feat(cli): /config set <key> <value> — edit settings from the REPL (#165)

/config was a read-only dump. Add a `set` subcommand that writes to the user
settings.json:
- dotted keys nest (e.g. `permissions.defaultMode`);
- the value is parsed as JSON (number / bool / object / array), falling back to
  a string;
- writes via the REPL-injected userSettingsPath (honors --home, so tests + a
  custom $HOME never touch the real config).

Applies to new sessions (model/mode/effort still change live via /model etc.).

Tests (parity-commands.test.ts, +3): dotted-key write, JSON-number parse, usage.
cli 140. Doc: /config row notes `set`.

Co-authored-by: t <t@t>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

apps/cli/src/commands.ts

@@ -15,12 +15,14 @@ import {
   contextWindowFor,
   estimateCost,
   redact,
+  writeSettings,
   EFFORT_PARAMS,
   VERSION,
   type Credentials,
   type Effort,
 } from '@deepcode/core';
 import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -102,6 +104,18 @@ export function formatPrComments(data: PrCommentsData): string[] {
   return lines;
 }
 
+/** Set a possibly-dotted key path on an object, creating intermediate objects. */
+function setDeep(obj: Record<string, unknown>, path: string, value: unknown): void {
+  const keys = path.split('.');
+  let o = obj;
+  for (let i = 0; i < keys.length - 1; i++) {
+    const k = keys[i]!;
+    if (typeof o[k] !== 'object' || o[k] === null || Array.isArray(o[k])) o[k] = {};
+    o = o[k] as Record<string, unknown>;
+  }
+  o[keys[keys.length - 1]!] = value;
+}
+
 export interface SessionContext {
   cwd: string;
   model: string;
@@ -111,6 +125,8 @@ export interface SessionContext {
   creds: Credentials;
   /** Credentials store (REPL-injected) — backs /login and /logout. */
   credsStore?: CredentialsStore;
+  /** User settings.json path (REPL-injected, honors --home) — backs /config set. */
+  userSettingsPath?: string;
   sessionId: string;
   sessions: SessionManager;
   usage: {
@@ -345,12 +361,45 @@ export const ContextCommand: SlashCommand = {
 
 export const ConfigCommand: SlashCommand = {
   name: '/config',
-  description: 'Show resolved settings (read-only in M2).',
-  run(_args, ctx) {
+  description: 'Show settings, or `/config set <key> <value>` to edit (dotted keys ok).',
+  async run(args, ctx) {
+    if (args[0] === 'set') {
+      const key = args[1]?.trim();
+      const valueRaw = args.slice(2).join(' ').trim();
+      if (!key || !valueRaw) {
+        return [
+          'Usage: /config set <key> <value>',
+          '  key may be dotted (e.g. permissions.defaultMode); value is parsed as JSON, else kept as a string.',
+        ];
+      }
+      if (!ctx.userSettingsPath) return ['(/config set is unavailable here.)'];
+      let value: unknown;
+      try {
+        value = JSON.parse(valueRaw);
+      } catch {
+        value = valueRaw;
+      }
+      let current: Record<string, unknown> = {};
+      try {
+        current = JSON.parse(await readFile(ctx.userSettingsPath, 'utf8')) as Record<
+          string,
+          unknown
+        >;
+      } catch {
+        /* missing/empty → start fresh */
+      }
+      setDeep(current, key, value);
+      await writeSettings(ctx.userSettingsPath, current as DeepCodeSettings);
+      return [
+        `Set ${key} = ${JSON.stringify(value)}`,
+        `→ ${ctx.userSettingsPath}`,
+        'Applies to new sessions (model / mode / effort change live via /model, /mode, /effort).',
+      ];
+    }
     const out = ['Current settings (merged):'];
     out.push(JSON.stringify(ctx.settings, null, 2).split('\n').slice(0, 40).join('\n'));
     out.push('');
-    out.push('Edit ~/.deepcode/settings.json (user) or .deepcode/settings.json (project).');
+    out.push('Edit with `/config set <key> <value>`, or ~/.deepcode/settings.json directly.');
     return out;
   },
 };

apps/cli/src/parity-commands.test.ts

@@ -3,7 +3,7 @@
 // never real creds). /recap uses a mock provider; /pr_comments' renderer is pure.
 
 import { afterEach, describe, expect, it } from 'vitest';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { CredentialsStore, SessionManager } from '@deepcode/core';
@@ -154,3 +154,31 @@ describe('/upgrade + /privacy-settings', () => {
     expect(out).toMatch(/security-model\.md/);
   });
 });
+
+describe('/config set', () => {
+  it('writes a dotted key to the user settings file', async () => {
+    const path = join(await tmpHome(), 'settings.json');
+    const out = await reg
+      .match('/config')!
+      .cmd.run(['set', 'permissions.defaultMode', 'plan'], ctx({ userSettingsPath: path }));
+    expect(out.join('\n')).toMatch(/Set permissions\.defaultMode/);
+    const written = JSON.parse(await readFile(path, 'utf8')) as {
+      permissions?: { defaultMode?: string };
+    };
+    expect(written.permissions?.defaultMode).toBe('plan');
+  });
+
+  it('parses a JSON value (number, not string)', async () => {
+    const path = join(await tmpHome(), 'settings.json');
+    await reg
+      .match('/config')!
+      .cmd.run(['set', 'memoryLoadCapKB', '200'], ctx({ userSettingsPath: path }));
+    const written = JSON.parse(await readFile(path, 'utf8')) as { memoryLoadCapKB?: number };
+    expect(written.memoryLoadCapKB).toBe(200);
+  });
+
+  it('shows usage for `/config set` with no key/value', async () => {
+    const out = await reg.match('/config')!.cmd.run(['set'], ctx());
+    expect(out.join('\n')).toMatch(/Usage: \/config set/);
+  });
+});

apps/cli/src/repl.ts

@@ -435,6 +435,7 @@ export async function startRepl(opts: ReplOpts): Promise<number> {
     settings,
     creds,
     credsStore,
+    userSettingsPath: settingsPaths({ cwd, home: opts.home }).userPath,
     sessionId: session.id,
     sessions,
     usage: { inputTokens: 0, outputTokens: 0, reasoningTokens: 0, cacheReadTokens: 0 },

docs/BEHAVIOR_PARITY.md

@@ -32,7 +32,7 @@ Legend: `✅` matches · `🟡` matches with caveats · `🔄` deferred · `⚠
 | `/effort`                  | ✓           | ✓                  | 🟡 — CLI prints the tier table (numbers from `EFFORT_PARAMS` SSOT); switch via `/effort <tier>`; arrow-key selector is GUI-only (M6) |
 | `/cost` / `/usage`         | ✓           | ✓                  | ✅                                                                                                                                   |
 | `/context`                 | ✓           | ✓                  | ✅                                                                                                                                   |
-| `/config`                  | ✓           | ✓ (read-only)      | 🟡 — Claude Code's `/config` is interactive editor; ours is JSON dump (M3c-ext for editor)                                           |
+| `/config`                  | ✓           | ✓                  | 🟡 — dumps merged settings + `/config set <key> <value>` (dotted keys, JSON values) writes user settings; no full arrow-key editor   |
 | `/resume`                  | ✓           | ✓ (list only)      | 🟡 — Claude Code has fuzzy picker; ours lists; pick via `--resume <id>`                                                              |
 | `/init`                    | ✓           | ✓                  | ✅ — interactive 3-phase REPL flow (scan → draft → approve-write `AGENTS.md`)                                                        |
 | `/mcp`                     | ✓           | ✓                  | ✅                                                                                                                                   |