UAT: `agents config set --scope project/local` does not enforce `project_scopable` constraint #3806

New issue

Open

opened 2026-04-06 06:29:41 +00:00 by freemo · 0 comments

freemo commented

2026-04-06 06:29:41 +00:00

Owner

Background and Context

The agents config set command with --scope project or --scope local does not validate whether the configuration key is marked as project_scopable=True in the registry. This allows users to write non-project-scopable keys (e.g., core.log.level, core.data-dir, core.format) to project-scoped or local-scoped config files, violating the spec's intent.

The legacy --project flag path correctly validates project_scopable:

if project is not None:
    if not entry.project_scopable:
        raise typer.BadParameter(f"Key '{normalized}' is not project-scopable.")

However, the new three-scope --scope flag path in config_set() (around line 230–260 of src/cleveragents/cli/commands/config.py) is missing this check entirely:

elif config_scope is not None:
    # New three-scope set (--scope flag)
    # MISSING: check for entry.project_scopable when scope is PROJECT or LOCAL
    if config_scope == ConfigScope.GLOBAL:
        previous = config_data.get(normalized)
    elif config_scope == ConfigScope.PROJECT:
        previous = svc.read_project_config().get(normalized)
    else:
        previous = svc.read_local_config().get(normalized)
    svc.set_value(normalized, coerced, scope=config_scope)

Current Behavior

agents config set core.log.level DEBUG --scope project succeeds silently, writing the non-project-scopable key to the project config file. No error is raised.

Expected Behavior

Per the specification, configuration keys marked project_scopable=False in the registry must only be settable at the global scope. Attempting to set them with --scope project or --scope local should fail with:

Error: Key 'core.log.level' is not project-scopable.

Steps to Reproduce

# core.log.level is NOT project-scopable (project_scopable=False)
agents config set core.log.level DEBUG --scope project
# Expected: Error "Key 'core.log.level' is not project-scopable."
# Actual:   Success — key is written to project config file

Impact

Users can accidentally write global-only settings to project config files.
These settings are silently ignored during resolution (since the key is not project-scopable, the project-level value is never used).
Creates confusing behaviour: the config file contains a key that has no effect.

Proposed Fix

Add a project_scopable guard in the --scope path of config_set():

elif config_scope is not None:
    if config_scope in (ConfigScope.PROJECT, ConfigScope.LOCAL) and not entry.project_scopable:
        raise typer.BadParameter(f"Key '{normalized}' is not project-scopable.")
    # ... rest of the code

Backlog note: This issue was discovered during autonomous operation
on milestone v3.4.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Metadata

Branch: fix/config-set-scope-project-scopable-validation
Commit Message: fix(cli): enforce project_scopable constraint in config set --scope path
Milestone: (backlog — no milestone assigned)
Parent Epic: #397

Subtasks

Add project_scopable guard in the --scope path of config_set() in src/cleveragents/cli/commands/config.py
Ensure parity between the legacy --project flag path and the new --scope flag path for this validation
Tests (Behave): Add scenario — config set <non-project-scopable-key> --scope project raises BadParameter
Tests (Behave): Add scenario — config set <non-project-scopable-key> --scope local raises BadParameter
Tests (Behave): Add scenario — config set <non-project-scopable-key> --scope global succeeds
Tests (Robot): Add integration test verifying the error message is surfaced correctly via CLI
Verify coverage >= 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-uat-tester

## Background and Context The `agents config set` command with `--scope project` or `--scope local` does not validate whether the configuration key is marked as `project_scopable=True` in the registry. This allows users to write non-project-scopable keys (e.g., `core.log.level`, `core.data-dir`, `core.format`) to project-scoped or local-scoped config files, violating the spec's intent. The legacy `--project` flag path **correctly** validates `project_scopable`: ```python if project is not None: if not entry.project_scopable: raise typer.BadParameter(f"Key '{normalized}' is not project-scopable.") ``` However, the new three-scope `--scope` flag path in `config_set()` (around line 230–260 of `src/cleveragents/cli/commands/config.py`) is **missing** this check entirely: ```python elif config_scope is not None: # New three-scope set (--scope flag) # MISSING: check for entry.project_scopable when scope is PROJECT or LOCAL if config_scope == ConfigScope.GLOBAL: previous = config_data.get(normalized) elif config_scope == ConfigScope.PROJECT: previous = svc.read_project_config().get(normalized) else: previous = svc.read_local_config().get(normalized) svc.set_value(normalized, coerced, scope=config_scope) ``` ## Current Behavior `agents config set core.log.level DEBUG --scope project` succeeds silently, writing the non-project-scopable key to the project config file. No error is raised. ## Expected Behavior Per the specification, configuration keys marked `project_scopable=False` in the registry must only be settable at the global scope. Attempting to set them with `--scope project` or `--scope local` should fail with: ``` Error: Key 'core.log.level' is not project-scopable. ``` ## Steps to Reproduce ```bash # core.log.level is NOT project-scopable (project_scopable=False) agents config set core.log.level DEBUG --scope project # Expected: Error "Key 'core.log.level' is not project-scopable." # Actual: Success — key is written to project config file ``` ## Impact - Users can accidentally write global-only settings to project config files. - These settings are silently ignored during resolution (since the key is not project-scopable, the project-level value is never used). - Creates confusing behaviour: the config file contains a key that has no effect. ## Proposed Fix Add a `project_scopable` guard in the `--scope` path of `config_set()`: ```python elif config_scope is not None: if config_scope in (ConfigScope.PROJECT, ConfigScope.LOCAL) and not entry.project_scopable: raise typer.BadParameter(f"Key '{normalized}' is not project-scopable.") # ... rest of the code ``` --- > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.4.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Metadata - **Branch**: `fix/config-set-scope-project-scopable-validation` - **Commit Message**: `fix(cli): enforce project_scopable constraint in config set --scope path` - **Milestone**: *(backlog — no milestone assigned)* - **Parent Epic**: #397 ## Subtasks - [ ] Add `project_scopable` guard in the `--scope` path of `config_set()` in `src/cleveragents/cli/commands/config.py` - [ ] Ensure parity between the legacy `--project` flag path and the new `--scope` flag path for this validation - [ ] Tests (Behave): Add scenario — `config set <non-project-scopable-key> --scope project` raises `BadParameter` - [ ] Tests (Behave): Add scenario — `config set <non-project-scopable-key> --scope local` raises `BadParameter` - [ ] Tests (Behave): Add scenario — `config set <non-project-scopable-key> --scope global` succeeds - [ ] Tests (Robot): Add integration test verifying the error message is surfaced correctly via CLI - [ ] Verify coverage >= 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-uat-tester

freemo added a new dependency

2026-04-06 06:29:54 +00:00

#397 Epic: Server & Autonomy Infrastructure

freemo added the

Points

label

2026-04-06 06:35:58 +00:00

freemo referenced this issue

2026-04-06 07:00:43 +00:00

[Automated] CleverAgents Build Session - 2026-04-06 #3775

freemo referenced this issue

2026-04-06 07:04:26 +00:00