The previous approach read the live config.yml back through NIO to
recover the raw ^{ENV_VAR} tokens, on the assumption that SubstAgent
only intercepted java.io.FileInputStream. Current SubstAgent also hooks
sun.nio.fs.UnixNativeDispatcher and sun.nio.ch.FileDispatcherImpl, so
NIO reads come back substituted too and the tokens were unrecoverable.
Reading through a hard link with a non-config extension does not help
either. SubstAgent keys its cache by file descriptor number and only
sanity checks the inode, and a hard link shares the inode of the file it
points at, so a recycled descriptor matches an already consumed entry
and the read reports EOF instead of returning the real bytes.
Take the variable names from the default config bundled in the plugin
jar instead. A jar is not a config path, so that copy keeps its raw
placeholders, verified against the agent. A key is only rewritten when
its in-memory value equals the environment variable the default names
for it, which is the only way SubstAgent could have produced it.
Also use ^{ENV_VAR} for the database credentials, which is the syntax
SubstAgent expands.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
NotAlexNoyleandClaude Opus 5
04d31f8b8e