configs: Add support for repo-level configs for jj

This can be used to add shared configuration across a repository. For example, all users should have the same `jj fix` within a given repository.

See https://chromium-review.googlesource.com/c/chromium/src/+/6703030 for an example

Author: matts1

CHANGELOG.md

@@ -42,6 +42,13 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 * `jj fix` now buffers lines from subprocesses' stderr streams and emits them a
   complete line at a time. Each line is prepended with the file name.
 
+* Introduced an additional config layer `repo-managed` between `user` and
+  `repo`. This layer is stored in version control, and if it ever changes,
+  we recommend to the user to review the changes (for security reasons) by
+  running `jj config review-managed`. This can be used to create config shared
+  between all users who use a repository (eg.
+  [fix commands](https://chromium-review.googlesource.com/c/chromium/src/+/6703030))
+
 ### Fixed bugs
 
 ### Packaging changes

cli/src/cli_util.rs

@@ -360,7 +360,9 @@ impl CommandHelper {
         let mut config_env = self.data.config_env.clone();
         let mut raw_config = self.data.raw_config.clone();
         let repo_path = workspace_root.join(".jj").join("repo");
-        config_env.reset_repo_path(&repo_path);
+        config_env.reset_repo_path(&repo_path, workspace_root);
+        // Since it's a new workspace, we don't need to bother loading the
+        // repo-managed config.
         config_env.reload_repo_config(&mut raw_config)?;
         let mut config = config_env.resolve_config(&raw_config)?;
         // No migration messages here, which would usually be emitted before.
@@ -3857,8 +3859,8 @@ impl<'a> CliRunner<'a> {
             .map_err(|err| map_workspace_load_error(err, Some(".")));
         config_env.reload_user_config(&mut raw_config)?;
         if let Ok(loader) = &maybe_cwd_workspace_loader {
-            config_env.reset_repo_path(loader.repo_path());
-            config_env.reload_repo_config(&mut raw_config)?;
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            config_env.reload_all_repo_config(ui, &mut raw_config)?;
         }
         let mut config = config_env.resolve_config(&raw_config)?;
         migrate_config(&mut config)?;
@@ -3907,8 +3909,8 @@ impl<'a> CliRunner<'a> {
                 .workspace_loader_factory
                 .create(&abs_path)
                 .map_err(|err| map_workspace_load_error(err, Some(path)))?;
-            config_env.reset_repo_path(loader.repo_path());
-            config_env.reload_repo_config(&mut raw_config)?;
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            config_env.reload_all_repo_config(ui, &mut raw_config)?;
             Ok(loader)
         } else {
             maybe_cwd_workspace_loader
@@ -3925,6 +3927,7 @@ impl<'a> CliRunner<'a> {
                 ConfigSource::Default => "default-provided",
                 ConfigSource::EnvBase | ConfigSource::EnvOverrides => "environment-provided",
                 ConfigSource::User => "user-level",
+                ConfigSource::RepoManaged => "repo-managed-level",
                 ConfigSource::Repo => "repo-level",
                 ConfigSource::CommandArg => "CLI-provided",
             };

cli/src/commands/config/mod.rs

@@ -16,6 +16,7 @@ mod edit;
 mod get;
 mod list;
 mod path;
+mod review_managed;
 mod set;
 mod unset;
 
@@ -34,6 +35,8 @@ use self::list::cmd_config_list;
 use self::list::ConfigListArgs;
 use self::path::cmd_config_path;
 use self::path::ConfigPathArgs;
+use self::review_managed::cmd_review_managed;
+use self::review_managed::ConfigReviewManagedArgs;
 use self::set::cmd_config_set;
 use self::set::ConfigSetArgs;
 use self::unset::cmd_config_unset;
@@ -146,6 +149,8 @@ pub(crate) enum ConfigCommand {
     Set(ConfigSetArgs),
     #[command(visible_alias("u"))]
     Unset(ConfigUnsetArgs),
+    #[command()]
+    ReviewManaged(ConfigReviewManagedArgs),
 }
 
 #[instrument(skip_all)]
@@ -161,5 +166,6 @@ pub(crate) fn cmd_config(
         ConfigCommand::Path(args) => cmd_config_path(ui, command, args),
         ConfigCommand::Set(args) => cmd_config_set(ui, command, args),
         ConfigCommand::Unset(args) => cmd_config_unset(ui, command, args),
+        ConfigCommand::ReviewManaged(args) => cmd_review_managed(ui, command, args),
     }
 }

cli/src/commands/config/review_managed.rs

@@ -0,0 +1,124 @@
+// Copyright 2025 The Jujutsu Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::borrow::Borrow as _;
+use std::borrow::Cow;
+
+use tracing::instrument;
+
+use crate::cli_util::CommandHelper;
+use crate::command_error::internal_error_with_message;
+use crate::command_error::user_error;
+use crate::command_error::CommandError;
+use crate::config::maybe_read_to_string;
+use crate::merge_tools::make_diff_sections;
+use crate::ui::Ui;
+
+/// Reviews and updates configuration stored in version control.
+/// You should never need to run this command unless jj tells you to.
+#[derive(clap::Args, Clone, Debug)]
+pub struct ConfigReviewManagedArgs {
+    /// Trust the repository's config and skip review of it.
+    /// Use this when you absolutely trust the repo config (eg. you're the only
+    /// contributor).
+    #[arg(long)]
+    trust: bool,
+}
+
+#[instrument(skip_all)]
+pub fn cmd_review_managed(
+    ui: &mut Ui,
+    command: &CommandHelper,
+    args: &ConfigReviewManagedArgs,
+) -> Result<(), CommandError> {
+    if let Some(paths) = command.config_env().repo_managed_config_paths() {
+        // Treat an empty file the same as a nonexistent one.
+        let vcs = maybe_read_to_string(&paths.managed)?.unwrap_or_else(String::new);
+        let config = maybe_read_to_string(&paths.config)?.unwrap_or_else(String::new);
+
+        if vcs.is_empty() {
+            // We don't need the user to review this since it's not a security issue.
+            writeln!(
+                ui.status(),
+                "The config file has been removed from the VCS, so we have removed the local copy \
+                 too."
+            )?;
+            std::fs::remove_file(paths.config)?;
+            std::fs::remove_file(paths.last_reviewed)?;
+            return Ok(());
+        }
+
+        if config == vcs {
+            writeln!(ui.status(), "Your config file is already up to date")?;
+            return Ok(());
+        }
+
+        let new_config = if args.trust {
+            vcs.clone()
+        } else {
+            let sections = make_diff_sections(&config, &vcs)
+                .map_err(|e| internal_error_with_message("Failed to create diff sections", e))?;
+            // Ideally we'd use the user's chosen diff selector, but that
+            // heavily relies on jj's objects such as Tree and Store.
+            let recorded = scm_record::Recorder::new(
+                scm_record::RecordState {
+                    is_read_only: false,
+                    commits: vec![],
+                    files: vec![scm_record::File {
+                        old_path: None,
+                        path: std::borrow::Cow::Borrowed(&paths.managed),
+                        // This doesn't do anything.
+                        file_mode: scm_record::FileMode::Unix(0o777),
+                        sections,
+                    }],
+                },
+                &mut scm_record::helpers::CrosstermInput,
+            )
+            .run()
+            .map_err(|_| user_error("Failed to select changes"))?;
+
+            // There's always precisely one file.
+            reconstruct(&recorded.files[0].sections)
+        };
+        std::fs::write(paths.config, new_config)?;
+        std::fs::write(paths.last_reviewed, vcs)?;
+        writeln!(ui.status(), "Updated repo config file")?;
+        Ok(())
+    } else {
+        Err(user_error(
+            "Unable to detect location of config files. Are you in a repo?",
+        ))
+    }
+}
+
+fn reconstruct<'a>(sections: &[scm_record::Section<'a>]) -> String {
+    let mut out: Vec<&Cow<'a, str>> = Default::default();
+    for section in sections {
+        match section {
+            scm_record::Section::Unchanged { lines } => out.extend(lines),
+            scm_record::Section::Changed { lines } => {
+                for line in lines {
+                    if line.is_checked == (line.change_type == scm_record::ChangeType::Added) {
+                        out.push(&line.line);
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    out.into_iter()
+        .map(|s| s.borrow())
+        .collect::<Vec<&str>>()
+        .join("")
+}

cli/src/complete.rs

@@ -867,8 +867,8 @@ fn get_jj_command() -> Result<(JjBuilder, UserSettings), CommandError> {
     let maybe_cwd_workspace_loader = DefaultWorkspaceLoaderFactory.create(find_workspace_dir(&cwd));
     let _ = config_env.reload_user_config(&mut raw_config);
     if let Ok(loader) = &maybe_cwd_workspace_loader {
-        config_env.reset_repo_path(loader.repo_path());
-        let _ = config_env.reload_repo_config(&mut raw_config);
+        config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+        let _ = config_env.reload_all_repo_config(&ui, &mut raw_config);
     }
     let mut config = config_env.resolve_config(&raw_config)?;
     // skip 2 because of the clap_complete prelude: jj -- jj <actual args...>
@@ -885,8 +885,8 @@ fn get_jj_command() -> Result<(JjBuilder, UserSettings), CommandError> {
     if let Some(repository) = args.repository {
         // Try to update repo-specific config on a best-effort basis.
         if let Ok(loader) = DefaultWorkspaceLoaderFactory.create(&cwd.join(&repository)) {
-            config_env.reset_repo_path(loader.repo_path());
-            let _ = config_env.reload_repo_config(&mut raw_config);
+            config_env.reset_repo_path(loader.repo_path(), loader.workspace_root());
+            let _ = config_env.reload_all_repo_config(&ui, &mut raw_config);
             if let Ok(new_config) = config_env.resolve_config(&raw_config) {
                 config = new_config;
             }

cli/src/config.rs

@@ -18,6 +18,7 @@ use std::collections::HashMap;
 use std::env;
 use std::env::split_paths;
 use std::fmt;
+use std::io;
 use std::path::Path;
 use std::path::PathBuf;
 use std::process::Command;
@@ -36,6 +37,8 @@ use jj_lib::config::ConfigSource;
 use jj_lib::config::ConfigValue;
 use jj_lib::config::StackedConfig;
 use jj_lib::dsl_util;
+use jj_lib::file_util::IoResultExt as _;
+use jj_lib::file_util::PathError;
 use regex::Captures;
 use regex::Regex;
 use tracing::instrument;
@@ -326,11 +329,31 @@ impl UnresolvedConfigEnv {
 pub struct ConfigEnv {
     home_dir: Option<PathBuf>,
     repo_path: Option<PathBuf>,
+    workspace_root: Option<PathBuf>,
     user_config_paths: Vec<ConfigPath>,
     repo_config_path: Option<ConfigPath>,
     command: Option<String>,
 }
 
+pub struct RepoManagedConfigPaths {
+    /// The path to the file managed by the repo.
+    pub managed: PathBuf,
+    /// The path to the managed config that is actually in use.
+    pub config: PathBuf,
+    /// The path to the content of the file that was last reviewed.
+    pub last_reviewed: PathBuf,
+}
+
+// The same as std::fs::read_to_string, but returns None if the file was not
+// found.
+pub fn maybe_read_to_string(path: &Path) -> io::Result<Option<String>> {
+    match std::fs::read_to_string(path) {
+        Ok(val) => Ok(Some(val)),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
 impl ConfigEnv {
     /// Initializes configuration loader based on environment variables.
     pub fn from_environment(ui: &Ui) -> Self {
@@ -371,6 +394,7 @@ impl ConfigEnv {
         ConfigEnv {
             home_dir,
             repo_path: None,
+            workspace_root: None,
             user_config_paths: env.resolve(ui),
             repo_config_path: None,
             command: None,
@@ -441,9 +465,22 @@ impl ConfigEnv {
 
     /// Sets the directory where repo-specific config file is stored. The path
     /// is usually `.jj/repo`.
-    pub fn reset_repo_path(&mut self, path: &Path) {
-        self.repo_path = Some(path.to_owned());
-        self.repo_config_path = Some(ConfigPath::new(path.join("config.toml")));
+    pub fn reset_repo_path(&mut self, repo_path: &Path, workspace_root: &Path) {
+        self.repo_path = Some(repo_path.to_owned());
+        self.workspace_root = Some(workspace_root.to_owned());
+        self.repo_config_path = Some(ConfigPath::new(repo_path.join("config.toml")));
+    }
+
+    /// Returns all paths associated with the repo-managed configuration.
+    pub fn repo_managed_config_paths(&self) -> Option<RepoManagedConfigPaths> {
+        match (&self.repo_path, &self.workspace_root) {
+            (Some(repo_path), Some(workspace_root)) => Some(RepoManagedConfigPaths {
+                config: repo_path.join("generated_repo_config.toml"),
+                last_reviewed: repo_path.join("last_reviewed_repo_config.toml"),
+                managed: workspace_root.join(".config/jj/config.toml"),
+            }),
+            _ => None,
+        }
     }
 
     /// Returns a path to the repo-specific config file.
@@ -480,6 +517,55 @@ impl ConfigEnv {
             .transpose()
     }
 
+    /// Loads repo-managed config file for the user into the given `config`.
+    /// The old repo-managed config layer will be replaced if any.
+    fn reload_repo_managed_config(
+        &self,
+        ui: &Ui,
+        config: &mut RawConfig,
+    ) -> Result<(), ConfigLoadError> {
+        if !self.reload_repo_managed_config_internal(config)? {
+            writeln!(
+                ui.warning_default(),
+                "Your repo-managed config is out of date"
+            )
+            .context(PathBuf::from("stderr"))
+            .map_err(ConfigLoadError::Read)?;
+            writeln!(ui.hint_default(), "Run `jj config review-managed`")
+                .context(PathBuf::from("stderr"))
+                .map_err(ConfigLoadError::Read)?;
+        }
+        Ok(())
+    }
+
+    // When we pass UI it can't be instrumented (since it doesn't implement
+    // std::fmt::Debug), so we split this up into two functions.
+    #[instrument]
+    fn reload_repo_managed_config_internal(
+        &self,
+        config: &mut RawConfig,
+    ) -> Result<bool, ConfigLoadError> {
+        let mut_config = config.as_mut();
+        mut_config.remove_layers(ConfigSource::RepoManaged);
+        Ok(if let Some(paths) = self.repo_managed_config_paths() {
+            match mut_config.load_file(ConfigSource::RepoManaged, paths.config) {
+                Ok(()) => {}
+                Err(ConfigLoadError::Read(PathError { error, .. }))
+                    if error.kind() == io::ErrorKind::NotFound => {}
+                e => e?,
+            }
+            let vcs_content = maybe_read_to_string(&paths.managed)
+                .context(paths.managed)
+                .map_err(ConfigLoadError::Read)?;
+            let last_reviewed_content = maybe_read_to_string(&paths.last_reviewed)
+                .context(paths.last_reviewed)
+                .map_err(ConfigLoadError::Read)?;
+            vcs_content == last_reviewed_content
+        } else {
+            true
+        })
+    }
+
     /// Loads repo-specific config file into the given `config`. The old
     /// repo-config layer will be replaced if any.
     #[instrument]
@@ -491,6 +577,16 @@ impl ConfigEnv {
         Ok(())
     }
 
+    /// Reloads both the repo-config and the repo-managed config.
+    pub fn reload_all_repo_config(
+        &self,
+        ui: &Ui,
+        config: &mut RawConfig,
+    ) -> Result<(), ConfigLoadError> {
+        self.reload_repo_managed_config(ui, config)?;
+        self.reload_repo_config(config)
+    }
+
     /// Resolves conditional scopes within the current environment. Returns new
     /// resolved config.
     pub fn resolve_config(&self, config: &RawConfig) -> Result<StackedConfig, ConfigGetError> {
@@ -1767,6 +1863,7 @@ mod tests {
         ConfigEnv {
             home_dir,
             repo_path: None,
+            workspace_root: None,
             user_config_paths: env.resolve(&Ui::null()),
             repo_config_path: None,
             command: None,