From 173a1ac17756282f706b5c9335e944e8970db409 Mon Sep 17 00:00:00 2001 From: Techcable Date: Sat, 6 Jun 2026 15:20:40 -0700 Subject: [PATCH] docs: require user permission before editing jj config Add a config-permission guardrail across the skill. Editing jj config (jj config set / jj config edit, --user or --repo) writes persistent settings that silently alter later behavior (git.push/git.fetch redirect pushes; trunk() aliases change rebase targets), so it must be gated on explicit user approval rather than treated as a routine non-interactive operation. - SKILL.md: new Critical Rule - troubleshooting.md: reframe Configuration block (list = safe; writes = ask first) - bookmarks.md: permission callout on multi-remote config workflows - revsets.md: glob opt-in is a user-owned config change --- SKILL.md | 1 + references/bookmarks.md | 2 ++ references/revsets.md | 2 +- references/troubleshooting.md | 12 +++++++----- 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/SKILL.md b/SKILL.md index 25ae37c..d5c55bc 100644 --- a/SKILL.md +++ b/SKILL.md @@ -16,6 +16,7 @@ If `.jj/` exists in the repo root, this is a jj repo. **Use `jj` commands, not ` - **VERIFY** mutations with `jj st` and `jj log` after `squash`, `abandon`, `rebase`, `restore`, `commit`. jj will silently do exactly what you asked, even if it wasn't what you meant. - **PREFER change IDs** (letters, e.g. `nmwwolux`) over commit IDs (hex). Change IDs are stable across rewrites. - **NEVER** rebase or describe an immutable commit (e.g. `main` if it's tracking a remote). Target the commit *above* it, or use `main@origin` as `--destination`. +- **NEVER** edit config without explicit user permission. `jj config set`/`jj config edit` (whether `--user` or `--repo`) write persistent settings that silently alter later behavior — `git.push`/`git.fetch` change where your code goes, `revset-aliases."trunk()"` changes what `trunk()` resolves to. Propose the exact command and wait for approval. - If you get stuck, `jj undo` reverses the last operation. `jj op log` shows everything; `jj op restore ` rewinds the whole repo. ## Mental Model diff --git a/references/bookmarks.md b/references/bookmarks.md index 159ae04..9b96d94 100644 --- a/references/bookmarks.md +++ b/references/bookmarks.md @@ -89,6 +89,8 @@ jj git fetch ## Multiple Remotes +> **Permission required.** The `jj config set --repo` commands below write persistent settings that change where `jj git push`/`fetch` send your code and what `trunk()` resolves to. Don't run them on your own — show the user the exact commands and get explicit approval first. + Two common workflows: ### Contributing upstream via a GitHub-style fork diff --git a/references/revsets.md b/references/revsets.md index 542236d..6f24a73 100644 --- a/references/revsets.md +++ b/references/revsets.md @@ -130,7 +130,7 @@ Functions that take a string pattern accept these prefixes: - `regex:"^feat.*"` — Rust regex - `regex-i:"..."` -> The default for plain `"string"` will change from `substring:` to `glob:` in a future release. Set `ui.revsets-use-glob-by-default = true` in `~/.config/jj/config.toml` to opt in early. +> The default for plain `"string"` will change from `substring:` to `glob:` in a future release. The user can opt in early by setting `ui.revsets-use-glob-by-default = true` in `~/.config/jj/config.toml` — but **don't make that config change yourself without explicit permission** (see the config-permission rule in `SKILL.md`). Until then, use an explicit `substring:`/`glob:` prefix when the distinction matters. ## Date Patterns diff --git a/references/troubleshooting.md b/references/troubleshooting.md index 3488aa8..6230f6e 100644 --- a/references/troubleshooting.md +++ b/references/troubleshooting.md @@ -109,14 +109,16 @@ Config is layered (highest priority wins): 4. User config (`~/.config/jj/config.toml`) 5. Built-in defaults +`jj config list` is read-only and safe. **Any config *write* (`jj config set`, `jj config edit`, whether `--user` or `--repo`) requires explicit user permission** — these settings are persistent and silently change later behavior (e.g. `git.push`/`git.fetch` redirect where your code goes; `trunk()` aliases change rebase targets). Propose the exact command and wait for approval. + ```bash -jj config list # show effective config -jj config set --user user.email "me@example.com" -jj config set --repo git.push origin -jj config edit --user # opens an editor — DO NOT USE IN AGENT +jj config list # read-only — safe +jj config set --user user.email "me@example.com" # WRITE — ask first +jj config set --repo git.push origin # WRITE — ask first +jj config edit --user # WRITE + opens an editor — never use in agent (hangs, and needs permission anyway) ``` -For agent use, prefer `jj config set` (non-interactive) over `jj config edit`. +Note `jj config edit` is doubly off-limits in an agent: it both hangs (interactive editor) and writes config. When the user has approved a config change, make it with a single non-interactive `jj config set`. ## Useful Advanced Commands