fix(config): resolve scoped config for read-only system-prompt dump

pythinker system-prompt fell back to an empty Config() whenever
~/.pythinker/config.toml was absent, silently dropping project/local scoped
settings (e.g. extra_skill_dirs) and printing an inaccurate prompt. Add a
persist=False mode to load_config/_load_scoped that runs the full user→project→
local merge with no disk side effects — no share-dir/lock creation, default
seeding, JSON→TOML migration, or auto-gitignore, and skipping the project-trust
read (trust only gates hooks, which no read-only consumer renders). The default
persist=True path is byte-for-byte unchanged. Regression test covers
no-user-config + project-config-present and asserts no config is seeded.

Author: elkaix

src/pythinker_code/cli/system_prompt.py

@@ -55,14 +55,17 @@ def system_prompt(
     """
     from pythinker_host.path import HostPath
 
-    from pythinker_code.config import Config, get_config_file, load_config
+    from pythinker_code.config import load_config
     from pythinker_code.soul.agent import render_agent_system_prompt
 
     resolved = agent_file if agent_file is not None else _resolve_agent_file(agent)
     if not resolved.exists():
         raise typer.BadParameter(f"Agent spec not found: {resolved}")
 
-    config = load_config() if get_config_file(create=False).expanduser().exists() else Config()
+    # Resolve the merged user/project/local scoped config so the dump reflects
+    # runtime behaviour even before a user config file exists. persist=False keeps
+    # the command read-only: no share-dir/lock creation, seeding, or auto-gitignore.
+    config = load_config(persist=False)
     wd = (
         HostPath.unsafe_from_local_path(work_dir.resolve())
         if work_dir is not None

src/pythinker_code/config.py

@@ -337,18 +337,26 @@ def _apply_env_vars(merged: dict[str, Any], provenance: dict[str, Any]) -> None:
             _set_nested(provenance, path, f"env {env_key}")
 
 
-def _load_scoped(project_root: Path | None) -> Config:
+def _load_scoped(project_root: Path | None, *, persist: bool = True) -> Config:
     """Run the five-step scoped config resolution pipeline.
 
     Steps: Ingest → Guard → Merge → Env → Validate.
     Returns a fully-validated Config with source_scopes populated.
+
+    When ``persist`` is False the pipeline is read-only: it merges the same
+    user/project/local scopes but performs no disk writes (no share-dir/lock
+    creation, no migration, no default seeding, no auto-gitignore) and skips the
+    project-trust read (which itself creates the trust-lock file). Trust only
+    gates project *hooks*, which no read-only consumer renders or executes, so
+    skipping it leaves the merged config faithful for those callers.
     """
     from pythinker_code.utils.gitignore import ensure_gitignored
 
     # ── INGEST ────────────────────────────────────────────────────────────
-    default_user_file = get_config_file().expanduser().resolve(strict=False)
+    # When read-only, do not let get_config_file() create the share dir.
+    default_user_file = get_config_file(create=persist).expanduser().resolve(strict=False)
     # Trigger JSON→TOML migration if needed (existing logic)
-    if not default_user_file.exists():
+    if persist and not default_user_file.exists():
         migration_error = _migrate_json_config_to_toml()
         if migration_error is not None:
             raise ConfigError(
@@ -371,7 +379,7 @@ def _read_toml(path: Path) -> dict[str, Any]:
     # If the user config file still doesn't exist after migration (e.g. corrupt JSON
     # was backed up but no TOML was written), seed it with defaults so subsequent
     # runs have a concrete starting point — matching the legacy single-file behaviour.
-    if not user_file.exists():
+    if persist and not user_file.exists():
         default_cfg = get_default_config()
         logger.debug("No config file found, creating default config: {config}", config=default_cfg)
         save_config(default_cfg, user_file)
@@ -384,11 +392,18 @@ def _read_toml(path: Path) -> dict[str, Any]:
     stripped_hook_files: list[str] = []
 
     if project_root is not None:
-        from pythinker_code.project_trust import is_project_trusted
-
-        project_trusted = is_project_trusted(project_root)
         project_file = project_root / ".pythinker" / "config.toml"
         local_file = project_root / ".pythinker" / "config.local.toml"
+        if persist:
+            from pythinker_code.project_trust import is_project_trusted
+
+            project_trusted = is_project_trusted(project_root)
+        else:
+            # Read-only callers skip the trust read — it creates the trust-lock
+            # file under the share dir. Trust only gates project hooks, which a
+            # read-only consumer never executes, so read every scope and leave any
+            # hooks merged-but-inert rather than touching disk.
+            project_trusted = True
         if project_trusted:
             project_dict = _read_toml(project_file)
             local_dict = _read_toml(local_file)
@@ -464,12 +479,14 @@ def _read_toml(path: Path) -> dict[str, Any]:
         config.source_scopes["project"] = project_file.resolve(strict=False)
     if local_file is not None and local_file.exists():
         config.source_scopes["local"] = local_file.resolve(strict=False)
-        # Auto-gitignore local config so it is never accidentally committed
-        ensure_gitignored(
-            project_root,  # type: ignore[arg-type]
-            ".pythinker/config.local.toml",
-            comment="Added by pythinker",
-        )
+        # Auto-gitignore local config so it is never accidentally committed.
+        # Skip this write for read-only callers.
+        if persist:
+            ensure_gitignored(
+                project_root,  # type: ignore[arg-type]
+                ".pythinker/config.local.toml",
+                comment="Added by pythinker",
+            )
 
     return config
 
@@ -1235,7 +1252,7 @@ def get_default_config() -> Config:
     )
 
 
-def load_config(config_file: Path | None = None) -> Config:
+def load_config(config_file: Path | None = None, *, persist: bool = True) -> Config:
     """Load configuration, resolving up to three scopes when no explicit file is given.
 
     When *config_file* is None (the default), the scoped pipeline runs:
@@ -1245,10 +1262,16 @@ def load_config(config_file: Path | None = None) -> Config:
     When *config_file* is given explicitly (e.g. via --config), that single
     file is loaded directly with no scope resolution — preserving the legacy
     behaviour used by tests and the CLI --config flag.
+
+    Pass ``persist=False`` for read-only callers (e.g. ``pythinker system-prompt``)
+    that must resolve the merged scoped config without any disk side effects:
+    no share-dir creation, no default-config seeding, no JSON→TOML migration,
+    no project-trust lock, and no auto-gitignore. Only the scoped (``config_file
+    is None``) branch honours the flag; an explicit path is already read-or-seed.
     """
     if config_file is None:
         project_root = find_project_root(Path.cwd())
-        return _load_scoped(project_root)
+        return _load_scoped(project_root, persist=persist)
 
     # ── Explicit path: legacy single-file load (unchanged) ────────────────
     default_config_file = get_config_file().expanduser().resolve(strict=False)

tests/cli/test_system_prompt_cli.py

@@ -2,6 +2,9 @@
 
 from __future__ import annotations
 
+from pathlib import Path
+from typing import Any
+
 import pytest
 import typer
 
@@ -23,3 +26,66 @@ def test_resolve_builtin_role_agent() -> None:
 def test_resolve_unknown_agent_raises() -> None:
     with pytest.raises(typer.BadParameter):
         _resolve_agent_file("does-not-exist-xyz")
+
+
+def test_system_prompt_uses_project_config_without_user_config(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Regression: system-prompt must merge project-scoped config even when no
+    user config file exists, and must not create the user config as a side effect.
+
+    Old behaviour: fell back to a bare ``Config()`` when ``~/.pythinker/config.toml``
+    was absent, so project-scoped values (e.g. ``extra_skill_dirs``) were silently
+    dropped.  Fix: calls ``load_config(persist=False)`` which runs the full
+    user+project+local merge pipeline read-only.
+    """
+    # ── project dir with a .git marker so find_project_root() resolves ──────
+    project = tmp_path / "proj"
+    project.mkdir()
+    (project / ".git").mkdir()
+    pythinker_dir = project / ".pythinker"
+    pythinker_dir.mkdir()
+    (pythinker_dir / "config.toml").write_text(
+        'extra_skill_dirs = ["/tmp/proj-only-skill-dir"]\n', encoding="utf-8"
+    )
+
+    # ── chdir into the project so load_config() picks up the project scope ──
+    monkeypatch.chdir(project)
+
+    # ── the autouse _isolate_share_dir fixture points PYTHINKER_SHARE_DIR at
+    #    a fresh empty tmp dir, so no user config.toml exists there ──────────
+
+    # ── spy: replace render_agent_system_prompt with an async stub that
+    #    records the config arg.  Patch the source module because the CLI
+    #    imports it lazily inside the callback. ────────────────────────────────
+    captured: dict[str, Any] = {}
+
+    async def _spy_render(agent_file: Path, work_dir: Any, config: Any) -> str:
+        captured["config"] = config
+        return "STUBBED PROMPT"
+
+    monkeypatch.setattr(
+        "pythinker_code.soul.agent.render_agent_system_prompt",
+        _spy_render,
+    )
+
+    # ── invoke the CLI callback directly (matches existing file style) ───────
+    from pythinker_code.cli.system_prompt import system_prompt
+
+    system_prompt(agent_file=DEFAULT_AGENT_FILE, work_dir=project)
+
+    # ── the spy must have been called ────────────────────────────────────────
+    assert "config" in captured, "render_agent_system_prompt was never called"
+
+    # ── project-scoped value must be present in the resolved config ──────────
+    # On the old Config() fallback extra_skill_dirs == [] (default), so this fails.
+    assert captured["config"].extra_skill_dirs == ["/tmp/proj-only-skill-dir"]
+
+    # ── project scope must appear in source_scopes (further proof of merge) ──
+    assert "project" in captured["config"].source_scopes
+
+    # ── no user config.toml must have been seeded as a side effect ───────────
+    from pythinker_code.config import get_config_file
+
+    assert not get_config_file(create=False).expanduser().resolve(strict=False).exists()