Merge branch 'main' into read-document-fallback

uinstinct · uinstinct · commit 82050fc86822 · 2025-11-20T11:16:33.000+05:30
diff --git a/core/config/profile/doLoadConfig.ts b/core/config/profile/doLoadConfig.ts
@@ -348,7 +348,12 @@ export default async function doLoadConfig(options: {
     }
   });
 
-  if (newConfig.allowAnonymousTelemetry !== false) {
+  // VS Code has an IDE telemetry setting
+  // Since it's a security concern we use OR behavior on false
+  if (
+    newConfig.allowAnonymousTelemetry !== false &&
+    ideInfo.ideType === "vscode"
+  ) {
     if ((await ide.isTelemetryEnabled()) === false) {
       newConfig.allowAnonymousTelemetry = false;
     }
diff --git a/core/config/yaml/loadYaml.ts b/core/config/yaml/loadYaml.ts
@@ -9,7 +9,6 @@ import {
   ModelRole,
   PackageIdentifier,
   RegistryClient,
-  TEMPLATE_VAR_REGEX,
   unrollAssistant,
   validateConfigYaml,
 } from "@continuedev/config-yaml";
@@ -237,22 +236,6 @@ export async function configYamlToContinueConfig(options: {
     sourceFile: doc.sourceFile,
   }));
 
-  config.mcpServers?.forEach((mcpServer) => {
-    if ("args" in mcpServer) {
-      const mcpArgVariables =
-        mcpServer.args?.filter((arg) => TEMPLATE_VAR_REGEX.test(arg)) ?? [];
-
-      if (mcpArgVariables.length === 0) {
-        return;
-      }
-
-      localErrors.push({
-        fatal: false,
-        message: `MCP server "${mcpServer.name}" has unsubstituted variables in args: ${mcpArgVariables.join(", ")}. Please refer to https://docs.continue.dev/hub/secrets/secret-types for managing hub secrets.`,
-      });
-    }
-  });
-
   // Prompt files -
   try {
     const promptFiles = await getAllPromptFiles(ide, undefined, true);
diff --git a/core/context/mcp/MCPConnection.ts b/core/context/mcp/MCPConnection.ts
@@ -2,6 +2,10 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { fileURLToPath } from "url";
 
+import {
+  decodeSecretLocation,
+  getTemplateVariables,
+} from "@continuedev/config-yaml";
 import {
   SSEClientTransport,
   SseError,
@@ -163,6 +167,24 @@ class MCPConnection {
       }
     }
 
+    const vars = getTemplateVariables(JSON.stringify(this.options));
+    const unrendered = vars.map((v) => {
+      const stripped = v.replace("secrets.", "");
+      try {
+        return decodeSecretLocation(stripped).secretName;
+      } catch {
+        return stripped;
+      }
+    });
+
+    if (unrendered.length > 0) {
+      this.errors.push(
+        `${this.options.name} MCP Server has unresolved secrets: ${unrendered.join(", ")}.
+For personal use you can set the secret in the hub at https://hub.continue.dev/settings/secrets.
+Org-level secrets can only be used for MCP by Background Agents (https://docs.continue.dev/hub/agents/overview) when \"Include in Env\" is enabled.`,
+      );
+    }
+
     this.connectionPromise = Promise.race([
       // If aborted by a refresh or other, cancel and don't do anything
       new Promise((resolve) => {
diff --git a/docs/mission-control/index.mdx b/docs/mission-control/index.mdx
@@ -23,6 +23,44 @@ Mission Control is where developers and teams use Continue to power everyday cod
   </Card>
 </CardGroup>
 
+## Inbox: One Place to Triage, Assign, and Take Action
+
+<Info>
+The Inbox is your team's central queue for all AI-powered Tasks, agent activity, and first-class integrations like Sentry and Snyk. It gives developers a shared place to review work, delegate responsibility, and launch follow-up Tasks—all without leaving Mission Control.
+</Info>
+
+<CardGroup cols={4}>
+  <Card title="Unified View" icon="list">
+    See every incoming Task, Sentry alert, Snyk vulnerability, and workflow output in one place.
+  </Card>
+
+  <Card title="Powerful Filtering" icon="filter">
+    Slice the Inbox by Agent, repository, integration, creator, status, or time to surface what matters now.
+  </Card>
+
+  <Card title="Clear Ownership" icon="user-check">
+    Assign Sessions to teammates so responsibilities are explicit and reviews move forward.
+  </Card>
+
+  <Card title="Take Action Fast" icon="zap">
+    Launch follow-up Tasks, investigate errors, or generate fixes directly from the Inbox—no context switching.
+  </Card>
+</CardGroup>
+
+### First-Class Integration Tabs
+
+Some signals deserve their own dedicated view. When you connect integrations:
+
+<AccordionGroup>
+<Accordion title="Sentry">
+  See error events organized by project with occurrences, first/last seen timestamps, and one-click **Solve** actions that launch an Agent to investigate or generate a fix.
+</Accordion>
+
+<Accordion title="Snyk">
+  Review high-severity vulnerabilities, check CVSS scores, and trigger Agents to patch or upgrade dependencies.
+</Accordion>
+</AccordionGroup>
+
 ## Monitoring & Insights
 
 <Info>
diff --git a/docs/mission-control/tasks.mdx b/docs/mission-control/tasks.mdx
@@ -12,7 +12,7 @@ description: "A Task is a unit of work shared between you and an agent. You trig
   - An agent's capabilities (model, rules, tools, prompt)
   - Your codebase (repository and branch)
 
-  Tasks can be triggered manually, by events, or on a schedule.
+  Tasks can be triggered manually, by events, or on a schedule, and can be assigned to anyone on your team for review.
 
 </Info>
 
diff --git a/extensions/cli/src/services/MCPService.ts b/extensions/cli/src/services/MCPService.ts
@@ -1,3 +1,7 @@
+import {
+  decodeSecretLocation,
+  getTemplateVariables,
+} from "@continuedev/config-yaml";
 import { type AssistantConfig } from "@continuedev/sdk";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
@@ -311,7 +315,24 @@ export class MCPService
     this.connections.set(serverName, connection);
     this.updateState();
 
+    const vars = getTemplateVariables(JSON.stringify(serverConfig));
+    const secretVars = vars.filter((v) => v.startsWith("secrets."));
+    const unrendered = secretVars.map((v) => {
+      return decodeSecretLocation(v.replace("secrets.", "")).secretName;
+    });
+
     try {
+      if (unrendered.length > 0) {
+        const message = `${serverConfig.name} MCP Server has unresolved secrets: ${unrendered.join(", ")}
+For personal use you can set the secret in the hub at https://hub.continue.dev/settings/secrets or pass it to the CLI environment.
+Org-level secrets can only be used for MCP by Background Agents (https://docs.continue.dev/hub/agents/overview) when \"Include in Env\" is enabled for the secret.`;
+        if (this.isHeadless) {
+          throw new Error(message);
+        } else {
+          connection.warnings.push(message);
+        }
+      }
+
       const client = await this.getConnectedClient(serverConfig, connection);
 
       connection.client = client;
diff --git a/extensions/cli/src/systemMessage.ts b/extensions/cli/src/systemMessage.ts
@@ -171,7 +171,7 @@ export async function constructSystemMessage(
   // Add plan mode specific instructions if in plan mode
   if (mode === "plan") {
     systemMessage +=
-      '\n<context name="planMode">You are operating in _Plan Mode_, which means that your goal is to help the user investigate their ideas and develop a plan before taking action. You only have access to read-only tools and should not attempt to circumvent them to write / delete / create files. For example, it is not acceptable to use the Bash tool to write to files.</context>\n';
+      '\n<context name="planMode">You are operating in _Plan Mode_, which means that your goal is to help the user investigate their ideas and develop a plan before taking action. You only have access to read-only tools and should not attempt to circumvent them to write / delete / create files. Ask the user to switch to agent mode if they want to make changes. For example, it is not acceptable to use the Bash tool to write to files.</context>\n';
   } else {
     // Check if commit signature is disabled via environment variable
     if (!process.env.CONTINUE_CLI_DISABLE_COMMIT_SIGNATURE) {
diff --git a/extensions/intellij/gradle.properties b/extensions/intellij/gradle.properties
@@ -1,5 +1,5 @@
 pluginGroup=com.github.continuedev.continueintellijextension
-pluginVersion=1.0.52
+pluginVersion=1.0.55
 platformVersion=2024.1
 kotlin.stdlib.default.dependency=false
 org.gradle.configuration-cache=true
diff --git a/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/constants/MessageTypes.kt b/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/constants/MessageTypes.kt
@@ -4,7 +4,6 @@ class MessageTypes {
     companion object {
         val IDE_MESSAGE_TYPES = listOf(
             "readRangeInFile",
-            "isTelemetryEnabled",
             "getUniqueId",
             "getDiff",
             "getTerminalContents",
diff --git a/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/continue/IdeProtocolClient.kt b/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/continue/IdeProtocolClient.kt
@@ -162,11 +162,6 @@ class IdeProtocolClient(
                         respond(contents)
                     }
 
-                    "isTelemetryEnabled" -> {
-                        val isEnabled = ide.isTelemetryEnabled()
-                        respond(isEnabled)
-                    }
-
                     "readRangeInFile" -> {
                         val params = gsonService.gson.fromJson(
                             dataElement.toString(),
diff --git a/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/continue/IntelliJIde.kt b/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/continue/IntelliJIde.kt
@@ -191,10 +191,6 @@ class IntelliJIDE(
         return mapOf("text" to text)
     }
 
-    override suspend fun isTelemetryEnabled(): Boolean {
-        return true
-    }
-
     override suspend fun isWorkspaceRemote(): Boolean {
         return this.getIdeInfo().remoteName != "local"
     }
diff --git a/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/types.kt b/extensions/intellij/src/main/kotlin/com/github/continuedev/continueintellijextension/types.kt
@@ -166,8 +166,6 @@ interface IDE {
 
     suspend fun getClipboardContent(): Map<String, String>
 
-    suspend fun isTelemetryEnabled(): Boolean
-
     suspend fun isWorkspaceRemote(): Boolean
 
     suspend fun getUniqueId(): String
diff --git a/packages/openai-adapters/src/apis/openaiResponses.ts b/packages/openai-adapters/src/apis/openaiResponses.ts
@@ -34,7 +34,7 @@ import {
   ResponseUsage,
 } from "openai/resources/responses/responses.js";
 
-const RESPONSES_MODEL_REGEX = /^(?:gpt-5|gpt-5-codex|o)/i;
+const RESPONSES_MODEL_REGEX = /^(?:gpt-5|gpt-5-codex|o[0-9])/i;
 
 export function isResponsesModel(model: string): boolean {
   return !!model && RESPONSES_MODEL_REGEX.test(model);
diff --git a/packages/openai-adapters/src/test/customFetch-auth-override.vitest.ts b/packages/openai-adapters/src/test/customFetch-auth-override.vitest.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it } from "vitest";
+import { customFetch } from "../util.js";
+
+/**
+ * Tests for the letRequestOptionsOverrideAuthHeaders function in customFetch
+ *
+ * This function removes duplicate Authorization and x-api-key headers when
+ * custom headers are provided in requestOptions.headers.
+ *
+ * The logic being tested:
+ * 1. If requestOptions.headers contains Authorization or x-api-key
+ * 2. Remove those headers from init.headers (sent by OpenAI SDK)
+ * 3. Let fetchwithRequestOptions merge in the custom headers
+ * 4. Results in single, correct header (not duplicate)
+ */
+describe("customFetch - auth header override logic", () => {
+  it("should export customFetch function", () => {
+    expect(typeof customFetch).toBe("function");
+  });
+
+  it("should return a function when called", () => {
+    const result = customFetch({
+      headers: { "x-api-key": "test" },
+    });
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle requestOptions with Authorization header", () => {
+    const result = customFetch({
+      headers: { Authorization: "Bearer custom-token" },
+    });
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle requestOptions with x-api-key header", () => {
+    const result = customFetch({
+      headers: { "x-api-key": "custom-key" },
+    });
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle requestOptions with both auth headers", () => {
+    const result = customFetch({
+      headers: {
+        Authorization: "Bearer custom-token",
+        "x-api-key": "custom-key",
+      },
+    });
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle empty requestOptions", () => {
+    const result = customFetch({});
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle undefined requestOptions", () => {
+    const result = customFetch(undefined);
+    expect(typeof result).toBe("function");
+  });
+
+  it("should handle case variations in header names", () => {
+    // lowercase authorization
+    const result1 = customFetch({
+      headers: { authorization: "Bearer custom" },
+    });
+    expect(typeof result1).toBe("function");
+
+    // uppercase X-Api-Key
+    const result2 = customFetch({
+      headers: { "X-Api-Key": "custom" },
+    });
+    expect(typeof result2).toBe("function");
+  });
+});
+
+/**
+ * Note: Full integration testing of the header override logic requires
+ * mocking the entire fetch stack (@continuedev/fetch package) which is
+ * complex. The above tests verify the function structure and basic behavior.
+ *
+ * The actual header removal logic is tested end-to-end by:
+ * - Manual testing with MITRE AIP endpoints
+ * - Real-world usage showing duplicate headers are resolved
+ *
+ * Related issues:
+ * - #7047: Duplicate headers bug
+ * - #8684: Authorization header fix (this extends it)
+ */
diff --git a/packages/openai-adapters/src/util.ts b/packages/openai-adapters/src/util.ts
@@ -159,34 +159,51 @@ export function customFetch(
     return patchedFetch;
   }
 
-  function letRequestOptionsOverrideAuthorizationHeader(init: any): any {
-    if (
-      !init ||
-      !init.headers ||
-      !requestOptions ||
-      !requestOptions.headers ||
-      (!requestOptions.headers["Authorization"] &&
-        !requestOptions.headers["authorization"])
-    ) {
+  function letRequestOptionsOverrideAuthHeaders(init: any): any {
+    if (!init || !init.headers || !requestOptions || !requestOptions.headers) {
       return init;
     }
 
-    if (init.headers instanceof Headers) {
-      init.headers.delete("Authorization");
-    } else if (Array.isArray(init.headers)) {
-      init.headers = init.headers.filter(
-        (header: [string, string]) =>
-          (header[0] ?? "").toLowerCase() !== "authorization",
-      );
-    } else if (typeof init.headers === "object") {
-      delete init.headers["Authorization"];
-      delete init.headers["authorization"];
+    // Check if custom Authorization or x-api-key headers are provided
+    const hasCustomAuth =
+      requestOptions.headers["Authorization"] ||
+      requestOptions.headers["authorization"];
+    const hasCustomXApiKey =
+      requestOptions.headers["x-api-key"] ||
+      requestOptions.headers["X-Api-Key"];
+
+    // Remove default auth headers if custom ones are provided
+    if (hasCustomAuth || hasCustomXApiKey) {
+      if (init.headers instanceof Headers) {
+        if (hasCustomAuth) {
+          init.headers.delete("Authorization");
+        }
+        if (hasCustomXApiKey) {
+          init.headers.delete("x-api-key");
+        }
+      } else if (Array.isArray(init.headers)) {
+        init.headers = init.headers.filter((header: [string, string]) => {
+          const headerLower = (header[0] ?? "").toLowerCase();
+          if (hasCustomAuth && headerLower === "authorization") return false;
+          if (hasCustomXApiKey && headerLower === "x-api-key") return false;
+          return true;
+        });
+      } else if (typeof init.headers === "object") {
+        if (hasCustomAuth) {
+          delete init.headers["Authorization"];
+          delete init.headers["authorization"];
+        }
+        if (hasCustomXApiKey) {
+          delete init.headers["x-api-key"];
+          delete init.headers["X-Api-Key"];
+        }
+      }
     }
     return init;
   }
 
   return (req: URL | string | Request, init?: any) => {
-    init = letRequestOptionsOverrideAuthorizationHeader(init);
+    init = letRequestOptionsOverrideAuthHeaders(init);
     if (typeof req === "string" || req instanceof URL) {
       return fetchwithRequestOptions(req, init, requestOptions);
     } else {

Original file line number	Diff line number	Diff line change
`@@ -348,7 +348,12 @@ export default async function doLoadConfig(options: {`
`348`	`348`	`}`
`349`	`349`	`});`
`350`	`350`
`351`		`- if (newConfig.allowAnonymousTelemetry !== false) {`
	`351`	`+ // VS Code has an IDE telemetry setting`
	`352`	`+ // Since it's a security concern we use OR behavior on false`
	`353`	`+ if (`
	`354`	`+ newConfig.allowAnonymousTelemetry !== false &&`
	`355`	`+ ideInfo.ideType === "vscode"`
	`356`	`+ ) {`
`352`	`357`	`if ((await ide.isTelemetryEnabled()) === false) {`
`353`	`358`	`newConfig.allowAnonymousTelemetry = false;`
`354`	`359`	`}`