Add advanced integration gates

Author: SqlRush

docs/cc-100-roadmap.md

@@ -1456,7 +1456,7 @@ M7 补充：terminal input parser 和 configurable keybinding name parser 现在
 - Chrome/computer-use/voice/native integrations。
 - enterprise/gated/platform-specific behavior。
 
-当前状态：未开始完整实现。
+当前状态：已新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge、session websocket/direct connect、LSP manager/tool、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
 
 ## Recommended Next Steps
 

docs/claude-code-go-rewrite-plan.md

@@ -745,6 +745,8 @@ test/parity/                 # golden tests against TS/official behavior
 - 每个 gated feature 独立开关测试。
 - 不启用 feature 时二进制行为和可见 schema 不泄露 gated 工具/命令。
 
+- 本轮补充：新增 `advanced` settings gate 地基，覆盖 bridge/LSP/telemetry/Chrome/voice/computer-use/native integrations 的独立 bool 开关解析、settings merge、headless `/config show advanced` 和 `/config search` 审计；未启用时仍不注册或泄露 gated 工具 schema。实际 repl bridge、session websocket/direct connect、LSP manager/tool、telemetry exporter/tracing、Chrome/voice/computer-use/native runtime 仍未完成。
+
 ### M12: Parity hardening
 
 产出：

internal/config/settings.go

@@ -223,6 +223,9 @@ func MergeSettings(settings ...contracts.Settings) contracts.Settings {
 			cp := *s.Remote
 			out.Remote = &cp
 		}
+		if s.Advanced != nil {
+			out.Advanced = mergeAdvancedSetting(out.Advanced, s.Advanced)
+		}
 		if s.AutoUpdatesChannel != "" {
 			out.AutoUpdatesChannel = s.AutoUpdatesChannel
 		}
@@ -262,6 +265,78 @@ func MergeSettingsSources(sources ...SourceSettings) contracts.Settings {
 	return merged
 }
 
+func mergeAdvancedSetting(a, b *contracts.AdvancedSetting) *contracts.AdvancedSetting {
+	if a == nil {
+		cp := *b
+		if b.Bridge != nil {
+			cp.Bridge = clonePtr(b.Bridge)
+		}
+		if b.LSP != nil {
+			cp.LSP = clonePtr(b.LSP)
+		}
+		if b.Telemetry != nil {
+			cp.Telemetry = clonePtr(b.Telemetry)
+		}
+		if b.Chrome != nil {
+			cp.Chrome = clonePtr(b.Chrome)
+		}
+		if b.Voice != nil {
+			cp.Voice = clonePtr(b.Voice)
+		}
+		if b.ComputerUse != nil {
+			cp.ComputerUse = clonePtr(b.ComputerUse)
+		}
+		if b.NativeIntegrations != nil {
+			cp.NativeIntegrations = clonePtr(b.NativeIntegrations)
+		}
+		return &cp
+	}
+	out := *a
+	if a.Bridge != nil {
+		out.Bridge = clonePtr(a.Bridge)
+	}
+	if a.LSP != nil {
+		out.LSP = clonePtr(a.LSP)
+	}
+	if a.Telemetry != nil {
+		out.Telemetry = clonePtr(a.Telemetry)
+	}
+	if a.Chrome != nil {
+		out.Chrome = clonePtr(a.Chrome)
+	}
+	if a.Voice != nil {
+		out.Voice = clonePtr(a.Voice)
+	}
+	if a.ComputerUse != nil {
+		out.ComputerUse = clonePtr(a.ComputerUse)
+	}
+	if a.NativeIntegrations != nil {
+		out.NativeIntegrations = clonePtr(a.NativeIntegrations)
+	}
+	if b.Bridge != nil {
+		out.Bridge = clonePtr(b.Bridge)
+	}
+	if b.LSP != nil {
+		out.LSP = clonePtr(b.LSP)
+	}
+	if b.Telemetry != nil {
+		out.Telemetry = clonePtr(b.Telemetry)
+	}
+	if b.Chrome != nil {
+		out.Chrome = clonePtr(b.Chrome)
+	}
+	if b.Voice != nil {
+		out.Voice = clonePtr(b.Voice)
+	}
+	if b.ComputerUse != nil {
+		out.ComputerUse = clonePtr(b.ComputerUse)
+	}
+	if b.NativeIntegrations != nil {
+		out.NativeIntegrations = clonePtr(b.NativeIntegrations)
+	}
+	return &out
+}
+
 func mergePermissions(a, b *contracts.PermissionsSetting) *contracts.PermissionsSetting {
 	if a == nil {
 		cp := *b

internal/config/settings_test.go

@@ -92,6 +92,9 @@ func TestValidateSettingsWarnsForInvalidSandboxFilesystem(t *testing.T) {
 func TestMergeSettings(t *testing.T) {
 	defaultWorktree := true
 	overrideWorktree := false
+	bridgeEnabled := true
+	telemetryDisabled := false
+	telemetryEnabled := true
 	a := contracts.Settings{
 		Env: map[string]string{"A": "1"},
 		Permissions: &contracts.PermissionsSetting{
@@ -103,6 +106,10 @@ func TestMergeSettings(t *testing.T) {
 			SparsePaths:        []string{"README.md"},
 			SymlinkDirectories: []string{"cache"},
 		},
+		Advanced: &contracts.AdvancedSetting{
+			Bridge:    &bridgeEnabled,
+			Telemetry: &telemetryDisabled,
+		},
 	}
 	b := contracts.Settings{
 		Env:   map[string]string{"A": "2", "B": "3"},
@@ -116,6 +123,9 @@ func TestMergeSettings(t *testing.T) {
 			SparsePaths:        []string{"docs"},
 			SymlinkDirectories: []string{"node_modules"},
 		},
+		Advanced: &contracts.AdvancedSetting{
+			Telemetry: &telemetryEnabled,
+		},
 	}
 	merged := MergeSettings(a, b)
 	if merged.Env["A"] != "2" || merged.Env["B"] != "3" {
@@ -136,6 +146,9 @@ func TestMergeSettings(t *testing.T) {
 	if len(merged.Worktree.SymlinkDirectories) != 2 || merged.Worktree.SymlinkDirectories[0] != "cache" || merged.Worktree.SymlinkDirectories[1] != "node_modules" {
 		t.Fatalf("worktree symlink dirs = %#v", merged.Worktree.SymlinkDirectories)
 	}
+	if merged.Advanced == nil || merged.Advanced.Bridge == nil || !*merged.Advanced.Bridge || merged.Advanced.Telemetry == nil || !*merged.Advanced.Telemetry {
+		t.Fatalf("advanced = %#v", merged.Advanced)
+	}
 }
 
 func TestMergeSettingsPreservesSandboxSettings(t *testing.T) {

internal/contracts/settings.go

@@ -62,6 +62,7 @@ type Settings struct {
 	CompanyAnnouncements            []string                    `json:"companyAnnouncements,omitempty"`
 	PluginConfigs                   map[string]PluginConfig     `json:"pluginConfigs,omitempty"`
 	Remote                          *RemoteSetting              `json:"remote,omitempty"`
+	Advanced                        *AdvancedSetting            `json:"advanced,omitempty"`
 	AutoUpdatesChannel              string                      `json:"autoUpdatesChannel,omitempty"`
 	Plugins                         map[string]any              `json:"plugins,omitempty"`
 	Extra                           map[string]any              `json:"-"`
@@ -114,6 +115,16 @@ type RemoteSetting struct {
 	DefaultEnvironmentID string `json:"defaultEnvironmentId,omitempty"`
 }
 
+type AdvancedSetting struct {
+	Bridge             *bool `json:"bridge,omitempty"`
+	LSP                *bool `json:"lsp,omitempty"`
+	Telemetry          *bool `json:"telemetry,omitempty"`
+	Chrome             *bool `json:"chrome,omitempty"`
+	Voice              *bool `json:"voice,omitempty"`
+	ComputerUse        *bool `json:"computerUse,omitempty"`
+	NativeIntegrations *bool `json:"nativeIntegrations,omitempty"`
+}
+
 type PermissionsSetting struct {
 	Allow                 []string       `json:"allow,omitempty"`
 	Deny                  []string       `json:"deny,omitempty"`

internal/contracts/settings_json.go

@@ -98,6 +98,7 @@ var knownSettingsJSONKeys = []string{
 	"companyAnnouncements",
 	"pluginConfigs",
 	"remote",
+	"advanced",
 	"autoUpdatesChannel",
 	"plugins",
 }

internal/contracts/settings_json_test.go

@@ -31,6 +31,26 @@ func TestSettingsPreservesUnknownFields(t *testing.T) {
 	}
 }
 
+func TestSettingsParsesAdvancedFeatureGates(t *testing.T) {
+	input := []byte(`{"advanced":{"bridge":true,"lsp":false,"telemetry":true,"computerUse":true}}`)
+	var settings Settings
+	if err := json.Unmarshal(input, &settings); err != nil {
+		t.Fatal(err)
+	}
+	if settings.Advanced == nil || settings.Advanced.Bridge == nil || !*settings.Advanced.Bridge {
+		t.Fatalf("advanced bridge = %#v", settings.Advanced)
+	}
+	if settings.Advanced.LSP == nil || *settings.Advanced.LSP {
+		t.Fatalf("advanced lsp = %#v", settings.Advanced)
+	}
+	if settings.Advanced.Telemetry == nil || !*settings.Advanced.Telemetry || settings.Advanced.ComputerUse == nil || !*settings.Advanced.ComputerUse {
+		t.Fatalf("advanced gates = %#v", settings.Advanced)
+	}
+	if settings.Extra["advanced"] != nil {
+		t.Fatalf("advanced should be a known setting, extra = %#v", settings.Extra)
+	}
+}
+
 func TestSettingsParsesOfficialMCPPolicyEntries(t *testing.T) {
 	input := []byte(`{
 		"allowedMcpServers": [

internal/conversation/run.go

@@ -972,8 +972,10 @@ func (r *Runner) formatConfigShow(raw string) string {
 			lines = append(lines, "Keys: "+strings.Join(sortedAnyMapKeys(merged.Sandbox), ", "))
 		}
 		return strings.Join(lines, "\n")
+	case "advanced":
+		return formatAdvancedSettings(merged.Advanced)
 	default:
-		return "Unknown config section " + strings.TrimSpace(raw) + ". Available sections: settings, model, output-style, auth, fast-mode, betas, env, permissions, mcp, hooks, plugins, marketplaces, sandbox"
+		return "Unknown config section " + strings.TrimSpace(raw) + ". Available sections: settings, model, output-style, auth, fast-mode, betas, env, permissions, mcp, hooks, plugins, marketplaces, sandbox, advanced"
 	}
 }
 
@@ -1027,6 +1029,8 @@ func normalizeConfigSection(raw string) string {
 		return "auth"
 	case "sandbox":
 		return "sandbox"
+	case "advanced", "advance", "adv", "gated", "gates", "feature", "features", "integration", "integrations":
+		return "advanced"
 	default:
 		return compact
 	}
@@ -1137,6 +1141,7 @@ func configSearchResults(r Runner, query string) []configSearchResult {
 	for _, key := range sortedAnyMapKeys(merged.Sandbox) {
 		add("sandbox", "sandbox key "+key, key)
 	}
+	addConfigAdvancedSearchResults(add, merged.Advanced)
 
 	sort.Slice(results, func(i, j int) bool {
 		if results[i].Section != results[j].Section {
@@ -1147,6 +1152,61 @@ func configSearchResults(r Runner, query string) []configSearchResult {
 	return results
 }
 
+func formatAdvancedSettings(setting *contracts.AdvancedSetting) string {
+	return strings.Join([]string{
+		"Config advanced integrations",
+		"Bridge: " + boolPtrEnabledText(advancedBool(setting, "bridge")),
+		"LSP: " + boolPtrEnabledText(advancedBool(setting, "lsp")),
+		"Telemetry: " + boolPtrEnabledText(advancedBool(setting, "telemetry")),
+		"Chrome: " + boolPtrEnabledText(advancedBool(setting, "chrome")),
+		"Voice: " + boolPtrEnabledText(advancedBool(setting, "voice")),
+		"Computer use: " + boolPtrEnabledText(advancedBool(setting, "computerUse")),
+		"Native integrations: " + boolPtrEnabledText(advancedBool(setting, "nativeIntegrations")),
+	}, "\n")
+}
+
+func addConfigAdvancedSearchResults(add func(string, string, ...string), setting *contracts.AdvancedSetting) {
+	for _, item := range []struct {
+		Name  string
+		Value *bool
+	}{
+		{Name: "bridge", Value: advancedBool(setting, "bridge")},
+		{Name: "lsp", Value: advancedBool(setting, "lsp")},
+		{Name: "telemetry", Value: advancedBool(setting, "telemetry")},
+		{Name: "chrome", Value: advancedBool(setting, "chrome")},
+		{Name: "voice", Value: advancedBool(setting, "voice")},
+		{Name: "computer use", Value: advancedBool(setting, "computerUse")},
+		{Name: "native integrations", Value: advancedBool(setting, "nativeIntegrations")},
+	} {
+		state := boolPtrEnabledText(item.Value)
+		add("advanced", item.Name+" "+state, item.Name, state)
+	}
+}
+
+func advancedBool(setting *contracts.AdvancedSetting, name string) *bool {
+	if setting == nil {
+		return nil
+	}
+	switch name {
+	case "bridge":
+		return setting.Bridge
+	case "lsp":
+		return setting.LSP
+	case "telemetry":
+		return setting.Telemetry
+	case "chrome":
+		return setting.Chrome
+	case "voice":
+		return setting.Voice
+	case "computerUse":
+		return setting.ComputerUse
+	case "nativeIntegrations":
+		return setting.NativeIntegrations
+	default:
+		return nil
+	}
+}
+
 func addConfigPermissionsSearchResults(add func(string, string, ...string), permissions *contracts.PermissionsSetting) {
 	if permissions == nil {
 		return

internal/conversation/run_test.go

@@ -1859,6 +1859,9 @@ func TestRunnerExecutesConfigShowSectionsWithoutQuery(t *testing.T) {
 	t.Setenv("CLAUDE_CONFIG_DIR", t.TempDir())
 	cwd := t.TempDir()
 	disableBypass := true
+	bridgeEnabled := true
+	lspDisabled := false
+	telemetryEnabled := true
 	runner := Runner{
 		Client:           client,
 		Model:            "sonnet",
@@ -1893,6 +1896,11 @@ func TestRunnerExecutesConfigShowSectionsWithoutQuery(t *testing.T) {
 				"market/a": {Options: map[string]any{"token": "plugin-secret"}},
 			},
 			Sandbox: map[string]any{"allowUnsandboxedCommands": false},
+			Advanced: &contracts.AdvancedSetting{
+				Bridge:    &bridgeEnabled,
+				LSP:       &lspDisabled,
+				Telemetry: &telemetryEnabled,
+			},
 		}},
 	}
 
@@ -1949,16 +1957,27 @@ func TestRunnerExecutesConfigShowSectionsWithoutQuery(t *testing.T) {
 		"- market/b: disabled",
 		"Plugin config names: market/a",
 	}, []string{"plugin-secret"})
+	assertConfigShow("/config show advanced", []string{
+		"Config advanced integrations",
+		"Bridge: enabled",
+		"LSP: disabled",
+		"Telemetry: enabled",
+		"Chrome: (unset)",
+		"Computer use: (unset)",
+		"Native integrations: (unset)",
+	}, nil)
 	assertConfigShow("/config show unknown", []string{
 		"Unknown config section unknown.",
 		"Available sections:",
+		"advanced",
 	}, nil)
 }
 
 func TestRunnerConfigSearchFindsSettingsWithoutLeakingValues(t *testing.T) {
 	client := &fakeClient{}
 	t.Setenv("CLAUDE_CONFIG_DIR", t.TempDir())
 	cwd := t.TempDir()
+	telemetryEnabled := true
 	runner := Runner{
 		Client:           client,
 		Model:            "sonnet",
@@ -1999,6 +2018,7 @@ func TestRunnerConfigSearchFindsSettingsWithoutLeakingValues(t *testing.T) {
 			},
 			ExtraKnownMarketplaces: map[string]any{"internal-market": map[string]any{"url": "https://market.example"}},
 			Sandbox:                map[string]any{"allowUnsandboxedCommands": false},
+			Advanced:               &contracts.AdvancedSetting{Telemetry: &telemetryEnabled},
 		}},
 	}
 
@@ -2038,6 +2058,15 @@ func TestRunnerConfigSearchFindsSettingsWithoutLeakingValues(t *testing.T) {
 		t.Fatalf("config find option key text = %q", text)
 	}
 
+	result, err = runner.RunTurn(context.Background(), nil, messages.UserText("/config search telemetry"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	text = result.Messages[1].Content[0].Text
+	if !strings.Contains(text, "- advanced: telemetry enabled") {
+		t.Fatalf("config search advanced text = %q", text)
+	}
+
 	result, err = runner.RunTurn(context.Background(), nil, messages.UserText("/config search hidden-token"))
 	if err != nil {
 		t.Fatal(err)