feat(config): add nanocoder config to show resolved settings and th… - #1123
feat(config): add nanocoder config to show resolved settings and th…#1123AniketR10 wants to merge 4 commits into
nanocoder config to show resolved settings and th…#1123Conversation
Semgrep flagged the path walk in getAt as a prototype-pollution risk. Config keys come from user-written JSON, so `constructor`, `toString` and `__proto__` resolved up the prototype chain and reported values no file ever set. Three related spots, only the first of which semgrep saw: - getAt/hasAt now require Object.hasOwn at every segment, and getAt is a reduce rather than a traversal loop. - The built-in default lookup used `in`, which also walks the chain, so a config key named `toString` was reported as having a default. - Providers were accumulated into a plain object keyed by name, so a provider named `__proto__` reassigned the accumulator prototype and one named `constructor` made every layer look like it declared that provider. Adds a regression test covering all three; it fails if any fix is reverted.
There was a problem hiding this comment.
Pull request overview
Adds a new fast-path CLI command (nanocoder config) that surfaces the effective resolved configuration along with provenance (layer + source), including shadowed/ignored values and JSON output, without booting the interactive Ink app.
Changes:
- Introduces an effective-config resolver that computes effective values (via live loaders) and maps them back to raw sources/layers.
- Adds
nanocoder config list|show|diffCLI surface (with--json) and wires it into the top-level CLI fast path. - Documents the new command and adds a changeset entry.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| source/config/index.ts | Exports built-in default config objects for provenance labeling and reuses them in loaders. |
| source/config/effective-config.ts | New effective config resolver + redaction + provenance/shadowing logic. |
| source/config/effective-config.spec.ts | AVA tests covering resolver behavior and CLI output. |
| source/config/config-cli.ts | Text/JSON renderers and command dispatch for nanocoder config. |
| source/cli.tsx | Adds a config fast path command and help text entry. |
| docs/configuration/index.md | Documents nanocoder config usage and key precedence rules. |
| .changeset/effective-config-command.md | Changelog entry for the new feature. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@will-lamerton @akramcodez please review |
There was a problem hiding this comment.
Thanks @AniketR10! Overall, the implementation looks good and the PR is in a good condition. These are non-blocking suggestions, but it would be nice to have them included:
-
MCP server shadowing: It would be good if
config diffalso reported shadowed MCP servers under ignored values, similar to how provider shadowing is handled. -
MCP env origin: When the configuration comes from
NANOCODER_MCPSERVERS_FILE, it would be good to report that as the origin instead of always showingNANOCODER_MCPSERVERS. -
Additional test coverage: It would be nice to add coverage for the
--jsonpaths (config list --jsonandconfig show <key> --json) and MCP server credential redaction.
None of these are blockers - the current implementation looks solid. Just some small improvements that would make the PR even more complete.
|
@akramcodez have implemented the suggestions |
Description
Adds
nanocoder configso you can see your settings and which file each one came from.Settings come from four places: built-in defaults, your global config folder, the project folder, and
NANOCODER_*environment variables. Before this, finding out which one set a value meant opening all four by hand.Three commands:
nanocoder config list- every setting, its value, and the file it came fromnanocoder config show <key>0 one setting in detail, with its default and any values it beatnanocoder config diff- only what your files change, plus values that are set but not usedAll three take
--json.Worth knowing: settings are grouped into blocks like
autoCompact. Nanocoder takes the whole block from the first file that mentions it - it does not mix fields from two files. So if global setsthresholdandnotifyUser, and your project file sets onlythreshold, yournotifyUseris dropped and the built-in default is used. Nothing told you that before.config diffnow lists it under "Ignored values".Two smaller things: values show the way the app really uses them (write
threshold: 200, see95, because it's capped), and API keys show as<redacted>so output is safe to paste into an issue.Closes #1006.
Screencast.From.2026-09-01.22-50-28.mp4
Type of Change
Changeset
pnpm changeset) describing this change for the changelogTesting
Automated Tests
.spec.ts/tsxfilespnpm test:allcompletes successfully)14 new tests in
source/config/effective-config.spec.ts.source/config/passes 270 tests.test:types,test:lint,test:formatandtest:knipare all clean and the build succeeds. I have not run the fullpnpm test:allend to end.Manual Testing
Not applicable as this command only reads config files and prints them. It never contacts a provider. Tested by hand against a real global config plus a project config, checking value, layer, source file, shadowed values, and redaction.
Checklist
No logging needed — the command prints to stdout and exits.