fix: replace inputs with secrets

RomneyDa · RomneyDa · commit 4f5449adc1f8 · 2025-10-15T02:43:23.000-07:00
diff --git a/core/config/yaml/loadLocalYamlBlocks.ts b/core/config/yaml/loadLocalYamlBlocks.ts
@@ -37,6 +37,7 @@ export async function unrollLocalYamlBlocks(
           ide,
         ),
         renderSecrets: true,
+        replaceInputsWithSecrets: true,
         injectBlocks: packageIdentifiers,
       },
     );
diff --git a/extensions/cli/src/configLoader.ts b/extensions/cli/src/configLoader.ts
@@ -382,6 +382,7 @@ export async function unrollPackageIdentifiersAsConfigYaml(
       platformClient: new CLIPlatformClient(organizationId, apiClient),
       renderSecrets: true,
       injectBlocks: packageIdentifiers,
+      replaceInputsWithSecrets: true,
     },
   );
   if (!unrollResult?.config) {
@@ -515,7 +516,7 @@ async function loadAssistantSlug(
     }
   }
 
-  return result.config as AssistantUnrolled;
+  return apiConfig;
 }
 
 /**
diff --git a/extensions/cli/src/integration/rule-duplication.test.ts b/extensions/cli/src/integration/rule-duplication.test.ts
@@ -2,6 +2,7 @@ import { decodePackageIdentifier } from "@continuedev/config-yaml";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { isStringRule } from "src/hubLoader.js";
+
 import { BaseCommandOptions } from "../commands/BaseCommandOptions.js";
 import { ConfigService } from "../services/ConfigService.js";
 
diff --git a/extensions/cli/src/services/AgentFileService.ts b/extensions/cli/src/services/AgentFileService.ts
@@ -2,6 +2,7 @@ import {
   parseAgentFileRules,
   parseAgentFileTools,
 } from "@continuedev/config-yaml";
+
 import {
   agentFileProcessor,
   loadModelFromHub,
diff --git a/extensions/cli/src/services/ConfigService.test.ts b/extensions/cli/src/services/ConfigService.test.ts
@@ -1,24 +1,20 @@
-import { beforeEach, describe, expect, test, vi } from "vitest";
-
-// Mock modules
-vi.mock("../auth/workos.js");
-vi.mock("../configLoader.js");
-vi.mock("../util/logger.js");
-vi.mock("./ServiceContainer.js");
-vi.mock("@continuedev/config-yaml");
-// Don't mock hubLoader - use real isStringRule implementation
-
 import {
   decodePackageIdentifier,
   mergeUnrolledAssistants,
 } from "@continuedev/config-yaml";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
 import * as workos from "../auth/workos.js";
 import * as configLoader from "../configLoader.js";
 
 import { ConfigService } from "./ConfigService.js";
 import { serviceContainer } from "./ServiceContainer.js";
 import { AgentFileServiceState, SERVICE_NAMES } from "./types.js";
-
+vi.mock("../auth/workos.js");
+vi.mock("../configLoader.js");
+vi.mock("../util/logger.js");
+vi.mock("./ServiceContainer.js");
+vi.mock("@continuedev/config-yaml");
 describe("ConfigService", () => {
   let service: ConfigService;
   const mockConfig = {
diff --git a/extensions/cli/src/services/ConfigService.ts b/extensions/cli/src/services/ConfigService.ts
@@ -1,18 +1,19 @@
-import { DefaultApiInterface } from "@continuedev/sdk/dist/api/dist/index.js";
-
-import { AuthConfig, loadAuthConfig } from "../auth/workos.js";
-import { BaseCommandOptions } from "../commands/BaseCommandOptions.js";
-import { loadConfiguration } from "../configLoader.js";
-import { logger } from "../util/logger.js";
-
 import {
   AssistantUnrolled,
   decodePackageIdentifier,
   mergeUnrolledAssistants,
   PackageIdentifier,
 } from "@continuedev/config-yaml";
+import { DefaultApiInterface } from "@continuedev/sdk/dist/api/dist/index.js";
+
 import { isStringRule } from "src/hubLoader.js";
 import { getErrorString } from "src/util/error.js";
+
+import { AuthConfig, loadAuthConfig } from "../auth/workos.js";
+import { BaseCommandOptions } from "../commands/BaseCommandOptions.js";
+import { loadConfiguration } from "../configLoader.js";
+import { logger } from "../util/logger.js";
+
 import { BaseService, ServiceWithDependencies } from "./BaseService.js";
 import { serviceContainer } from "./ServiceContainer.js";
 import {
@@ -71,83 +72,129 @@ export class ConfigService
       prompts: [],
     };
 
-    const {
-      model = [],
-      mcp = [],
-      rule = [],
-      prompt = [],
-    } = injectedConfigOptions || {};
+    const options = injectedConfigOptions || {};
 
-    // Models: all models will be package identifiers
+    this.processModels(options.model || [], agentFileState, packageIdentifiers);
+    this.processMcpServers(
+      options.mcp || [],
+      agentFileState,
+      packageIdentifiers,
+      additional,
+    );
+    this.processAgentFileRules(agentFileState, packageIdentifiers);
+    this.processRulesAndPrompts(
+      options.rule || [],
+      options.prompt || [],
+      packageIdentifiers,
+      additional,
+    );
+    this.processAgentFilePrompt(agentFileState, additional);
+
+    return {
+      injected: packageIdentifiers,
+      additional,
+    };
+  }
+
+  private processModels(
+    models: string[],
+    agentFileState: AgentFileServiceState | undefined,
+    packageIdentifiers: PackageIdentifier[],
+  ): void {
+    const allModels = [...models];
     if (agentFileState?.agentFile?.model) {
-      model.push(agentFileState.agentFile.model);
+      allModels.push(agentFileState.agentFile.model);
     }
-    for (const _model of model) {
+
+    for (const model of allModels) {
       try {
-        packageIdentifiers.push(decodePackageIdentifier(_model));
+        packageIdentifiers.push(decodePackageIdentifier(model));
       } catch (e) {
-        logger.warn(`Failed to add modl "${_model}": ${getErrorString(e)}`);
+        logger.warn(`Failed to add model "${model}": ${getErrorString(e)}`);
       }
     }
+  }
+
+  private processMcpServers(
+    mcps: string[],
+    agentFileState: AgentFileServiceState | undefined,
+    packageIdentifiers: PackageIdentifier[],
+    additional: AssistantUnrolled,
+  ): void {
+    const allMcps = [
+      ...mcps,
+      ...(agentFileState?.parsedTools?.mcpServers || []),
+    ];
 
-    // MCPs can be package identifiers or URLs
-    mcp.push(...(agentFileState?.parsedTools?.mcpServers || []));
-    for (const _mcp of mcp) {
+    for (const mcp of allMcps) {
       try {
-        if (_mcp.startsWith("http://") || _mcp.startsWith("https://")) {
+        if (this.isUrl(mcp)) {
           additional.mcpServers!.push({
-            name: new URL(_mcp).hostname,
-            url: _mcp,
-            // type: "streamable-http", // no need to exclude sse yet
+            name: new URL(mcp).hostname,
+            url: mcp,
           });
         } else {
-          packageIdentifiers.push(decodePackageIdentifier(_mcp));
+          packageIdentifiers.push(decodePackageIdentifier(mcp));
         }
       } catch (e) {
-        logger.warn(`Failed to add MCP server "${_mcp}": ${getErrorString(e)}`);
+        logger.warn(`Failed to add MCP server "${mcp}": ${getErrorString(e)}`);
       }
     }
+  }
 
-    // agent file rules can only be package identifiers
-    for (const r of agentFileState?.parsedRules || []) {
+  private processAgentFileRules(
+    agentFileState: AgentFileServiceState | undefined,
+    packageIdentifiers: PackageIdentifier[],
+  ): void {
+    for (const rule of agentFileState?.parsedRules || []) {
       try {
-        packageIdentifiers.push(decodePackageIdentifier(r));
+        packageIdentifiers.push(decodePackageIdentifier(rule));
       } catch (e) {
         logger.warn(
-          `Failed to get rule "${r} (from agent file)": ${getErrorString(e)}`,
+          `Failed to get rule "${rule} (from agent file)": ${getErrorString(e)}`,
         );
       }
     }
+  }
 
-    // Rule and prompt flags can be either package identifiers or strings
-    for (const _rule of [...rule, ...prompt]) {
+  private processRulesAndPrompts(
+    rules: string[],
+    prompts: string[],
+    packageIdentifiers: PackageIdentifier[],
+    additional: AssistantUnrolled,
+  ): void {
+    const allRulesAndPrompts = [...rules, ...prompts];
+
+    for (const item of allRulesAndPrompts) {
       try {
-        if (isStringRule(_rule)) {
-          additional.rules!.push(_rule);
+        if (isStringRule(item)) {
+          additional.rules!.push(item);
         } else {
-          packageIdentifiers.push(decodePackageIdentifier(_rule));
+          packageIdentifiers.push(decodePackageIdentifier(item));
         }
       } catch (e) {
         logger.warn(
-          `Failed to load rule or prompt "${_rule}": ${getErrorString(e)}`,
+          `Failed to load rule or prompt "${item}": ${getErrorString(e)}`,
         );
       }
     }
+  }
 
-    // Agent file prompt can only be a string
+  private processAgentFilePrompt(
+    agentFileState: AgentFileServiceState | undefined,
+    additional: AssistantUnrolled,
+  ): void {
     if (agentFileState?.agentFile?.prompt) {
       additional.prompts!.push({
         name: `Agent prompt (${agentFileState.agentFile.name})`,
         prompt: agentFileState.agentFile.prompt,
         description: agentFileState.agentFile.description,
       });
     }
+  }
 
-    // Todo ensure --model models take priority over config models
-    return {
-      injected: packageIdentifiers,
-      additional,
-    };
+  private isUrl(value: string): boolean {
+    return value.startsWith("http://") || value.startsWith("https://");
   }
 
   private async loadConfig(
diff --git a/extensions/cli/src/services/index.test.ts b/extensions/cli/src/services/index.test.ts
@@ -1,6 +1,6 @@
+import { Configuration, DefaultApi } from "@continuedev/sdk/dist/api";
 import { vi } from "vitest";
 
-import { Configuration, DefaultApi } from "@continuedev/sdk/dist/api";
 import { initializeServices, services } from "./index.js";
 
 // Mock the onboarding module
diff --git a/packages/config-yaml/src/load/unroll.ts b/packages/config-yaml/src/load/unroll.ts
@@ -215,6 +215,7 @@ export interface DoNotRenderSecretsUnrollAssistantOptions
 export interface RenderSecretsUnrollAssistantOptions
   extends BaseUnrollAssistantOptions {
   renderSecrets: true;
+  replaceInputsWithSecrets?: boolean;
   orgScopeId: string | null;
   currentUserSlug: string;
   platformClient: PlatformClient;
@@ -294,7 +295,7 @@ export async function unrollAssistantFromContent(
 
   // Convert all of the template variables to FQSNs
   // Secrets from the block will have the assistant slug prepended to the FQSN
-  const templatedYaml = renderTemplateData(rawUnrolledYaml, {
+  let templatedYaml = renderTemplateData(rawUnrolledYaml, {
     secrets: extractFQSNMap(rawUnrolledYaml, [id]),
   });
 
@@ -306,6 +307,10 @@ export async function unrollAssistantFromContent(
     };
   }
 
+  if (options.replaceInputsWithSecrets) {
+    templatedYaml = replaceInputsWithSecrets(templatedYaml);
+  }
+
   // Render secret values/locations for client
   const secrets = await extractRenderedSecretsMap(
     templatedYaml,

Original file line number	Diff line number	Diff line change
`@@ -382,6 +382,7 @@ export async function unrollPackageIdentifiersAsConfigYaml(`
`382`	`382`	`platformClient: new CLIPlatformClient(organizationId, apiClient),`
`383`	`383`	`renderSecrets: true,`
`384`	`384`	`injectBlocks: packageIdentifiers,`
	`385`	`+ replaceInputsWithSecrets: true,`
`385`	`386`	`},`
`386`	`387`	`);`
`387`	`388`	`if (!unrollResult?.config) {`
`@@ -515,7 +516,7 @@ async function loadAssistantSlug(`
`515`	`516`	`}`
`516`	`517`	`}`
`517`	`518`
`518`		`- return result.config as AssistantUnrolled;`
	`519`	`+ return apiConfig;`
`519`	`520`	`}`
`520`	`521`
`521`	`522`	`/**`