feat: add system-wide config file support

docs/content/config.md

@@ -43,6 +43,8 @@ wt config show
 | **User config** | `~/.config/worktrunk/config.toml` | Worktree path template, LLM commit configs, etc | ✗ |
 | **Project config** | `.config/wt.toml` | Project hooks, dev server URL | ✓ |
 
+Organizations can also deploy a system-wide config file for shared defaults — run `wt config show` for the platform-specific location.
+
 **User config** — personal preferences:
 
 ```toml
@@ -353,6 +355,8 @@ WORKTRUNK_COMMIT__GENERATION__COMMAND="echo 'test: automated commit'" wt merge
 |----------|---------|
 | `WORKTRUNK_BIN` | Override binary path for shell wrappers (useful for testing dev builds) |
 | `WORKTRUNK_CONFIG_PATH` | Override user config file location |
+| `WORKTRUNK_SYSTEM_CONFIG_PATH` | Override system config file location |
+| `XDG_CONFIG_DIRS` | Colon-separated system config directories (default: `/etc/xdg`) |
 | `WORKTRUNK_DIRECTIVE_FILE` | Internal: set by shell wrappers to enable directory changes |
 | `WORKTRUNK_SHELL` | Internal: set by shell wrappers to indicate shell type (e.g., `powershell`) |
 | `WORKTRUNK_MAX_CONCURRENT_COMMANDS` | Max parallel git commands (default: 32). Lower if hitting file descriptor limits. |
@@ -396,7 +400,7 @@ Usage: <b><span class=c>wt config</span></b> <span class=c>[OPTIONS]</span> <spa
 Show configuration files & locations.
 
 Shows location and contents of user config (`~/.config/worktrunk/config.toml`)
-and project config (`.config/wt.toml`).
+and project config (`.config/wt.toml`). Also shows system config if present.
 
 If a config file doesn't exist, shows defaults that would be used.
 

skills/worktrunk/reference/config.md

@@ -35,6 +35,8 @@ wt config show
 | **User config** | `~/.config/worktrunk/config.toml` | Worktree path template, LLM commit configs, etc | ✗ |
 | **Project config** | `.config/wt.toml` | Project hooks, dev server URL | ✓ |
 
+Organizations can also deploy a system-wide config file for shared defaults — run `wt config show` for the platform-specific location.
+
 **User config** — personal preferences:
 
 ```toml
@@ -345,6 +347,8 @@ WORKTRUNK_COMMIT__GENERATION__COMMAND="echo 'test: automated commit'" wt merge
 |----------|---------|
 | `WORKTRUNK_BIN` | Override binary path for shell wrappers (useful for testing dev builds) |
 | `WORKTRUNK_CONFIG_PATH` | Override user config file location |
+| `WORKTRUNK_SYSTEM_CONFIG_PATH` | Override system config file location |
+| `XDG_CONFIG_DIRS` | Colon-separated system config directories (default: `/etc/xdg`) |
 | `WORKTRUNK_DIRECTIVE_FILE` | Internal: set by shell wrappers to enable directory changes |
 | `WORKTRUNK_SHELL` | Internal: set by shell wrappers to indicate shell type (e.g., `powershell`) |
 | `WORKTRUNK_MAX_CONCURRENT_COMMANDS` | Max parallel git commands (default: 32). Lower if hitting file descriptor limits. |
@@ -386,7 +390,7 @@ Usage: <b><span class=c>wt config</span></b> <span class=c>[OPTIONS]</span> <spa
 Show configuration files & locations.
 
 Shows location and contents of user config (`~/.config/worktrunk/config.toml`)
-and project config (`.config/wt.toml`).
+and project config (`.config/wt.toml`). Also shows system config if present.
 
 If a config file doesn't exist, shows defaults that would be used.
 

src/cli/config.rs

@@ -213,7 +213,7 @@ pub enum ConfigCommand {
     /// Show configuration files & locations
     #[command(
         after_long_help = r#"Shows location and contents of user config (`~/.config/worktrunk/config.toml`)
-and project config (`.config/wt.toml`).
+and project config (`.config/wt.toml`). Also shows system config if present.
 
 If a config file doesn't exist, shows defaults that would be used.
 

src/cli/mod.rs

@@ -1487,6 +1487,8 @@ wt config show
 | **User config** | `~/.config/worktrunk/config.toml` | Worktree path template, LLM commit configs, etc | ✗ |
 | **Project config** | `.config/wt.toml` | Project hooks, dev server URL | ✓ |
 
+Organizations can also deploy a system-wide config file for shared defaults — run `wt config show` for the platform-specific location.
+
 **User config** — personal preferences:
 
 ```toml
@@ -1797,6 +1799,8 @@ WORKTRUNK_COMMIT__GENERATION__COMMAND="echo 'test: automated commit'" wt merge
 |----------|---------|
 | `WORKTRUNK_BIN` | Override binary path for shell wrappers (useful for testing dev builds) |
 | `WORKTRUNK_CONFIG_PATH` | Override user config file location |
+| `WORKTRUNK_SYSTEM_CONFIG_PATH` | Override system config file location |
+| `XDG_CONFIG_DIRS` | Colon-separated system config directories (default: `/etc/xdg`) |
 | `WORKTRUNK_DIRECTIVE_FILE` | Internal: set by shell wrappers to enable directory changes |
 | `WORKTRUNK_SHELL` | Internal: set by shell wrappers to indicate shell type (e.g., `powershell`) |
 | `WORKTRUNK_MAX_CONCURRENT_COMMANDS` | Max parallel git commands (default: 32). Lower if hitting file descriptor limits. |

src/commands/config/show.rs

@@ -10,7 +10,8 @@ use std::path::PathBuf;
 use anyhow::Context;
 use color_print::cformat;
 use worktrunk::config::{
-    ProjectConfig, UserConfig, find_unknown_project_keys, find_unknown_user_keys,
+    ProjectConfig, UserConfig, default_system_config_path, find_unknown_project_keys,
+    find_unknown_user_keys, get_system_config_path,
 };
 use worktrunk::git::Repository;
 use worktrunk::path::format_path_for_display;
@@ -34,8 +35,14 @@ pub fn handle_config_show(full: bool) -> anyhow::Result<()> {
     // Build the complete output as a string
     let mut show_output = String::new();
 
+    // Render system config section (only when a system config file exists)
+    let has_system_config = render_system_config(&mut show_output)?;
+    if has_system_config {
+        show_output.push('\n');
+    }
+
     // Render user config
-    render_user_config(&mut show_output)?;
+    render_user_config(&mut show_output, has_system_config)?;
     show_output.push('\n');
 
     // Render project config if in a git repository
@@ -340,7 +347,48 @@ fn render_diagnostics(out: &mut String) -> anyhow::Result<()> {
     Ok(())
 }
 
-fn render_user_config(out: &mut String) -> anyhow::Result<()> {
+/// Render the SYSTEM CONFIG section. Returns true if a system config file was found.
+fn render_system_config(out: &mut String) -> anyhow::Result<bool> {
+    let Some(system_path) = get_system_config_path() else {
+        return Ok(false);
+    };
+
+    writeln!(
+        out,
+        "{}",
+        format_heading(
+            "SYSTEM CONFIG",
+            Some(&format_path_for_display(&system_path))
+        )
+    )?;
+
+    // Read and display the file contents
+    let contents =
+        std::fs::read_to_string(&system_path).context("Failed to read system config file")?;
+
+    if contents.trim().is_empty() {
+        writeln!(out, "{}", hint_message("Empty file (no system defaults)"))?;
+        return Ok(true);
+    }
+
+    // Validate config (syntax + schema) and warn if invalid
+    if let Err(e) = toml::from_str::<UserConfig>(&contents) {
+        writeln!(out, "{}", error_message("Invalid config"))?;
+        writeln!(out, "{}", format_with_gutter(&e.to_string(), None))?;
+    } else {
+        // Only check for unknown keys if config is valid
+        out.push_str(&warn_unknown_keys::<UserConfig>(&find_unknown_user_keys(
+            &contents,
+        )));
+    }
+
+    // Display TOML with syntax highlighting
+    writeln!(out, "{}", format_toml(&contents))?;
+
+    Ok(true)
+}
+
+fn render_user_config(out: &mut String, has_system_config: bool) -> anyhow::Result<()> {
     let config_path = require_user_config_path()?;
 
     writeln!(
@@ -406,6 +454,24 @@ fn render_user_config(out: &mut String) -> anyhow::Result<()> {
     // Display TOML with syntax highlighting (gutter at column 0)
     writeln!(out, "{}", format_toml(&contents))?;
 
+    if !has_system_config {
+        render_system_config_hint(out)?;
+    }
+
+    Ok(())
+}
+
+fn render_system_config_hint(out: &mut String) -> anyhow::Result<()> {
+    if let Some(path) = default_system_config_path() {
+        writeln!(
+            out,
+            "{}",
+            hint_message(cformat!(
+                "Optional system config not found @ <dim>{}</>",
+                format_path_for_display(&path)
+            ))
+        )?;
+    }
     Ok(())
 }
 

src/config/mod.rs

@@ -1,17 +1,15 @@
 //! Configuration system for worktrunk
 //!
-//! Worktrunk uses two independent configuration files:
+//! Three configuration sources, loaded in order (later overrides earlier):
 //!
-//! - **User config** (`~/.config/worktrunk/config.toml`) - Personal preferences
-//! - **Project config** (`.config/wt.toml`) - Lifecycle hooks, checked into git
+//! 1. **System config** (`/etc/xdg/worktrunk/config.toml` or platform equivalent) -
+//!    Organization-wide defaults, optional
+//! 2. **User config** (`~/.config/worktrunk/config.toml`) - Personal preferences
+//! 3. **Project config** (`.config/wt.toml`) - Lifecycle hooks, checked into git
 //!
-//! The two configs are **completely independent**:
-//! - No overlap in settings (they configure different things)
-//! - No merging or precedence rules needed
-//! - Loaded separately and used in different contexts
-//!
-//! User config controls "how worktrunk behaves for me", project config controls
-//! "what commands run for this project".
+//! System and user configs share the same schema and are merged by the `config`
+//! crate's builder (user values override system values at the key level).
+//! Project config is independent — different schema, different purpose.
 //!
 //! See `wt config --help` for complete documentation.
 
@@ -96,7 +94,8 @@ pub use project::{
 pub use user::{
     CommitConfig, CommitGenerationConfig, ListConfig, MergeConfig, OverridableConfig,
     ResolvedConfig, SelectConfig, StageMode, UserConfig, UserProjectOverrides,
-    find_unknown_keys as find_unknown_user_keys, get_config_path, set_config_path,
+    default_system_config_path, find_unknown_keys as find_unknown_user_keys, get_config_path,
+    get_system_config_path, set_config_path,
 };
 
 #[cfg(test)]

src/config/user/mod.rs

@@ -19,7 +19,9 @@ use serde::{Deserialize, Serialize};
 
 // Re-export public types
 pub use merge::Merge;
-pub use path::{get_config_path, set_config_path};
+pub use path::{
+    default_system_config_path, get_config_path, get_system_config_path, set_config_path,
+};
 pub use resolved::ResolvedConfig;
 pub use schema::{find_unknown_keys, valid_user_config_keys};
 pub use sections::{
@@ -106,19 +108,39 @@ pub struct UserConfig {
 }
 
 impl UserConfig {
-    /// Load configuration from config file and environment variables.
+    /// Load configuration from system config, user config, and environment variables.
     ///
     /// Configuration is loaded in the following order (later sources override earlier ones):
     /// 1. Default values
-    /// 2. Config file (see struct documentation for platform-specific paths)
-    /// 3. Environment variables (WORKTRUNK_*)
+    /// 2. System config (organization-wide defaults)
+    /// 3. User config file (personal preferences)
+    /// 4. Environment variables (WORKTRUNK_*)
     pub fn load() -> Result<Self, ConfigError> {
         // Note: worktree-path has no default set here - it's handled by the getter
         // which returns the default when None. This allows us to distinguish
         // "user explicitly set this" from "using default".
         let mut builder = Config::builder();
 
-        // Add config file if it exists
+        // Add system config if it exists (lowest priority file source)
+        if let Some(system_path) = path::get_system_config_path() {
+            if let Ok(content) = std::fs::read_to_string(&system_path) {
+                // Warn about unknown fields in system config
+                let unknown_keys: std::collections::HashMap<_, _> = find_unknown_keys(&content)
+                    .into_iter()
+                    .filter(|(k, _)| {
+                        !super::deprecation::DEPRECATED_SECTION_KEYS.contains(&k.as_str())
+                    })
+                    .collect();
+                super::deprecation::warn_unknown_fields::<UserConfig>(
+                    &system_path,
+                    &unknown_keys,
+                    "System config",
+                );
+            }
+            builder = builder.add_source(File::from(system_path));
+        }
+
+        // Add user config file if it exists (overrides system config)
         let config_path = get_config_path();
         if let Some(config_path) = config_path.as_ref()
             && config_path.exists()