Function substituteConfigVariables

packages/plugin/src/config/variable.ts:79–192

(input: SubstituteInput)

 * the subsequent JSONC parse.
 */
export function substituteConfigVariables(input: SubstituteInput): SubstituteResult {
    const warnings: string[] = [];
    let text = input.text;

    if (input.isProjectConfig) {
        const hasEnvTokens = ENV_PATTERN.test(text);
        const hasFileTokens = FILE_PATTERN.test(text);
        ENV_PATTERN.lastIndex = 0;
        FILE_PATTERN.lastIndex = 0;
        if (hasEnvTokens || hasFileTokens) {
            const tokenTypes = [
                hasEnvTokens ? "{env:}" : undefined,
                hasFileTokens ? "{file:}" : undefined,
            ]
                .filter(Boolean)
                .join(" and ");
            warnings.push(
                `Project-level config no longer supports ${tokenTypes} tokens for security reasons; leaving tokens literal. Move secret expansion to user-level config.`,
            );
        }
        return { text, warnings };
    }

    // Strip JSONC comments before substitution so tokens in comments cannot
    // trigger env/file side effects. The shared parser helper is string-aware,
    // so URL strings and literal comment markers inside strings are preserved.
    text = stripJsonComments(text);

    text = text.replace(ENV_PATTERN, (_, rawName: string) => {
        const varName = rawName.trim();
        const value = varName ? process.env[varName] : undefined;
        if (value === undefined || value === "") {
            warnings.push(
                `Environment variable ${varName} is not set (referenced via {env:${varName}}); using empty string`,
            );
            return "";
        }

        return JSON.stringify(value).slice(1, -1);
    });

    const fileMatches = Array.from(text.matchAll(FILE_PATTERN));
    if (fileMatches.length === 0) {
        return { text, warnings };
    }

    const configDir = input.configPath ? dirname(input.configPath) : process.cwd();

    let output = "";
    let cursor = 0;

    for (const match of fileMatches) {
        const token = match[0];
        const rawPath = match[1] ?? "";
        const index = match.index ?? 0;

        output += text.slice(cursor, index);
        cursor = index + token.length;