Feat: Resolve runtime secret refs in tools and providers#2212
Closed
EvanNotFound wants to merge 1 commit intoHKUDS:nightlyfrom
Closed
Feat: Resolve runtime secret refs in tools and providers#2212EvanNotFound wants to merge 1 commit intoHKUDS:nightlyfrom
EvanNotFound wants to merge 1 commit intoHKUDS:nightlyfrom
Conversation
- add secret_refs helper to load file/exec based secrets at runtime - resolve MCP, web, shell, channels, and provider configs via secret refs - ensure CLI gateway/agent use resolved model and proxy values - keep config files storing literal secret ref expressions - extend tests for secret refs, MCP, web search, channels, and CLI config
Collaborator
|
Hi @EvanNotFound! Thanks for this contribution. I took a closer look at your implementation - it's quite comprehensive! However, I think there might be a simpler approach. Since nanobot already uses environment variables extensively, what if we just use This would: see: #2218 |
4 tasks
Author
|
@chengyongru i reviewed the pr in #2218 |
This was referenced Mar 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR implements #2172
Before this PR, Nanobot uses raw config object to access values. Both
load_configandsave_configoperates on the same raw config object, which means in order to add secret ref functionality, we need a runtime config as the middleman. However, adding a new layer of config object adds a lot of complexity and will require a full architectural change. So what I did here is building on top of the raw config. I added a helper to resolve secret references, and whenever a module needs secrets, it calls the helper to resolve the secrets at runtime.Code Changes
{file:...}and{exec:...}config values so secrets do not need to be stored directly in config.json.