2c926c12e3
- Fix loadStoredEnvKeys divergent provider lists: add telegram_bot and custom-openai to wizard.ts (the canonical copy used by CLI), remove dead duplicate from onboarding.ts - Security: add SAFE_COMMAND_PREFIXES allowlist to resolveConfigValue to prevent arbitrary RCE via settings.json shell commands - Security: add TOFU (Trust On First Use) model for project-local extensions — skip untrusted .pi/extensions/ with stderr warning - Performance: debounce sql.js MemoryStorage persistence (500ms window) so rapid mutations coalesce into a single db.export()+writeFileSync - Fix double lstatSync call in tool-bootstrap.ts isRegularFile - Add 26 new tests covering all changes
32 lines
1.3 KiB
TypeScript
32 lines
1.3 KiB
TypeScript
import type { AuthStorage } from '@gsd/pi-coding-agent'
|
|
|
|
// ─── Env hydration ────────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Hydrate process.env from stored auth.json credentials for optional tool keys.
|
|
* Runs on every launch so extensions see Brave/Context7/Jina keys stored via the
|
|
* wizard on prior launches.
|
|
*/
|
|
export function loadStoredEnvKeys(authStorage: AuthStorage): void {
|
|
const providers: Array<[string, string]> = [
|
|
['brave', 'BRAVE_API_KEY'],
|
|
['brave_answers', 'BRAVE_ANSWERS_KEY'],
|
|
['context7', 'CONTEXT7_API_KEY'],
|
|
['jina', 'JINA_API_KEY'],
|
|
['tavily', 'TAVILY_API_KEY'],
|
|
['slack_bot', 'SLACK_BOT_TOKEN'],
|
|
['discord_bot', 'DISCORD_BOT_TOKEN'],
|
|
['telegram_bot', 'TELEGRAM_BOT_TOKEN'],
|
|
['groq', 'GROQ_API_KEY'],
|
|
['ollama-cloud', 'OLLAMA_API_KEY'],
|
|
['custom-openai', 'CUSTOM_OPENAI_API_KEY'],
|
|
]
|
|
for (const [provider, envVar] of providers) {
|
|
if (!process.env[envVar]) {
|
|
const cred = authStorage.get(provider)
|
|
if (cred?.type === 'api_key' && cred.key) {
|
|
process.env[envVar] = cred.key as string
|
|
}
|
|
}
|
|
}
|
|
}
|