configs: Add support for repo-level configs for jj

This can be used to add shared configuration across a repository. For example, all users should have the same `jj fix` within a given repository.

See https://chromium-review.googlesource.com/c/chromium/src/+/6703030 for an example

Author: matts1

CHANGELOG.md

@@ -42,6 +42,13 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 * `jj fix` now buffers lines from subprocesses' stderr streams and emits them a
   complete line at a time. Each line is prepended with the file name.
 
+* Introduced an additional config layer `repo-managed` between `user` and
+  `repo`. This layer is stored in version control, and if it ever changes,
+  we recommend to the user to review the changes (for security reasons) by
+  running the new command `jj config review-managed`. This can be used to
+  create config shared between all users who use a repository (eg.
+  [fix commands](https://chromium-review.googlesource.com/c/chromium/src/+/6703030))
+
 ### Fixed bugs
 
 ### Packaging changes

cli/src/cli_util.rs

@@ -360,7 +360,9 @@ impl CommandHelper {
         let mut config_env = self.data.config_env.clone();
         let mut raw_config = self.data.raw_config.clone();
         let repo_path = workspace_root.join(".jj").join("repo");
-        config_env.reset_repo_path(&repo_path);
+        config_env.reset_repo_path(&repo_path, workspace_root);
+        // Since it's a new workspace, we don't need to bother loading the
+        // repo-managed config.
         config_env.reload_repo_config(&mut raw_config)?;
         let mut config = config_env.resolve_config(&raw_config)?;
         // No migration messages here, which would usually be emitted before.
@@ -3857,8 +3859,8 @@ impl<'a> CliRunner<'a> {
             .map_err(|err| map_workspace_load_error(err, Some(".")));
         config_env.reload_user_config(&mut raw_config)?;
         if let Ok(loader) = &maybe_cwd_workspace_loader {
-            config_env.reset_repo_path(loader.repo_path());
-            config_env.reload_repo_config(&mut raw_config)?;
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            config_env.reload_all_repo_config(ui, &mut raw_config)?;
         }
         let mut config = config_env.resolve_config(&raw_config)?;
         migrate_config(&mut config)?;
@@ -3907,8 +3909,8 @@ impl<'a> CliRunner<'a> {
                 .workspace_loader_factory
                 .create(&abs_path)
                 .map_err(|err| map_workspace_load_error(err, Some(path)))?;
-            config_env.reset_repo_path(loader.repo_path());
-            config_env.reload_repo_config(&mut raw_config)?;
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            config_env.reload_all_repo_config(ui, &mut raw_config)?;
             Ok(loader)
         } else {
             maybe_cwd_workspace_loader
@@ -3925,6 +3927,7 @@ impl<'a> CliRunner<'a> {
                 ConfigSource::Default => "default-provided",
                 ConfigSource::EnvBase | ConfigSource::EnvOverrides => "environment-provided",
                 ConfigSource::User => "user-level",
+                ConfigSource::RepoManaged => "repo-managed-level",
                 ConfigSource::Repo => "repo-level",
                 ConfigSource::CommandArg => "CLI-provided",
             };

cli/src/command_error.rs

@@ -271,6 +271,7 @@ impl From<ConfigLoadError> for CommandError {
     fn from(err: ConfigLoadError) -> Self {
         let hint = match &err {
             ConfigLoadError::Read(_) => None,
+            ConfigLoadError::Get { .. } => None,
             ConfigLoadError::Parse { source_path, .. } => source_path
                 .as_ref()
                 .map(|path| format!("Check the config file: {}", path.display())),

cli/src/commands/config/mod.rs

@@ -16,6 +16,7 @@ mod edit;
 mod get;
 mod list;
 mod path;
+mod review_managed;
 mod set;
 mod unset;
 
@@ -34,6 +35,8 @@ use self::list::cmd_config_list;
 use self::list::ConfigListArgs;
 use self::path::cmd_config_path;
 use self::path::ConfigPathArgs;
+use self::review_managed::cmd_review_managed;
+use self::review_managed::ConfigReviewManagedArgs;
 use self::set::cmd_config_set;
 use self::set::ConfigSetArgs;
 use self::unset::cmd_config_unset;
@@ -146,6 +149,8 @@ pub(crate) enum ConfigCommand {
     Set(ConfigSetArgs),
     #[command(visible_alias("u"))]
     Unset(ConfigUnsetArgs),
+    #[command()]
+    ReviewManaged(ConfigReviewManagedArgs),
 }
 
 #[instrument(skip_all)]
@@ -161,5 +166,6 @@ pub(crate) fn cmd_config(
         ConfigCommand::Path(args) => cmd_config_path(ui, command, args),
         ConfigCommand::Set(args) => cmd_config_set(ui, command, args),
         ConfigCommand::Unset(args) => cmd_config_unset(ui, command, args),
+        ConfigCommand::ReviewManaged(args) => cmd_review_managed(ui, command, args),
     }
 }

cli/src/commands/config/review_managed.rs

@@ -0,0 +1,124 @@
+// Copyright 2025 The Jujutsu Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::borrow::Borrow as _;
+use std::borrow::Cow;
+
+use tracing::instrument;
+
+use crate::cli_util::CommandHelper;
+use crate::command_error::internal_error_with_message;
+use crate::command_error::user_error;
+use crate::command_error::CommandError;
+use crate::config::maybe_read_to_string;
+use crate::merge_tools::make_diff_sections;
+use crate::ui::Ui;
+
+/// Reviews and updates configuration stored in version control.
+/// You should never need to run this command unless jj tells you to.
+#[derive(clap::Args, Clone, Debug)]
+pub struct ConfigReviewManagedArgs {
+    /// Trust the repository's config and skip review of it.
+    /// Use this when you absolutely trust the repo config (eg. you're the only
+    /// contributor).
+    #[arg(long)]
+    trust: bool,
+}
+
+#[instrument(skip_all)]
+pub fn cmd_review_managed(
+    ui: &mut Ui,
+    command: &CommandHelper,
+    args: &ConfigReviewManagedArgs,
+) -> Result<(), CommandError> {
+    if let Some(paths) = command.config_env().repo_managed_config_paths() {
+        // Treat an empty file the same as a nonexistent one.
+        let vcs = maybe_read_to_string(&paths.managed)?.unwrap_or_else(String::new);
+        let config = maybe_read_to_string(&paths.config)?.unwrap_or_else(String::new);
+
+        if vcs.is_empty() {
+            // We don't need the user to review this since it's not a security issue.
+            writeln!(
+                ui.status(),
+                "The config file has been removed from the VCS, so we have removed the local copy \
+                 too."
+            )?;
+            std::fs::remove_file(paths.config)?;
+            std::fs::remove_file(paths.last_reviewed)?;
+            return Ok(());
+        }
+
+        if config == vcs {
+            writeln!(ui.status(), "Your config file is already up to date")?;
+            return Ok(());
+        }
+
+        let new_config = if args.trust {
+            vcs.clone()
+        } else {
+            let sections = make_diff_sections(&config, &vcs)
+                .map_err(|e| internal_error_with_message("Failed to create diff sections", e))?;
+            // Ideally we'd use the user's chosen diff selector, but that
+            // heavily relies on jj's objects such as Tree and Store.
+            let recorded = scm_record::Recorder::new(
+                scm_record::RecordState {
+                    is_read_only: false,
+                    commits: vec![],
+                    files: vec![scm_record::File {
+                        old_path: None,
+                        path: std::borrow::Cow::Borrowed(&paths.managed),
+                        // This doesn't do anything.
+                        file_mode: scm_record::FileMode::Unix(0o777),
+                        sections,
+                    }],
+                },
+                &mut scm_record::helpers::CrosstermInput,
+            )
+            .run()
+            .map_err(|_| user_error("Failed to select changes"))?;
+
+            // There's always precisely one file.
+            reconstruct(&recorded.files[0].sections)
+        };
+        std::fs::write(paths.config, new_config)?;
+        std::fs::write(paths.last_reviewed, vcs)?;
+        writeln!(ui.status(), "Updated repo config file")?;
+        Ok(())
+    } else {
+        Err(user_error(
+            "Unable to detect location of config files. Are you in a repo?",
+        ))
+    }
+}
+
+fn reconstruct<'a>(sections: &[scm_record::Section<'a>]) -> String {
+    let mut out: Vec<&Cow<'a, str>> = Default::default();
+    for section in sections {
+        match section {
+            scm_record::Section::Unchanged { lines } => out.extend(lines),
+            scm_record::Section::Changed { lines } => {
+                for line in lines {
+                    if line.is_checked == (line.change_type == scm_record::ChangeType::Added) {
+                        out.push(&line.line);
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    out.into_iter()
+        .map(|s| s.borrow())
+        .collect::<Vec<&str>>()
+        .join("")
+}

cli/src/complete.rs

@@ -867,8 +867,8 @@ fn get_jj_command() -> Result<(JjBuilder, UserSettings), CommandError> {
     let maybe_cwd_workspace_loader = DefaultWorkspaceLoaderFactory.create(find_workspace_dir(&cwd));
     let _ = config_env.reload_user_config(&mut raw_config);
     if let Ok(loader) = &maybe_cwd_workspace_loader {
-        config_env.reset_repo_path(loader.repo_path());
-        let _ = config_env.reload_repo_config(&mut raw_config);
+        config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+        let _ = config_env.reload_all_repo_config(&ui, &mut raw_config);
     }
     let mut config = config_env.resolve_config(&raw_config)?;
     // skip 2 because of the clap_complete prelude: jj -- jj <actual args...>
@@ -885,8 +885,8 @@ fn get_jj_command() -> Result<(JjBuilder, UserSettings), CommandError> {
     if let Some(repository) = args.repository {
         // Try to update repo-specific config on a best-effort basis.
         if let Ok(loader) = DefaultWorkspaceLoaderFactory.create(&cwd.join(&repository)) {
-            config_env.reset_repo_path(loader.repo_path());
-            let _ = config_env.reload_repo_config(&mut raw_config);
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            let _ = config_env.reload_all_repo_config(&ui, &mut raw_config);
             if let Ok(new_config) = config_env.resolve_config(&raw_config) {
                 config = new_config;
             }