `config-set context null must succeed (bypass enum validator), got error: ${unsetResult.error}`);
const config = readConfig(tmpDir);
assert.ok(!Object.prototype.hasOwnProperty.call(config, 'context'),
'context key must be removed after unset');
});
test('idempotent: config-set <never-set key> null succeeds with no crash and no key written', () => {
const result = runGsdTools('config-set git.base_branch null', tmpDir);
assert.ok(result.success, `Command failed: ${result.error}`);
const config = readConfig(tmpDir);
assert.ok(
!config.git || !Object.prototype.hasOwnProperty.call(config.git, 'base_branch'),
'git.base_branch must not be present after unsetting a key that was never set'
);
});
test('literal-"null" guard: no config-set <key> null ever persists the literal string "null" on disk', () => {
runGsdTools('config-set review.models.gemini foo', tmpDir);
runGsdTools('config-set review.models.gemini null', tmpDir);
runGsdTools('config-set brave_search sk-test-1234', tmpDir);
runGsdTools('config-set brave_search null', tmpDir);
runGsdTools('config-set context dev', tmpDir);
runGsdTools('config-set context null', tmpDir);
const configPath = path.join(tmpDir, '.planning', 'config.json');
const rawText = fs.readFileSync(configPath, 'utf-8');
assert.doesNotMatch(rawText, /:\s*"null"/,
`config.json must never contain a key mapped to the literal string "null": ${rawText}`);
});
test('prototype-pollution guard: unsetting a __proto__ leaf is rejected, no pollution (alert #26 parity)', () => {
// Create the intermediate so the unset walk reaches the leaf guard (a bare
// dynamic-prefix key passes the schema gate, so this exercises the
// _unsetNestedValue guard, not the schema gate — mirrors the set-path test).
const seed = runGsdTools('config-set agent_skills.sonnet-coder true', tmpDir);
assert.ok(seed.success, `seed failed: ${seed.error}`);
const result = runGsdTools('config-set agent_skills.__proto__ null', tmpDir);
assert.strictEqual(result.success, false, `Expected rejection, got: ${result.output}`);
assert.ok(
result.error.includes('prototype pollution guard'),
`Expected pollution-guard error, got: ${result.error}`,
);
// No prototype pollution occurred via the unset path.
assert.strictEqual(({}).polluted, undefined);
assert.strictEqual(Object.prototype.hasOwnProperty.call(Object.prototype, 'polluted'), false);
});
test('deep (4-segment) nested key: config-set <deep> null removes only the leaf', () => {
const set = runGsdTools('config-set review.reviewer_instances.myinst.model some-model', tmpDir);
assert.ok(set.success, `deep set failed: ${set.error}`);
assert.strictEqual(readConfig(tmpDir).review.reviewer_instances.myinst.model, 'some-model');
const unset = runGsdTools('config-set review.reviewer_instances.myinst.model null', tmpDir);
assert.ok(unset.success, `deep unset failed: ${unset.error}`);
const config = readConfig(tmpDir);
assert.ok(
!config.review.reviewer_instances.myinst ||
!Object.prototype.hasOwnProperty.call(config.review.reviewer_instances.myinst, 'model'),
'the leaf model key must be removed',
);
// Parent objects along the path are preserved (unset removes only the leaf).
assert.ok(config.review && config.review.reviewer_instances,
'parent objects on the path must remain after leaf unset');
});
});
// ─── config-set (research_before_questions and discuss_mode) ──────────────────
describe('config-set research_before_questions and discuss_mode', () => {