feat(agent-proxy): resolve connect config from flag, env, and .infisical.json

[saifsmailbox98]

Description 📣

Adds flag → env → .infisical.json config resolution to agent-proxy connect. Each setting can come from a flag, an env var, or .infisical.json, and an explicit flag always wins.

Setting	Flag	Env var	.infisical.json
Proxy address	--proxy	INFISICAL_AGENT_PROXY_ADDRESS	— (see below)
Environment	--env	INFISICAL_ENVIRONMENT	defaultEnvironment
Secret path	--path	INFISICAL_SECRET_PATH	defaultSecretPath

The proxy address is deliberately not read from .infisical.json. That file is usually committed to a repo, and unlike the other settings (which fail loudly if wrong), a bad proxy address would silently route all agent traffic and its auth token through the wrong host. It resolves from the flag or env var only.

Scoped to connect only. run, export, secrets, folder, and dynamic-secrets are untouched (byte-identical to before), so no existing command changes behavior. Resolution logic lives in util/helper.go and is unit-tested in util/resolve_test.go.

Companion docs PR: Infisical/infisical#7336

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-319-feat-agent-proxy-resolve-connect-config-from-flag-env-and-infi

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

Adds flag → env var → .infisical.json resolution for agent-proxy connect, replacing the previous requirement that --proxy and --env be passed as explicit flags. Resolution priority is explicit flag > env var > workspace file > flag default, implemented via four new helper functions (ResolveEnvironmentName, ResolveSecretPath, ResolveAgentProxyAddress, GetBoolFlagOrEnv) that key off cmd.Flags().Changed() rather than an empty-value check.

• The proxy address is intentionally excluded from .infisical.json lookup — only flags and INFISICAL_AGENT_PROXY_ADDRESS are accepted — with a clear code comment explaining the SSRF rationale (a committed file containing a malicious host would silently redirect the embedded JWT).
• DefaultSecretPath is added to WorkspaceConfigFile as a new .infisical.json field (omitempty, backward-compatible).
• All four resolvers are covered by new unit tests in resolve_test.go, with flag defaults matching the production command registration.

Confidence Score: 5/5

Safe to merge — the change is scoped to agent-proxy connect, leaves all other commands byte-identical, and the deliberate security trade-off (reading proxy address from env but not from .infisical.json) is correctly implemented and documented.

The resolver logic is straightforward and well-tested. The Changed() approach correctly distinguishes an explicit flag from a flag sitting at its default, which is the right technique when the default is a meaningful value (e.g., "/" for --path). The proxy address is not read from the committed workspace file, addressing the most significant SSRF vector. No auth bypass, credential leak, or broken validation paths were found.

No files require special attention.

Important Files Changed

Filename	Overview
packages/cmd/agent_proxy.go	Replaces inline flag reads with resolver helpers for env/path/proxy; delegation is clean and error messages improved
packages/util/helper.go	Four new resolver functions added: ResolveEnvironmentName, ResolveSecretPath, ResolveAgentProxyAddress, GetBoolFlagOrEnv — all use Changed() correctly to differentiate explicit flag vs default
packages/util/resolve_test.go	New unit tests covering all four resolver functions with flag, env, file, and default priority paths; flag defaults match production command registration
packages/util/secrets.go	GetSecretPathFromWorkspaceFile added, mirroring the existing GetEnvFromWorkspaceFile pattern
packages/models/cli.go	Adds DefaultSecretPath to WorkspaceConfigFile with omitempty; backward-compatible addition
packages/util/constants.go	Adds INFISICAL_ENVIRONMENT_NAME, INFISICAL_SECRET_PATH_NAME, and two agent-proxy-specific constant names

_{Reviews (2): Last reviewed commit: "fix(agent-proxy): do not source the prox..." | Re-trigger Greptile}

[saifsmailbox98]

On the greptile security note about the proxy address coming from .infisical.json — fair point. We have removed .infisical.json as a source for the proxy address, now it only comes from the flag or the env var. Added a test also to make sure the file is ignored.

[saifsmailbox98]

@greptile review