feat(config): gate channel config writes

src/auto-reply/reply/commands-config.ts

@@ -15,6 +15,8 @@ import {
   setConfigOverride,
   unsetConfigOverride,
 } from "../../config/runtime-overrides.js";
+import { resolveChannelConfigWrites } from "../../channels/plugins/config-writes.js";
+import { normalizeChannelId } from "../../channels/registry.js";
 import { logVerbose } from "../../globals.js";
 import type { CommandHandler } from "./commands-types.js";
 import { parseConfigCommand } from "./config-commands.js";
@@ -44,6 +46,28 @@ export const handleConfigCommand: CommandHandler = async (params, allowTextComma
       reply: { text: `⚠️ ${configCommand.message}` },
     };
   }
+
+  if (configCommand.action === "set" || configCommand.action === "unset") {
+    const channelId = params.command.channelId ?? normalizeChannelId(params.command.channel);
+    const allowWrites = resolveChannelConfigWrites({
+      cfg: params.cfg,
+      channelId,
+      accountId: params.ctx.AccountId,
+    });
+    if (!allowWrites) {
+      const channelLabel = channelId ?? "this channel";
+      const hint = channelId
+        ? `channels.${channelId}.configWrites=true`
+        : "channels.<channel>.configWrites=true";
+      return {
+        shouldContinue: false,
+        reply: {
+          text: `⚠️ Config writes are disabled for ${channelLabel}. Set ${hint} to enable.`,
+        },
+      };
+    }
+  }
+
   const snapshot = await readConfigFileSnapshot();
   if (!snapshot.valid || !snapshot.parsed || typeof snapshot.parsed !== "object") {
     return {