Extensions ignore --use-context and --config-file and get the current context's credentials
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- cli
Research direction
Start in the extension dispatch path in src/cli.ts (around lines 341-354), where loadCfg() is called without the parsed --use-context, --config-file or --command-profile values, then follow buildContextEnv in src/extension/context.ts. Compare with the early config sniffing at src/cli.ts:150-206. Done when the reproduction commands print URL=http://b.example:9200 ARGS=x for both flag positions, and tests cover global flags before and after the extension name.
Written by the indexing model from the issue text.
Description
Summary
Extensions always receive the env for the config file's current_context, ignoring --use-context and --config-file. The extension dispatch path in src/cli.ts (lines ~341-354) calls loadCfg() with no options, so buildContextEnv (src/extension/context.ts) builds ELASTIC_ES_URL/ELASTIC_ES_API_KEY/etc. from the default context. The early config load at src/cli.ts:150-206 doesn't help here: it sniffs --use-context/--config-file/--command-profile, but extension dispatch never threads those values into loadCfg().
A related symptom: dispatch forwards process.argv.slice(3), so when a global flag comes before the extension name, the flag, its value, and the extension name all get passed to the extension as positional args.
Reproduction
Built dist/cli.js, using a fake HOME so nothing touches the real ~/.elastic:
R=/tmp/a22; mkdir -p $R/home/.elastic $R/ext
printf '#!/bin/sh\necho "URL=$ELASTIC_ES_URL ARGS=$*"\n' > $R/ext/run; chmod +x $R/ext/run
echo "[{\"name\":\"dumpenv\",\"source\":\"local:$R/ext\",\"path\":\"$R/ext\",\"entrypoint\":\"$R/ext/run\"}]" > $R/home/.elastic/extensions.json
cat > $R/cfg.yml <<'Y'
current_context: a
contexts:
a: { elasticsearch: { url: "http://a.example:9200", auth: { api_key: "AAA" } } }
b: { elasticsearch: { url: "http://b.example:9200", auth: { api_key: "BBB" } } }
Y
export HOME=$R/home ELASTIC_CLI_CONFIG_FILE=$R/cfg.yml
node dist/cli.js --use-context b dumpenv x
node dist/cli.js dumpenv --use-context b x
unset ELASTIC_CLI_CONFIG_FILE; node dist/cli.js --config-file $R/cfg.yml dumpenv x
Actual:
URL=http://a.example:9200 ARGS=b dumpenv x
URL=http://a.example:9200 ARGS=--use-context b x
URL= ARGS=/tmp/a22/cfg.yml dumpenv x
Expected: URL=http://b.example:9200 ARGS=x for the first two commands. The third should use cfg.yml and output ARGS=x.
Notes
This is a security concern as well as a correctness one. A user who runs --use-context staging to keep a tool away from prod still hands the extension the prod credentials. The root banner check (earlyConfig.value.banner) isn't part of this bug, because earlyConfig is loaded with the sniffed overrides. Open PR #718 (#700) doesn't change the extension dispatch path.
Acceptance criteria
- Extension dispatch passes the parsed
--use-context,--config-fileand--command-profilevalues toloadConfig, and the extension env reflects the chosen context. - Global flags placed before the extension name are not forwarded to the extension as args.
- Tests cover both flag positions.
Related
#512, #576, #700, #718
authored by Pi Coding Agent (Claude Opus 5.5)
- Dominant language
- TypeScript
- Stars
- 47
- Forks
- 27
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 52
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from elastic/cli
-
feat: ship skills/elastic/SKILL.md for agent invocationPossibly taken @onatozmenn claimed this 16 days ago. Openenhancement
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 Half a day Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 20/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
Similar issues
-
A hung CI job runs for 6 hours before it is cancelledPossibly taken @Olanetsoft claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Olanetsoft/agent-lookout#110 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
thedotmack/claude-mem#4757 ·
Maintainers usually reply within 1 day
-
🐛 bug 🗺️ MCP OAuth
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
LibreChat-AI/LibreChat#17077 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100