feat: add opt-in write access for all token-visible repos

tests/test_config.py

@@ -78,3 +78,31 @@ def test_settings_singleton(mock_env: None) -> None:
     settings2 = get_settings()
 
     assert settings1 is settings2
+
+
+def test_write_mode_requires_whitelist_or_allow_all(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Write mode without whitelist must be rejected unless allow-all is enabled."""
+    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
+    monkeypatch.setenv("GITEA_TOKEN", "test-token")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
+    monkeypatch.setenv("WRITE_MODE", "true")
+    monkeypatch.delenv("WRITE_REPOSITORY_WHITELIST", raising=False)
+    monkeypatch.setenv("WRITE_ALLOW_ALL_TOKEN_REPOS", "false")
+
+    reset_settings()
+    with pytest.raises(ValidationError):
+        get_settings()
+
+
+def test_write_mode_allows_all_token_repos(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Allow-all mode should pass validation without explicit repository whitelist."""
+    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
+    monkeypatch.setenv("GITEA_TOKEN", "test-token")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
+    monkeypatch.setenv("WRITE_MODE", "true")
+    monkeypatch.delenv("WRITE_REPOSITORY_WHITELIST", raising=False)
+    monkeypatch.setenv("WRITE_ALLOW_ALL_TOKEN_REPOS", "true")
+
+    reset_settings()
+    settings = get_settings()
+    assert settings.write_allow_all_token_repos is True