Function readConfigForEmbedding

packages/cli/src/commands/doctor-pi.ts:269–289

(
    path: string,
    isProjectConfig: boolean,
)

}

function readConfigForEmbedding(
    path: string,
    isProjectConfig: boolean,
): Record<string, unknown> | null {
    if (!existsSync(path)) return null;
    try {
        const rawText = readFileSync(path, "utf-8");
        // SECURITY: project-level config must NOT expand {env:}/{file:} tokens —
        // a malicious repo could otherwise resolve {env:ANTHROPIC_API_KEY} into a
        // field we then send to a repo-chosen endpoint. Mirror the runtime loader
        // (isProjectConfig leaves tokens literal for project config).
        const substituted = substituteConfigVariables({
            text: rawText,
            configPath: path,
            isProjectConfig,
        });
        return parseJsonc(substituted.text) as Record<string, unknown>;
    } catch {
        return null;
    }
}

function classifyEmbeddingOutcome(outcome: EmbeddingProbeOutcome): CheckResult {
    switch (outcome.kind) {