feat(config): gate channel config writes

src/channels/plugins/config-writes.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+
+import { resolveChannelConfigWrites } from "./config-writes.js";
+
+describe("resolveChannelConfigWrites", () => {
+  it("defaults to allow when unset", () => {
+    const cfg = {};
+    expect(resolveChannelConfigWrites({ cfg, channelId: "slack" })).toBe(true);
+  });
+
+  it("blocks when channel config disables writes", () => {
+    const cfg = { channels: { slack: { configWrites: false } } };
+    expect(resolveChannelConfigWrites({ cfg, channelId: "slack" })).toBe(false);
+  });
+
+  it("account override wins over channel default", () => {
+    const cfg = {
+      channels: {
+        slack: {
+          configWrites: true,
+          accounts: {
+            work: { configWrites: false },
+          },
+        },
+      },
+    };
+    expect(
+      resolveChannelConfigWrites({ cfg, channelId: "slack", accountId: "work" }),
+    ).toBe(false);
+  });
+
+  it("matches account ids case-insensitively", () => {
+    const cfg = {
+      channels: {
+        slack: {
+          configWrites: true,
+          accounts: {
+            Work: { configWrites: false },
+          },
+        },
+      },
+    };
+    expect(
+      resolveChannelConfigWrites({ cfg, channelId: "slack", accountId: "work" }),
+    ).toBe(false);
+  });
+});

src/channels/plugins/config-writes.ts

@@ -0,0 +1,35 @@
+import type { ClawdbotConfig } from "../../config/config.js";
+import type { ChannelId } from "./types.js";
+import { normalizeAccountId } from "../../routing/session-key.js";
+
+type ChannelConfigWithAccounts = {
+  configWrites?: boolean;
+  accounts?: Record<string, { configWrites?: boolean }>;
+};
+
+function resolveAccountConfig(
+  accounts: ChannelConfigWithAccounts["accounts"],
+  accountId: string,
+) {
+  if (!accounts || typeof accounts !== "object") return undefined;
+  if (accountId in accounts) return accounts[accountId];
+  const matchKey = Object.keys(accounts).find(
+    (key) => key.toLowerCase() === accountId.toLowerCase(),
+  );
+  return matchKey ? accounts[matchKey] : undefined;
+}
+
+export function resolveChannelConfigWrites(params: {
+  cfg: ClawdbotConfig;
+  channelId?: ChannelId | null;
+  accountId?: string | null;
+}): boolean {
+  if (!params.channelId) return true;
+  const channels = params.cfg.channels as Record<string, ChannelConfigWithAccounts> | undefined;
+  const channelConfig = channels?.[params.channelId];
+  if (!channelConfig) return true;
+  const accountId = normalizeAccountId(params.accountId);
+  const accountConfig = resolveAccountConfig(channelConfig.accounts, accountId);
+  const value = accountConfig?.configWrites ?? channelConfig.configWrites;
+  return value !== false;
+}